# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 04.03.2020 06:39:36.039 Process: id = "1" image_name = "us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe" page_root = "0x4b67a000" os_pid = "0xa18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa28 [0028.285] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0030.931] CoTaskMemAlloc (cb=0x8) returned 0x39fc50 [0031.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", nBufferLength=0x105, lpBuffer=0x26c3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpFilePart=0x0) returned 0x71 [0031.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", nBufferLength=0x105, lpBuffer=0x26c3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpFilePart=0x0) returned 0x71 [0031.028] VirtualProtect (in: lpAddress=0x1202068, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.034] VirtualProtect (in: lpAddress=0x1202068, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.034] VirtualProtect (in: lpAddress=0x1202080, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.034] VirtualProtect (in: lpAddress=0x1202080, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.034] VirtualProtect (in: lpAddress=0x1202090, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.035] VirtualProtect (in: lpAddress=0x1202090, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.035] VirtualProtect (in: lpAddress=0x1202098, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.035] VirtualProtect (in: lpAddress=0x1202098, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.035] VirtualProtect (in: lpAddress=0x12020bc, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.035] VirtualProtect (in: lpAddress=0x12020bc, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.035] VirtualProtect (in: lpAddress=0x12020c4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.035] VirtualProtect (in: lpAddress=0x12020c4, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.036] VirtualProtect (in: lpAddress=0x12020f0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.036] VirtualProtect (in: lpAddress=0x12020f0, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.036] VirtualProtect (in: lpAddress=0x1202100, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.036] VirtualProtect (in: lpAddress=0x1202100, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.036] VirtualProtect (in: lpAddress=0x1202108, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.036] VirtualProtect (in: lpAddress=0x1202108, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.036] VirtualProtect (in: lpAddress=0x1202110, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.037] VirtualProtect (in: lpAddress=0x1202110, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.037] VirtualProtect (in: lpAddress=0x1202128, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.037] VirtualProtect (in: lpAddress=0x1202128, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.037] VirtualProtect (in: lpAddress=0x1202130, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.037] VirtualProtect (in: lpAddress=0x1202130, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.037] VirtualProtect (in: lpAddress=0x1202150, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.037] VirtualProtect (in: lpAddress=0x1202150, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.037] VirtualProtect (in: lpAddress=0x1202158, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.038] VirtualProtect (in: lpAddress=0x1202158, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.038] VirtualProtect (in: lpAddress=0x1202160, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.038] VirtualProtect (in: lpAddress=0x1202160, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.038] VirtualProtect (in: lpAddress=0x12021d4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.038] VirtualProtect (in: lpAddress=0x12021d4, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.038] VirtualProtect (in: lpAddress=0x12021dc, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.038] VirtualProtect (in: lpAddress=0x12021dc, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.039] VirtualProtect (in: lpAddress=0x1202218, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.039] VirtualProtect (in: lpAddress=0x1202218, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.039] VirtualProtect (in: lpAddress=0x1202220, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.039] VirtualProtect (in: lpAddress=0x1202220, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.039] VirtualProtect (in: lpAddress=0x120225c, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.039] VirtualProtect (in: lpAddress=0x120225c, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.039] VirtualProtect (in: lpAddress=0x1202264, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.040] VirtualProtect (in: lpAddress=0x1202264, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.040] VirtualProtect (in: lpAddress=0x1202318, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.040] VirtualProtect (in: lpAddress=0x1202318, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.040] VirtualProtect (in: lpAddress=0x1202320, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.040] VirtualProtect (in: lpAddress=0x1202320, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.040] VirtualProtect (in: lpAddress=0x1202344, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.040] VirtualProtect (in: lpAddress=0x1202344, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.041] VirtualProtect (in: lpAddress=0x120234c, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.041] VirtualProtect (in: lpAddress=0x120234c, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.041] VirtualProtect (in: lpAddress=0x12023a0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.041] VirtualProtect (in: lpAddress=0x12023a0, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.041] VirtualProtect (in: lpAddress=0x12023a8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.041] VirtualProtect (in: lpAddress=0x12023a8, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.041] VirtualProtect (in: lpAddress=0x12023c0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.042] VirtualProtect (in: lpAddress=0x12023c0, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.042] VirtualProtect (in: lpAddress=0x12023c8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.042] VirtualProtect (in: lpAddress=0x12023c8, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.042] VirtualProtect (in: lpAddress=0x120241c, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.042] VirtualProtect (in: lpAddress=0x120241c, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.042] VirtualProtect (in: lpAddress=0x1202424, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.043] VirtualProtect (in: lpAddress=0x1202424, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.043] VirtualProtect (in: lpAddress=0x1202450, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.043] VirtualProtect (in: lpAddress=0x1202450, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.043] VirtualProtect (in: lpAddress=0x1202458, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.043] VirtualProtect (in: lpAddress=0x1202458, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.043] VirtualProtect (in: lpAddress=0x1202460, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.043] VirtualProtect (in: lpAddress=0x1202460, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.044] VirtualProtect (in: lpAddress=0x1202478, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.044] VirtualProtect (in: lpAddress=0x1202478, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.044] VirtualProtect (in: lpAddress=0x1202480, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.044] VirtualProtect (in: lpAddress=0x1202480, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.044] VirtualProtect (in: lpAddress=0x12024b0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.044] VirtualProtect (in: lpAddress=0x12024b0, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.044] VirtualProtect (in: lpAddress=0x12024b8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.045] VirtualProtect (in: lpAddress=0x12024b8, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.045] VirtualProtect (in: lpAddress=0x12024f4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.045] VirtualProtect (in: lpAddress=0x12024f4, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.045] VirtualProtect (in: lpAddress=0x12024fc, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.045] VirtualProtect (in: lpAddress=0x12024fc, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.045] VirtualProtect (in: lpAddress=0x1202514, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.045] VirtualProtect (in: lpAddress=0x1202514, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.046] VirtualProtect (in: lpAddress=0x120251c, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.046] VirtualProtect (in: lpAddress=0x120251c, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.046] VirtualProtect (in: lpAddress=0x120254c, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.046] VirtualProtect (in: lpAddress=0x120254c, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.046] VirtualProtect (in: lpAddress=0x1202554, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.046] VirtualProtect (in: lpAddress=0x1202554, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.046] VirtualProtect (in: lpAddress=0x120256c, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.047] VirtualProtect (in: lpAddress=0x120256c, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.047] VirtualProtect (in: lpAddress=0x1202574, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.047] VirtualProtect (in: lpAddress=0x1202574, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.047] VirtualProtect (in: lpAddress=0x12025ac, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.047] VirtualProtect (in: lpAddress=0x12025ac, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.047] VirtualProtect (in: lpAddress=0x12025bc, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.047] VirtualProtect (in: lpAddress=0x12025bc, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.048] VirtualProtect (in: lpAddress=0x1202a20, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.048] VirtualProtect (in: lpAddress=0x1202a20, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.048] VirtualProtect (in: lpAddress=0x1202a60, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.048] VirtualProtect (in: lpAddress=0x1202a60, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.048] VirtualProtect (in: lpAddress=0x1202a68, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.048] VirtualProtect (in: lpAddress=0x1202a68, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.048] VirtualProtect (in: lpAddress=0x1202bc4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.048] VirtualProtect (in: lpAddress=0x1202bc4, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.049] VirtualProtect (in: lpAddress=0x1202c00, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.049] VirtualProtect (in: lpAddress=0x1202c00, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.049] VirtualProtect (in: lpAddress=0x1202c10, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.049] VirtualProtect (in: lpAddress=0x1202c10, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.049] VirtualProtect (in: lpAddress=0x1202c30, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.049] VirtualProtect (in: lpAddress=0x1202c30, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.049] VirtualProtect (in: lpAddress=0x1202c98, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.050] VirtualProtect (in: lpAddress=0x1202c98, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.050] VirtualProtect (in: lpAddress=0x1202ca0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.050] VirtualProtect (in: lpAddress=0x1202ca0, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.050] VirtualProtect (in: lpAddress=0x1202ca8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.050] VirtualProtect (in: lpAddress=0x1202ca8, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.050] VirtualProtect (in: lpAddress=0x1202ccc, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.050] VirtualProtect (in: lpAddress=0x1202ccc, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.051] VirtualProtect (in: lpAddress=0x1202cd4, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.051] VirtualProtect (in: lpAddress=0x1202cd4, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.051] VirtualProtect (in: lpAddress=0x1202d00, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.051] VirtualProtect (in: lpAddress=0x1202d00, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.051] VirtualProtect (in: lpAddress=0x1202d10, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.051] VirtualProtect (in: lpAddress=0x1202d10, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.051] VirtualProtect (in: lpAddress=0x1202d18, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.052] VirtualProtect (in: lpAddress=0x1202d18, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.052] VirtualProtect (in: lpAddress=0x1202d20, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.052] VirtualProtect (in: lpAddress=0x1202d20, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.052] VirtualProtect (in: lpAddress=0x1202d40, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.052] VirtualProtect (in: lpAddress=0x1202d40, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.052] VirtualProtect (in: lpAddress=0x1202d60, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.052] VirtualProtect (in: lpAddress=0x1202d60, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.053] VirtualProtect (in: lpAddress=0x1202d70, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.053] VirtualProtect (in: lpAddress=0x1202d70, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.053] VirtualProtect (in: lpAddress=0x1202da0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.053] VirtualProtect (in: lpAddress=0x1202da0, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.053] VirtualProtect (in: lpAddress=0x1202f50, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.053] VirtualProtect (in: lpAddress=0x1202f50, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.053] VirtualProtect (in: lpAddress=0x1202f78, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.054] VirtualProtect (in: lpAddress=0x1202f78, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.054] VirtualProtect (in: lpAddress=0x1203074, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.054] VirtualProtect (in: lpAddress=0x1203074, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.054] VirtualProtect (in: lpAddress=0x120e718, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.054] VirtualProtect (in: lpAddress=0x120e718, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.054] VirtualProtect (in: lpAddress=0x1211f08, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.055] VirtualProtect (in: lpAddress=0x1211f08, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.055] VirtualProtect (in: lpAddress=0x1211f18, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.055] VirtualProtect (in: lpAddress=0x1211f18, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.055] VirtualProtect (in: lpAddress=0x1211f28, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.055] VirtualProtect (in: lpAddress=0x1211f28, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.055] VirtualProtect (in: lpAddress=0x1211f38, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.055] VirtualProtect (in: lpAddress=0x1211f38, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.055] VirtualProtect (in: lpAddress=0x1211f48, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.056] VirtualProtect (in: lpAddress=0x1211f48, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.056] VirtualProtect (in: lpAddress=0x1211f58, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.056] VirtualProtect (in: lpAddress=0x1211f58, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.056] VirtualProtect (in: lpAddress=0x1211f68, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.056] VirtualProtect (in: lpAddress=0x1211f68, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.056] VirtualProtect (in: lpAddress=0x1211f78, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.056] VirtualProtect (in: lpAddress=0x1211f78, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.057] VirtualProtect (in: lpAddress=0x1211f88, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.057] VirtualProtect (in: lpAddress=0x1211f88, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.057] VirtualProtect (in: lpAddress=0x1211fa8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.057] VirtualProtect (in: lpAddress=0x1211fa8, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.057] VirtualProtect (in: lpAddress=0x1211fb8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.058] VirtualProtect (in: lpAddress=0x1211fb8, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.058] VirtualProtect (in: lpAddress=0x1211fc0, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.058] VirtualProtect (in: lpAddress=0x1211fc0, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.058] VirtualProtect (in: lpAddress=0x1211fc8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.058] VirtualProtect (in: lpAddress=0x1211fc8, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.058] VirtualProtect (in: lpAddress=0x1211fe8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.058] VirtualProtect (in: lpAddress=0x1211fe8, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.059] VirtualProtect (in: lpAddress=0x1211ff8, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.059] VirtualProtect (in: lpAddress=0x1211ff8, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.059] VirtualProtect (in: lpAddress=0x1212018, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.059] VirtualProtect (in: lpAddress=0x1212018, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.059] VirtualProtect (in: lpAddress=0x1212028, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.059] VirtualProtect (in: lpAddress=0x1212028, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.059] VirtualProtect (in: lpAddress=0x1212038, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x20) returned 1 [0031.060] VirtualProtect (in: lpAddress=0x1212038, dwSize=0x4, flNewProtect=0x20, lpflOldProtect=0x26dc78 | out: lpflOldProtect=0x26dc78*=0x4) returned 1 [0031.098] LoadLibraryA (lpLibFileName="mscorjit.dll") returned 0x0 [0031.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="clrjit.dll", cchWideChar=10, lpMultiByteStr=0x26ca20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clrjit.dllvòþ\x07", lpUsedDefaultChar=0x0) returned 10 [0031.102] LoadLibraryA (lpLibFileName="clrjit.dll") returned 0x7fef2190000 [0031.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="getJit", cchWideChar=6, lpMultiByteStr=0x26ca20, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="getJit", lpUsedDefaultChar=0x0) returned 6 [0031.114] GetProcAddress (hModule=0x7fef2190000, lpProcName="getJit") returned 0x7fef2223750 [0031.201] GetCurrentProcessId () returned 0xa18 [0031.224] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x26bb70 | out: lpLuid=0x26bb70*(LowPart=0x14, HighPart=0)) returned 1 [0031.225] GetCurrentProcess () returned 0xffffffffffffffff [0031.225] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x26bb68 | out: TokenHandle=0x26bb68*=0x1dc) returned 1 [0031.226] AdjustTokenPrivileges (in: TokenHandle=0x1dc, DisableAllPrivileges=0, NewState=0x2659048*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0031.228] CloseHandle (hObject=0x1dc) returned 1 [0031.236] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa18) returned 0x1dc [0031.247] EnumProcessModules (in: hProcess=0x1dc, lphModule=0x265a030, cb=0x200, lpcbNeeded=0x26c9f0 | out: lphModule=0x265a030, lpcbNeeded=0x26c9f0) returned 1 [0031.249] GetModuleInformation (in: hProcess=0x1dc, hModule=0x1200000, lpmodinfo=0x265a2a0, cb=0x18 | out: lpmodinfo=0x265a2a0*(lpBaseOfDll=0x1200000, SizeOfImage=0x30000, EntryPoint=0x122814e)) returned 1 [0031.249] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.249] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x1200000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe") returned 0x4b [0031.251] CoTaskMemFree (pv=0x1a7719b0) [0031.251] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.251] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x1200000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe")) returned 0x71 [0031.251] CoTaskMemFree (pv=0x1a7719b0) [0031.252] GetModuleInformation (in: hProcess=0x1dc, hModule=0x77a60000, lpmodinfo=0x265c5e0, cb=0x18 | out: lpmodinfo=0x265c5e0*(lpBaseOfDll=0x77a60000, SizeOfImage=0x1a9000, EntryPoint=0x0)) returned 1 [0031.252] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.252] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x77a60000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0031.252] CoTaskMemFree (pv=0x1a7719b0) [0031.252] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.252] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x77a60000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0031.252] CoTaskMemFree (pv=0x1a7719b0) [0031.252] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fef9290000, lpmodinfo=0x265e788, cb=0x18 | out: lpmodinfo=0x265e788*(lpBaseOfDll=0x7fef9290000, SizeOfImage=0x6f000, EntryPoint=0x7fef9291134)) returned 1 [0031.252] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.252] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fef9290000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0031.253] CoTaskMemFree (pv=0x1a7719b0) [0031.253] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.253] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fef9290000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0031.253] CoTaskMemFree (pv=0x1a7719b0) [0031.253] GetModuleInformation (in: hProcess=0x1dc, hModule=0x77940000, lpmodinfo=0x2660930, cb=0x18 | out: lpmodinfo=0x2660930*(lpBaseOfDll=0x77940000, SizeOfImage=0x11f000, EntryPoint=0x77955ea0)) returned 1 [0031.253] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.253] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x77940000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0031.253] CoTaskMemFree (pv=0x1a7719b0) [0031.254] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.254] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x77940000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0031.254] CoTaskMemFree (pv=0x1a7719b0) [0031.254] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fefdc70000, lpmodinfo=0x2662ae8, cb=0x18 | out: lpmodinfo=0x2662ae8*(lpBaseOfDll=0x7fefdc70000, SizeOfImage=0x6b000, EntryPoint=0x7fefdc730e0)) returned 1 [0031.254] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.254] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fefdc70000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0031.254] CoTaskMemFree (pv=0x1a7719b0) [0031.254] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.254] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fefdc70000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0031.254] CoTaskMemFree (pv=0x1a7719b0) [0031.254] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7feff550000, lpmodinfo=0x2664cf8, cb=0x18 | out: lpmodinfo=0x2664cf8*(lpBaseOfDll=0x7feff550000, SizeOfImage=0xdb000, EntryPoint=0x7feff570760)) returned 1 [0031.255] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.255] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7feff550000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0031.255] CoTaskMemFree (pv=0x1a7719b0) [0031.255] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.255] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7feff550000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0031.255] CoTaskMemFree (pv=0x1a7719b0) [0031.255] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fefdee0000, lpmodinfo=0x2666eb0, cb=0x18 | out: lpmodinfo=0x2666eb0*(lpBaseOfDll=0x7fefdee0000, SizeOfImage=0x9f000, EntryPoint=0x7fefdee25a0)) returned 1 [0031.255] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.255] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fefdee0000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0031.256] CoTaskMemFree (pv=0x1a7719b0) [0031.256] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.256] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fefdee0000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0031.256] CoTaskMemFree (pv=0x1a7719b0) [0031.256] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7feffa30000, lpmodinfo=0x2669058, cb=0x18 | out: lpmodinfo=0x2669058*(lpBaseOfDll=0x7feffa30000, SizeOfImage=0x1f000, EntryPoint=0x7feffa360e8)) returned 1 [0031.256] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.256] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7feffa30000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0031.257] CoTaskMemFree (pv=0x1a7719b0) [0031.257] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.257] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7feffa30000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0031.257] CoTaskMemFree (pv=0x1a7719b0) [0031.257] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7feffb40000, lpmodinfo=0x266b200, cb=0x18 | out: lpmodinfo=0x266b200*(lpBaseOfDll=0x7feffb40000, SizeOfImage=0x12d000, EntryPoint=0x7feffb8ed50)) returned 1 [0031.257] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.257] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7feffb40000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0031.257] CoTaskMemFree (pv=0x1a7719b0) [0031.257] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.257] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7feffb40000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0031.258] CoTaskMemFree (pv=0x1a7719b0) [0031.258] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fef6d20000, lpmodinfo=0x266d440, cb=0x18 | out: lpmodinfo=0x266d440*(lpBaseOfDll=0x7fef6d20000, SizeOfImage=0x99000, EntryPoint=0x7fef6d22670)) returned 1 [0031.258] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.258] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fef6d20000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0031.258] CoTaskMemFree (pv=0x1a7719b0) [0031.258] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.258] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fef6d20000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll")) returned 0x3c [0031.259] CoTaskMemFree (pv=0x1a7719b0) [0031.259] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7feffac0000, lpmodinfo=0x266f630, cb=0x18 | out: lpmodinfo=0x266f630*(lpBaseOfDll=0x7feffac0000, SizeOfImage=0x71000, EntryPoint=0x7feffad1e20)) returned 1 [0031.259] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.259] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7feffac0000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0031.259] CoTaskMemFree (pv=0x1a7719b0) [0031.259] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.259] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7feffac0000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0031.260] CoTaskMemFree (pv=0x1a7719b0) [0031.260] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7feff8e0000, lpmodinfo=0x26717d8, cb=0x18 | out: lpmodinfo=0x26717d8*(lpBaseOfDll=0x7feff8e0000, SizeOfImage=0x67000, EntryPoint=0x7feff8eb03c)) returned 1 [0031.260] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.261] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7feff8e0000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0031.261] CoTaskMemFree (pv=0x1a7719b0) [0031.261] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.261] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7feff8e0000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0031.261] CoTaskMemFree (pv=0x1a7719b0) [0031.261] GetModuleInformation (in: hProcess=0x1dc, hModule=0x77840000, lpmodinfo=0x2673980, cb=0x18 | out: lpmodinfo=0x2673980*(lpBaseOfDll=0x77840000, SizeOfImage=0xfa000, EntryPoint=0x7785a2c8)) returned 1 [0031.262] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.262] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x77840000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0031.262] CoTaskMemFree (pv=0x1a7719b0) [0031.262] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.262] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x77840000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0031.262] CoTaskMemFree (pv=0x1a7719b0) [0031.262] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7feffcc0000, lpmodinfo=0x2675b28, cb=0x18 | out: lpmodinfo=0x2675b28*(lpBaseOfDll=0x7feffcc0000, SizeOfImage=0xe000, EntryPoint=0x7feffcc1080)) returned 1 [0031.263] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.263] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7feffcc0000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0031.263] CoTaskMemFree (pv=0x1a7719b0) [0031.263] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.263] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7feffcc0000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\LPK.dll" (normalized: "c:\\windows\\system32\\lpk.dll")) returned 0x1b [0031.263] CoTaskMemFree (pv=0x1a7719b0) [0031.263] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fefdf80000, lpmodinfo=0x2677cc0, cb=0x18 | out: lpmodinfo=0x2677cc0*(lpBaseOfDll=0x7fefdf80000, SizeOfImage=0xc9000, EntryPoint=0x7fefdffa874)) returned 1 [0031.264] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.264] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fefdf80000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0031.264] CoTaskMemFree (pv=0x1a7719b0) [0031.264] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.264] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fefdf80000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\USP10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")) returned 0x1d [0031.265] CoTaskMemFree (pv=0x1a7719b0) [0031.265] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7feffc70000, lpmodinfo=0x2679e68, cb=0x18 | out: lpmodinfo=0x2679e68*(lpBaseOfDll=0x7feffc70000, SizeOfImage=0x2e000, EntryPoint=0x7feffc71010)) returned 1 [0031.265] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.265] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7feffc70000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0031.265] CoTaskMemFree (pv=0x1a7719b0) [0031.265] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.265] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7feffc70000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0031.266] CoTaskMemFree (pv=0x1a7719b0) [0031.266] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fefddd0000, lpmodinfo=0x267c010, cb=0x18 | out: lpmodinfo=0x267c010*(lpBaseOfDll=0x7fefddd0000, SizeOfImage=0x109000, EntryPoint=0x7fefddd1064)) returned 1 [0031.266] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.266] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fefddd0000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0031.267] CoTaskMemFree (pv=0x1a7719b0) [0031.267] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.267] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fefddd0000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSCTF.dll" (normalized: "c:\\windows\\system32\\msctf.dll")) returned 0x1d [0031.267] CoTaskMemFree (pv=0x1a7719b0) [0031.267] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fefcb70000, lpmodinfo=0x267e2d0, cb=0x18 | out: lpmodinfo=0x267e2d0*(lpBaseOfDll=0x7fefcb70000, SizeOfImage=0xc000, EntryPoint=0x7fefcb71064)) returned 1 [0031.268] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.268] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fefcb70000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0031.268] CoTaskMemFree (pv=0x1a7719b0) [0031.268] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.268] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fefcb70000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0031.268] CoTaskMemFree (pv=0x1a7719b0) [0031.269] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fef3770000, lpmodinfo=0x2680478, cb=0x18 | out: lpmodinfo=0x2680478*(lpBaseOfDll=0x7fef3770000, SizeOfImage=0x987000, EntryPoint=0x7fef3773310)) returned 1 [0031.269] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.269] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fef3770000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0031.269] CoTaskMemFree (pv=0x1a7719b0) [0031.269] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.269] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fef3770000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll")) returned 0x37 [0031.270] CoTaskMemFree (pv=0x1a7719b0) [0031.270] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fef4380000, lpmodinfo=0x2682648, cb=0x18 | out: lpmodinfo=0x2682648*(lpBaseOfDll=0x7fef4380000, SizeOfImage=0xf7000, EntryPoint=0x7fef43a4d80)) returned 1 [0031.270] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.270] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fef4380000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0031.271] CoTaskMemFree (pv=0x1a7719b0) [0031.271] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.271] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fef4380000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0031.271] CoTaskMemFree (pv=0x1a7719b0) [0031.271] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fef22a0000, lpmodinfo=0x2684820, cb=0x18 | out: lpmodinfo=0x2684820*(lpBaseOfDll=0x7fef22a0000, SizeOfImage=0x14c9000, EntryPoint=0x0)) returned 1 [0031.272] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.272] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fef22a0000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0031.272] CoTaskMemFree (pv=0x1a7719b0) [0031.272] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.272] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fef22a0000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\70690ed034c632a010f791ea65e40064\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\70690ed034c632a010f791ea65e40064\\mscorlib.ni.dll")) returned 0x68 [0031.273] CoTaskMemFree (pv=0x1a7719b0) [0031.273] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7feff2a0000, lpmodinfo=0x2686a68, cb=0x18 | out: lpmodinfo=0x2686a68*(lpBaseOfDll=0x7feff2a0000, SizeOfImage=0x203000, EntryPoint=0x7feff2c3330)) returned 1 [0031.273] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.273] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7feff2a0000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0031.274] CoTaskMemFree (pv=0x1a7719b0) [0031.274] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.274] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7feff2a0000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0031.274] CoTaskMemFree (pv=0x1a7719b0) [0031.274] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fefd8a0000, lpmodinfo=0x2688c10, cb=0x18 | out: lpmodinfo=0x2688c10*(lpBaseOfDll=0x7fefd8a0000, SizeOfImage=0xf000, EntryPoint=0x7fefd8a1010)) returned 1 [0031.275] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.275] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fefd8a0000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0031.275] CoTaskMemFree (pv=0x1a7719b0) [0031.275] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.275] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fefd8a0000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0031.276] CoTaskMemFree (pv=0x1a7719b0) [0031.276] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fefc300000, lpmodinfo=0x268adc8, cb=0x18 | out: lpmodinfo=0x268adc8*(lpBaseOfDll=0x7fefc300000, SizeOfImage=0x56000, EntryPoint=0x7fefc30bbc0)) returned 1 [0031.276] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.276] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fefc300000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0031.277] CoTaskMemFree (pv=0x1a7719b0) [0031.277] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.277] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fefc300000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0031.277] CoTaskMemFree (pv=0x1a7719b0) [0031.277] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fef2190000, lpmodinfo=0x268cf70, cb=0x18 | out: lpmodinfo=0x268cf70*(lpBaseOfDll=0x7fef2190000, SizeOfImage=0x108000, EntryPoint=0x7fef219107c)) returned 1 [0031.278] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.278] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fef2190000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0031.279] CoTaskMemFree (pv=0x1a7719b0) [0031.279] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.279] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fef2190000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll")) returned 0x3a [0031.279] CoTaskMemFree (pv=0x1a7719b0) [0031.279] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7feff950000, lpmodinfo=0x268f150, cb=0x18 | out: lpmodinfo=0x268f150*(lpBaseOfDll=0x7feff950000, SizeOfImage=0xd7000, EntryPoint=0x7feff953274)) returned 1 [0031.280] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.280] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7feff950000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0031.280] CoTaskMemFree (pv=0x1a7719b0) [0031.280] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.280] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7feff950000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0031.281] CoTaskMemFree (pv=0x1a7719b0) [0031.281] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fef4da0000, lpmodinfo=0x2691308, cb=0x18 | out: lpmodinfo=0x2691308*(lpBaseOfDll=0x7fef4da0000, SizeOfImage=0x16000, EntryPoint=0x7fef4da107c)) returned 1 [0031.281] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.281] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fef4da0000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0031.282] CoTaskMemFree (pv=0x1a7719b0) [0031.282] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.282] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fef4da0000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll")) returned 0x3e [0031.283] CoTaskMemFree (pv=0x1a7719b0) [0031.283] GetModuleInformation (in: hProcess=0x1dc, hModule=0x7fef1570000, lpmodinfo=0x26934f8, cb=0x18 | out: lpmodinfo=0x26934f8*(lpBaseOfDll=0x7fef1570000, SizeOfImage=0xc13000, EntryPoint=0x0)) returned 1 [0031.283] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.283] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x7fef1570000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0031.284] CoTaskMemFree (pv=0x1a7719b0) [0031.284] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.284] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x7fef1570000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\76e0ae2162ace0d6430ce89ffdf32afa\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\76e0ae2162ace0d6430ce89ffdf32afa\\system.ni.dll")) returned 0x64 [0031.284] CoTaskMemFree (pv=0x1a7719b0) [0031.284] GetModuleInformation (in: hProcess=0x1dc, hModule=0x77c20000, lpmodinfo=0x2695738, cb=0x18 | out: lpmodinfo=0x2695738*(lpBaseOfDll=0x77c20000, SizeOfImage=0x7000, EntryPoint=0x77c2106c)) returned 1 [0031.285] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.285] GetModuleBaseNameW (in: hProcess=0x1dc, hModule=0x77c20000, lpBaseName=0x1a7719b0, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0031.286] CoTaskMemFree (pv=0x1a7719b0) [0031.286] CoTaskMemAlloc (cb=0x804) returned 0x1a7719b0 [0031.286] GetModuleFileNameExW (in: hProcess=0x1dc, hModule=0x77c20000, lpFilename=0x1a7719b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0031.286] CoTaskMemFree (pv=0x1a7719b0) [0031.286] CloseHandle (hObject=0x1dc) returned 1 [0031.383] CoTaskMemAlloc (cb=0x1) returned 0x39fde0 [0031.411] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x1000, flProtect=0x40) returned 0x140000 [0031.411] VirtualProtect (in: lpAddress=0x7fef2260300, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x26dd90 | out: lpflOldProtect=0x26dd90*=0x2) returned 1 [0031.414] VirtualProtect (in: lpAddress=0x7fef2260300, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x26dd90 | out: lpflOldProtect=0x26dd90*=0x40) returned 1 [0031.808] CoTaskMemAlloc (cb=0x6) returned 0x39fc70 [0031.824] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x26e800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0031.838] IsAppThemed () returned 0x1 [0031.839] CoTaskMemAlloc (cb=0xf0) returned 0x1a75b0d0 [0031.839] CreateActCtxA (pActCtx=0x26edd0) returned 0x1a744ea8 [0031.887] CoTaskMemFree (pv=0x1a75b0d0) [0031.912] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc16c [0031.912] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc16a [0031.922] CoTaskMemAlloc (cb=0x6) returned 0x39fcf0 [0031.923] CoTaskMemAlloc (cb=0x6) returned 0x39fc80 [0031.923] CoTaskMemAlloc (cb=0xb) returned 0x1a777a80 [0031.924] CoTaskMemAlloc (cb=0x56c) returned 0x1a789140 [0031.993] CoTaskMemAlloc (cb=0xb) returned 0x1a777b60 [0031.994] CoTaskMemAlloc (cb=0xb) returned 0x1a777ca0 [0032.007] GetLogicalDrives () returned 0x4 [0032.008] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x26e780, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0032.009] CoTaskMemAlloc (cb=0xf) returned 0x1a777c80 [0032.010] CoTaskMemAlloc (cb=0xc6) returned 0x1a7473a0 [0032.053] CoTaskMemAlloc (cb=0xf) returned 0x1a777c40 [0032.338] CoTaskMemAlloc (cb=0x13) returned 0x1a777cc0 [0032.339] CoTaskMemAlloc (cb=0xb0) returned 0x1a740230 [0032.353] CoTaskMemAlloc (cb=0x12) returned 0x1a777b00 [0032.355] CoTaskMemAlloc (cb=0xe) returned 0x1a777ae0 [0032.358] GetComputerNameW (in: lpBuffer=0x26ebf0, nSize=0x26ef18 | out: lpBuffer="XDUWTFONO", nSize=0x26ef18) returned 1 [0032.360] GetUserNameW (in: lpBuffer=0x26ebf0, pcbBuffer=0x26ef18 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x26ef18) returned 1 [0032.477] CoTaskMemAlloc (cb=0xb) returned 0x1a777c00 [0032.479] CoCreateGuid (in: pguid=0x26eed8 | out: pguid=0x26eed8*(Data1=0xfb8ef7ae, Data2=0x4487, Data3=0x4aea, Data4=([0]=0x96, [1]=0x5b, [2]=0x9f, [3]=0xe, [4]=0xa8, [5]=0x90, [6]=0x94, [7]=0x67))) returned 0x0 [0032.482] CoTaskMemAlloc (cb=0xb) returned 0x1a777aa0 [0032.484] GetTimeZoneInformation (in: lpTimeZoneInformation=0x26eba0 | out: lpTimeZoneInformation=0x26eba0) returned 0x2 [0032.488] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x26e9a8 | out: pTimeZoneInformation=0x26e9a8) returned 0x2 [0032.494] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x26e978 | out: phkResult=0x26e978*=0x1e8) returned 0x0 [0032.495] RegQueryValueExW (in: hKey=0x1e8, lpValueName="TZI", lpReserved=0x0, lpType=0x26e9b8, lpData=0x0, lpcbData=0x26e9b0*=0x0 | out: lpType=0x26e9b8*=0x3, lpData=0x0, lpcbData=0x26e9b0*=0x2c) returned 0x0 [0032.495] RegQueryValueExW (in: hKey=0x1e8, lpValueName="TZI", lpReserved=0x0, lpType=0x26e9b8, lpData=0x26a3090, lpcbData=0x26e9b0*=0x2c | out: lpType=0x26e9b8*=0x3, lpData=0x26a3090*, lpcbData=0x26e9b0*=0x2c) returned 0x0 [0032.496] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x26e778 | out: phkResult=0x26e778*=0x1ec) returned 0x0 [0032.496] RegQueryValueExW (in: hKey=0x1ec, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x26e7b8, lpData=0x0, lpcbData=0x26e7b0*=0x0 | out: lpType=0x26e7b8*=0x4, lpData=0x0, lpcbData=0x26e7b0*=0x4) returned 0x0 [0032.496] RegQueryValueExW (in: hKey=0x1ec, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x26e7b8, lpData=0x26e798, lpcbData=0x26e7b0*=0x4 | out: lpType=0x26e7b8*=0x4, lpData=0x26e798*=0x7d7, lpcbData=0x26e7b0*=0x4) returned 0x0 [0032.496] RegQueryValueExW (in: hKey=0x1ec, lpValueName="LastEntry", lpReserved=0x0, lpType=0x26e7b8, lpData=0x0, lpcbData=0x26e7b0*=0x0 | out: lpType=0x26e7b8*=0x4, lpData=0x0, lpcbData=0x26e7b0*=0x4) returned 0x0 [0032.496] RegQueryValueExW (in: hKey=0x1ec, lpValueName="LastEntry", lpReserved=0x0, lpType=0x26e7b8, lpData=0x26e798, lpcbData=0x26e7b0*=0x4 | out: lpType=0x26e7b8*=0x4, lpData=0x26e798*=0x7d8, lpcbData=0x26e7b0*=0x4) returned 0x0 [0032.496] RegQueryValueExW (in: hKey=0x1ec, lpValueName="2007", lpReserved=0x0, lpType=0x26e7b8, lpData=0x0, lpcbData=0x26e7b0*=0x0 | out: lpType=0x26e7b8*=0x3, lpData=0x0, lpcbData=0x26e7b0*=0x2c) returned 0x0 [0032.496] RegQueryValueExW (in: hKey=0x1ec, lpValueName="2007", lpReserved=0x0, lpType=0x26e7b8, lpData=0x26a38a8, lpcbData=0x26e7b0*=0x2c | out: lpType=0x26e7b8*=0x3, lpData=0x26a38a8*, lpcbData=0x26e7b0*=0x2c) returned 0x0 [0032.497] RegQueryValueExW (in: hKey=0x1ec, lpValueName="2008", lpReserved=0x0, lpType=0x26e7b8, lpData=0x0, lpcbData=0x26e7b0*=0x0 | out: lpType=0x26e7b8*=0x3, lpData=0x0, lpcbData=0x26e7b0*=0x2c) returned 0x0 [0032.497] RegQueryValueExW (in: hKey=0x1ec, lpValueName="2008", lpReserved=0x0, lpType=0x26e7b8, lpData=0x26a39b0, lpcbData=0x26e7b0*=0x2c | out: lpType=0x26e7b8*=0x3, lpData=0x26a39b0*, lpcbData=0x26e7b0*=0x2c) returned 0x0 [0032.497] RegCloseKey (hKey=0x1ec) returned 0x0 [0032.497] RegQueryValueExW (in: hKey=0x1e8, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x26e948, lpData=0x0, lpcbData=0x26e940*=0x0 | out: lpType=0x26e948*=0x1, lpData=0x0, lpcbData=0x26e940*=0x20) returned 0x0 [0032.497] RegQueryValueExW (in: hKey=0x1e8, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x26e948, lpData=0x26a3b80, lpcbData=0x26e940*=0x20 | out: lpType=0x26e948*=0x1, lpData="@tzres.dll,-670", lpcbData=0x26e940*=0x20) returned 0x0 [0032.498] RegQueryValueExW (in: hKey=0x1e8, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x26e948, lpData=0x0, lpcbData=0x26e940*=0x0 | out: lpType=0x26e948*=0x1, lpData=0x0, lpcbData=0x26e940*=0x20) returned 0x0 [0032.498] RegQueryValueExW (in: hKey=0x1e8, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x26e948, lpData=0x26a3bf0, lpcbData=0x26e940*=0x20 | out: lpType=0x26e948*=0x1, lpData="@tzres.dll,-672", lpcbData=0x26e940*=0x20) returned 0x0 [0032.498] RegQueryValueExW (in: hKey=0x1e8, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x26e948, lpData=0x0, lpcbData=0x26e940*=0x0 | out: lpType=0x26e948*=0x1, lpData=0x0, lpcbData=0x26e940*=0x20) returned 0x0 [0032.498] RegQueryValueExW (in: hKey=0x1e8, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x26e948, lpData=0x26a3c60, lpcbData=0x26e940*=0x20 | out: lpType=0x26e948*=0x1, lpData="@tzres.dll,-671", lpcbData=0x26e940*=0x20) returned 0x0 [0033.454] CoTaskMemAlloc (cb=0x20c) returned 0x1a792a60 [0033.454] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1a792a60 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0033.456] CoTaskMemFree (pv=0x1a792a60) [0033.457] CoTaskMemAlloc (cb=0x20c) returned 0x1a792a60 [0033.457] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x26e998, pwszFileMUIPath=0x1a792a60, pcchFileMUIPath=0x26e9a0, pululEnumerator=0x26e990 | out: pwszLanguage=0x0, pcchLanguage=0x26e998, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x26e9a0, pululEnumerator=0x26e990) returned 1 [0033.459] CoTaskMemFree (pv=0x0) [0033.459] CoTaskMemFree (pv=0x1a792a60) [0033.460] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x290001 [0033.463] CoTaskMemAlloc (cb=0x3ec) returned 0x1a78c1e0 [0033.463] LoadStringW (in: hInstance=0x290001, uID=0x29e, lpBuffer=0x1a78c1e0, cchBufferMax=500 | out: lpBuffer="(UTC+10:00) Canberra, Melbourne, Sydney") returned 0x27 [0033.463] CoTaskMemFree (pv=0x1a78c1e0) [0033.463] FreeLibrary (hLibModule=0x290001) returned 1 [0033.464] CoTaskMemAlloc (cb=0x20c) returned 0x1a792a60 [0033.464] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1a792a60 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0033.464] CoTaskMemFree (pv=0x1a792a60) [0033.464] CoTaskMemAlloc (cb=0x20c) returned 0x1a792a60 [0033.464] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x26e998, pwszFileMUIPath=0x1a792a60, pcchFileMUIPath=0x26e9a0, pululEnumerator=0x26e990 | out: pwszLanguage=0x0, pcchLanguage=0x26e998, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x26e9a0, pululEnumerator=0x26e990) returned 1 [0033.464] CoTaskMemFree (pv=0x0) [0033.464] CoTaskMemFree (pv=0x1a792a60) [0033.465] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x290001 [0033.465] CoTaskMemAlloc (cb=0x3ec) returned 0x1a78c1e0 [0033.465] LoadStringW (in: hInstance=0x290001, uID=0x2a0, lpBuffer=0x1a78c1e0, cchBufferMax=500 | out: lpBuffer="AUS Eastern Standard Time") returned 0x19 [0033.465] CoTaskMemFree (pv=0x1a78c1e0) [0033.465] FreeLibrary (hLibModule=0x290001) returned 1 [0033.466] CoTaskMemAlloc (cb=0x20c) returned 0x1a792a60 [0033.466] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1a792a60 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0033.466] CoTaskMemFree (pv=0x1a792a60) [0033.466] CoTaskMemAlloc (cb=0x20c) returned 0x1a792a60 [0033.466] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x26e998, pwszFileMUIPath=0x1a792a60, pcchFileMUIPath=0x26e9a0, pululEnumerator=0x26e990 | out: pwszLanguage=0x0, pcchLanguage=0x26e998, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x26e9a0, pululEnumerator=0x26e990) returned 1 [0033.466] CoTaskMemFree (pv=0x0) [0033.466] CoTaskMemFree (pv=0x1a792a60) [0033.466] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x290001 [0033.467] CoTaskMemAlloc (cb=0x3ec) returned 0x1a78c1e0 [0033.467] LoadStringW (in: hInstance=0x290001, uID=0x29f, lpBuffer=0x1a78c1e0, cchBufferMax=500 | out: lpBuffer="AUS Eastern Daylight Time") returned 0x19 [0033.467] CoTaskMemFree (pv=0x1a78c1e0) [0033.467] FreeLibrary (hLibModule=0x290001) returned 1 [0033.467] RegCloseKey (hKey=0x1e8) returned 0x0 [0033.469] CoTaskMemAlloc (cb=0xb) returned 0x1a777d40 [0033.470] CoTaskMemAlloc (cb=0x20c) returned 0x1a792a60 [0033.471] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a792a60 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.471] CoTaskMemFree (pv=0x1a792a60) [0033.471] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x26e950, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0033.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0033.472] CoTaskMemAlloc (cb=0x13) returned 0x1a777d60 [0033.474] CoTaskMemAlloc (cb=0xe) returned 0x1a777d80 [0033.503] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0033.504] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7fef9100000 [0033.969] AdjustWindowRectEx (in: lpRect=0x26ee20, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x26ee20) returned 1 [0033.972] GetCurrentProcess () returned 0xffffffffffffffff [0033.972] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x26ec30, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x26ec30*=0x20c) returned 1 [0033.982] GetCurrentActCtx (in: lphActCtx=0x26eb20 | out: lphActCtx=0x26eb20*=0x0) returned 1 [0033.982] ActivateActCtx (in: hActCtx=0x1a744ea8, lpCookie=0x26eb60 | out: hActCtx=0x1a744ea8, lpCookie=0x26eb60) returned 1 [0033.982] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0033.983] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7fefc4e0000 [0034.620] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77840000 [0034.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x26e840, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW", lpUsedDefaultChar=0x0) returned 14 [0034.620] GetProcAddress (hModule=0x77840000, lpProcName="DefWindowProcW") returned 0x77a8b0ac [0034.621] GetStockObject (i=5) returned 0x1900015 [0034.625] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0034.627] CoTaskMemAlloc (cb=0x5c) returned 0x1a798c60 [0034.627] RegisterClassW (lpWndClass=0x26e800) returned 0xc16b [0034.628] CoTaskMemFree (pv=0x1a798c60) [0034.628] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0034.628] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x1200000, lpParam=0x0) returned 0x5011c [0034.632] SetWindowLongPtrW (hWnd=0x5011c, nIndex=-4, dwNewLong=0x77a8b0ac) returned 0x1b37141c [0034.636] GetWindowLongPtrW (hWnd=0x5011c, nIndex=-4) returned 0x77a8b0ac [0034.639] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x26dc48 | out: phkResult=0x26dc48*=0x21c) returned 0x0 [0034.640] RegQueryValueExW (in: hKey=0x21c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x26dc98, lpData=0x0, lpcbData=0x26dc90*=0x0 | out: lpType=0x26dc98*=0x0, lpData=0x0, lpcbData=0x26dc90*=0x0) returned 0x2 [0034.640] RegQueryValueExW (in: hKey=0x21c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x26dc98, lpData=0x0, lpcbData=0x26dc90*=0x0 | out: lpType=0x26dc98*=0x0, lpData=0x0, lpcbData=0x26dc90*=0x0) returned 0x2 [0034.641] RegCloseKey (hKey=0x21c) returned 0x0 [0034.642] SetWindowLongPtrW (hWnd=0x5011c, nIndex=-4, dwNewLong=0x1b37146c) returned 0x77a8b0ac [0034.642] GetWindowLongPtrW (hWnd=0x5011c, nIndex=-4) returned 0x1b37146c [0034.642] GetWindowLongPtrW (hWnd=0x5011c, nIndex=-16) returned 0x6c10000 [0034.645] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc0e3 [0034.646] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc168 [0034.646] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x5011c, Msg=0x81, wParam=0x0, lParam=0x26e1e0) returned 0x1 [0034.646] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x5011c, Msg=0x83, wParam=0x0, lParam=0x26e290) returned 0x0 [0034.647] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x5011c, Msg=0x1, wParam=0x0, lParam=0x26e1e0) returned 0x0 [0034.647] GetClientRect (in: hWnd=0x5011c, lpRect=0x26dca0 | out: lpRect=0x26dca0) returned 1 [0034.647] GetWindowRect (in: hWnd=0x5011c, lpRect=0x26dca0 | out: lpRect=0x26dca0) returned 1 [0034.649] GetParent (hWnd=0x5011c) returned 0x0 [0034.649] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001834200000001) returned 1 [0034.651] CoTaskMemAlloc (cb=0x355) returned 0x1a78c1e0 [0034.744] CoTaskMemAlloc (cb=0x12) returned 0x1a777dc0 [0034.750] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0034.751] AdjustWindowRectEx (in: lpRect=0x26ee00, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26ee00) returned 1 [0034.751] CoTaskMemAlloc (cb=0xe) returned 0x1a777de0 [0034.759] CoTaskMemAlloc (cb=0xb) returned 0x1a777e00 [0034.787] GdiplusStartup (in: token=0x7fe93ff9990, input=0x26d598, output=0x26d648 | out: token=0x7fe93ff9990, output=0x26d648) returned 0x0 [0034.804] GdipCreateFontFamilyFromName (name="Segoe UI Light", fontCollection=0x0, fontFamily=0x26edb0) returned 0x0 [0034.830] GdipCreateFont (fontFamily=0x1b8191f0, emSize=0x7fef13ecd25, style=0, unit=0x3, font=0x26ac730) returned 0x0 [0034.847] GdipGetFontSize (font=0x1b81ae40, size=0x26ac738) returned 0x0 [0034.849] GetSystemDefaultLCID () returned 0x409 [0034.849] GetStockObject (i=17) returned 0x18a0025 [0034.851] GetObjectW (in: h=0x18a0025, c=92, pv=0x26eaf0 | out: pv=0x26eaf0) returned 92 [0034.852] GetDC (hWnd=0x0) returned 0x60109d6 [0034.858] CoTaskMemAlloc (cb=0x5c) returned 0x1a798c60 [0034.859] GdipCreateFontFromLogfontW (hdc=0x60109d6, logfont=0x1a798c60, font=0x26ec30) returned 0x0 [0034.978] CoTaskMemFree (pv=0x1a798c60) [0034.979] CoTaskMemAlloc (cb=0x5c) returned 0x1a798c60 [0034.979] CoTaskMemFree (pv=0x1a798c60) [0034.979] CoTaskMemAlloc (cb=0x5c) returned 0x1a798c60 [0034.980] CoTaskMemFree (pv=0x1a798c60) [0034.981] GdipGetFontUnit (font=0x1b9eff40, unit=0x26eba0) returned 0x0 [0034.981] GdipGetFontSize (font=0x1b9eff40, size=0x26ebac) returned 0x0 [0034.981] GdipGetFontStyle (font=0x1b9eff40, style=0x26eb98) returned 0x0 [0034.981] GdipGetFamily (font=0x1b9eff40, family=0x26eb90) returned 0x0 [0034.983] GdipGetFontSize (font=0x1b9eff40, size=0x26ad170) returned 0x0 [0034.983] ReleaseDC (hWnd=0x0, hDC=0x60109d6) returned 1 [0034.985] GetDC (hWnd=0x0) returned 0x60109d6 [0034.986] GdipCreateFromHDC (hdc=0x60109d6, graphics=0x26eba8) returned 0x0 [0034.991] GdipGetDpiY (graphics=0x1d0552e0, dpi=0x26ad348) returned 0x0 [0034.992] GdipGetFontHeight (font=0x1b9eff40, graphics=0x1d0552e0, height=0x26eba4) returned 0x0 [0034.993] GdipGetEmHeight (family=0x1b9ec5a0, style=0, EmHeight=0x26eba8) returned 0x0 [0034.994] GdipGetLineSpacing (family=0x1b9ec5a0, style=0, LineSpacing=0x26eba8) returned 0x0 [0034.995] GdipDeleteGraphics (graphics=0x1d0552e0) returned 0x0 [0034.995] ReleaseDC (hWnd=0x0, hDC=0x60109d6) returned 1 [0034.999] GdipCreateFont (fontFamily=0x1b9ec5a0, emSize=0x7fef13ecd25, style=0, unit=0x3, font=0x26ad2d8) returned 0x0 [0034.999] GdipGetFontSize (font=0x1b85f560, size=0x26ad2e0) returned 0x0 [0035.000] GdipDeleteFont (font=0x1b9eff40) returned 0x0 [0035.005] CoTaskMemAlloc (cb=0x12) returned 0x1a777e80 [0035.010] CoTaskMemAlloc (cb=0xb) returned 0x1a777ea0 [0035.012] CoTaskMemAlloc (cb=0x25) returned 0x1a798730 [0035.016] CoTaskMemAlloc (cb=0xaf) returned 0x1a7408f0 [0035.028] CoTaskMemAlloc (cb=0x6) returned 0x1a7763e0 [0035.030] CoTaskMemAlloc (cb=0x13) returned 0x1a777ec0 [0035.033] CoTaskMemAlloc (cb=0x6) returned 0x1a776400 [0035.035] CoTaskMemAlloc (cb=0xf) returned 0x1a777ee0 [0035.042] EtwEventRegister (in: ProviderId=0x26adba0, EnableCallback=0x1b3714bc, CallbackContext=0x0, RegHandle=0x26adb80 | out: RegHandle=0x26adb80) returned 0x0 [0035.050] CoTaskMemAlloc (cb=0xf) returned 0x1a777f20 [0035.052] CoTaskMemAlloc (cb=0x16) returned 0x1a777f40 [0035.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe.config", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe.config", lpFilePart=0x0) returned 0x78 [0035.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1 [0035.059] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x26ea50 | out: lpFileInformation=0x26ea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0035.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x26e930) returned 1 [0035.440] CoTaskMemAlloc (cb=0xc) returned 0x1a778080 [0035.441] CoTaskMemAlloc (cb=0x27) returned 0x1a798af0 [0035.442] CoTaskMemAlloc (cb=0xd) returned 0x1a778020 [0035.445] CoTaskMemAlloc (cb=0x4e) returned 0x1a7683b0 [0035.446] CoTaskMemAlloc (cb=0xf) returned 0x1a778060 [0035.447] CoTaskMemAlloc (cb=0x43) returned 0x1a78a470 [0035.449] CoTaskMemAlloc (cb=0xb) returned 0x1a7780a0 [0035.451] CoTaskMemAlloc (cb=0x12) returned 0x1a777f60 [0035.453] CoTaskMemAlloc (cb=0x2b) returned 0x1a796f70 [0035.454] CoTaskMemAlloc (cb=0x17) returned 0x1a79d010 [0035.455] CoTaskMemAlloc (cb=0x396) returned 0x1a79da80 [0035.466] CoTaskMemAlloc (cb=0x89) returned 0x1a74a530 [0035.467] CoTaskMemAlloc (cb=0x13) returned 0x1a79d030 [0035.468] CoTaskMemAlloc (cb=0x75) returned 0x1a764150 [0035.469] CoTaskMemAlloc (cb=0x1c) returned 0x1a798a60 [0035.471] CoTaskMemAlloc (cb=0x45) returned 0x1a78a560 [0035.473] CoTaskMemAlloc (cb=0xf) returned 0x1a79d050 [0035.476] CoTaskMemAlloc (cb=0x16) returned 0x1a79d070 [0035.568] GdipLoadImageFromStream (stream=0x2c0020, image=0x26e340) [0035.785] GdipImageForceValidation (image=0x1d0552e0) returned 0x0 [0035.785] GdipGetImageType (image=0x1d0552e0, type=0x26e338) returned 0x0 [0035.787] GdipGetImageRawFormat (image=0x1d0552e0, format=0x26e240*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0035.789] GdipImageGetFrameDimensionsCount (image=0x1d0552e0, count=0x26e240) returned 0x0 [0035.789] GdipImageGetFrameDimensionsList (image=0x1d0552e0, dimensionIDs=0x1a79d130*(Data1=0x48740022, Data2=0x7361, Data3=0x4368, Data4=([0]=0x6f, [1]=0x64, [2]=0x65, [3]=0x0, [4]=0x6e, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0 [0035.790] LocalFree (hMem=0x1a79d130) returned 0x0 [0035.840] GdipImageGetFrameCount (image=0x1d0552e0, dimensionID=0x26e238*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), count=0x26ea1b0) returned 0x0 [0035.843] CoTaskMemAlloc (cb=0x12) returned 0x1a79d130 [0035.847] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.847] AdjustWindowRectEx (in: lpRect=0x26ec68, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26ec68) returned 1 [0035.852] GetUserObjectInformationA (in: hObj=0x44, nIndex=1, pvInfo=0x26ed9c8, nLength=0xc, lpnLengthNeeded=0x26e8e0 | out: pvInfo=0x26ed9c8, lpnLengthNeeded=0x26e8e0) returned 1 [0035.855] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0035.855] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0035.856] GetClassInfoW (in: hInstance=0x1200000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x26eda88 | out: lpWndClass=0x26eda88) returned 0 [0035.857] CoTaskMemAlloc (cb=0x58) returned 0x1a7c6010 [0035.857] RegisterClassW (lpWndClass=0x26e6f0) returned 0xc166 [0035.857] CoTaskMemFree (pv=0x1a7c6010) [0035.857] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1200000, lpParam=0x0) returned 0x1c0270 [0035.860] NtdllDefWindowProc_W (hWnd=0x1c0270, Msg=0x83, wParam=0x0, lParam=0x26e110) returned 0x0 [0035.860] NtdllDefWindowProc_W (hWnd=0x1c0270, Msg=0x1, wParam=0x0, lParam=0x26e000) returned 0x0 [0035.860] NtdllDefWindowProc_W (hWnd=0x1c0270, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0035.860] NtdllDefWindowProc_W (hWnd=0x1c0270, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0035.863] GetSysColor (nIndex=10) returned 0xb4b4b4 [0035.863] GetSysColor (nIndex=2) returned 0xd1b499 [0035.863] GetSysColor (nIndex=9) returned 0x0 [0035.863] GetSysColor (nIndex=12) returned 0xababab [0035.863] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.863] GetSysColor (nIndex=20) returned 0xffffff [0035.863] GetSysColor (nIndex=16) returned 0xa0a0a0 [0035.863] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.863] GetSysColor (nIndex=16) returned 0xa0a0a0 [0035.863] GetSysColor (nIndex=21) returned 0x696969 [0035.863] GetSysColor (nIndex=22) returned 0xe3e3e3 [0035.863] GetSysColor (nIndex=20) returned 0xffffff [0035.863] GetSysColor (nIndex=18) returned 0x0 [0035.863] GetSysColor (nIndex=1) returned 0x0 [0035.863] GetSysColor (nIndex=27) returned 0xead1b9 [0035.863] GetSysColor (nIndex=28) returned 0xf2e4d7 [0035.863] GetSysColor (nIndex=17) returned 0x6d6d6d [0035.863] GetSysColor (nIndex=13) returned 0xff9933 [0035.863] GetSysColor (nIndex=14) returned 0xffffff [0035.863] GetSysColor (nIndex=26) returned 0xcc6600 [0035.864] GetSysColor (nIndex=11) returned 0xfcf7f4 [0035.864] GetSysColor (nIndex=3) returned 0xdbcdbf [0035.864] GetSysColor (nIndex=19) returned 0x544e43 [0035.864] GetSysColor (nIndex=24) returned 0xe1ffff [0035.864] GetSysColor (nIndex=23) returned 0x0 [0035.864] GetSysColor (nIndex=4) returned 0xf0f0f0 [0035.864] GetSysColor (nIndex=30) returned 0xf0f0f0 [0035.864] GetSysColor (nIndex=29) returned 0xff9933 [0035.864] GetSysColor (nIndex=7) returned 0x0 [0035.864] GetSysColor (nIndex=0) returned 0xc8c8c8 [0035.864] GetSysColor (nIndex=5) returned 0xffffff [0035.864] GetSysColor (nIndex=6) returned 0x646464 [0035.864] GetSysColor (nIndex=8) returned 0x0 [0035.865] CoTaskMemAlloc (cb=0x12) returned 0x1a79d210 [0035.868] CoTaskMemAlloc (cb=0x12) returned 0x1a79d270 [0035.871] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.871] AdjustWindowRectEx (in: lpRect=0x26ec68, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26ec68) returned 1 [0035.872] CoTaskMemAlloc (cb=0x12) returned 0x1a79d250 [0035.877] CoTaskMemAlloc (cb=0x12) returned 0x1a79d390 [0035.881] CoTaskMemAlloc (cb=0x12) returned 0x1a79d370 [0035.885] CoTaskMemAlloc (cb=0x12) returned 0x1a79d310 [0035.887] CoTaskMemAlloc (cb=0x12) returned 0x1a79d350 [0035.891] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.891] AdjustWindowRectEx (in: lpRect=0x26ed68, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x26ed68) returned 1 [0035.891] GetSystemMetrics (nIndex=59) returned 1460 [0035.891] GetSystemMetrics (nIndex=60) returned 920 [0035.891] GetSystemMetrics (nIndex=34) returned 132 [0035.891] GetSystemMetrics (nIndex=35) returned 38 [0035.891] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.891] AdjustWindowRectEx (in: lpRect=0x26eb28, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x26eb28) returned 1 [0035.891] CoTaskMemAlloc (cb=0xe) returned 0x1a79d330 [0035.893] CoTaskMemAlloc (cb=0x12) returned 0x1a79d3b0 [0035.896] GetCurrentThreadId () returned 0xa28 [0035.896] GetCurrentThreadId () returned 0xa28 [0035.901] CoTaskMemAlloc (cb=0x12) returned 0x1a79d1b0 [0035.904] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.904] AdjustWindowRectEx (in: lpRect=0x26eb40, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x26eb40) returned 1 [0035.904] AdjustWindowRectEx (in: lpRect=0x26ecb8, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x26ecb8) returned 1 [0035.904] GetSystemMetrics (nIndex=59) returned 1460 [0035.904] GetSystemMetrics (nIndex=60) returned 920 [0035.904] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.904] AdjustWindowRectEx (in: lpRect=0x26e8f0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x26e8f0) returned 1 [0035.904] AdjustWindowRectEx (in: lpRect=0x26ea78, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x26ea78) returned 1 [0035.907] CoTaskMemAlloc (cb=0x12) returned 0x1a79d2b0 [0035.909] CoTaskMemAlloc (cb=0x12) returned 0x1a79d1f0 [0035.912] CoTaskMemAlloc (cb=0x12) returned 0x1a79d1d0 [0035.913] CoTaskMemAlloc (cb=0x12) returned 0x1a79d170 [0035.915] CoTaskMemAlloc (cb=0x12) returned 0x1a79d2f0 [0035.917] CoTaskMemAlloc (cb=0x12) returned 0x1a79d230 [0035.919] CreateCompatibleDC (hdc=0x0) returned 0x170109b1 [0035.920] GetDC (hWnd=0x0) returned 0x60109d6 [0035.920] GdipCreateFromHDC (hdc=0x60109d6, graphics=0x26e988) returned 0x0 [0035.920] CoTaskMemAlloc (cb=0x5c) returned 0x1a798fe0 [0035.920] GdipGetLogFontW (font=0x1b85f560, graphics=0x1b86e110, logfontW=0x1a798fe0) returned 0x0 [0035.920] CoTaskMemFree (pv=0x1a798fe0) [0035.920] CoTaskMemAlloc (cb=0x5c) returned 0x1a798fe0 [0035.920] CoTaskMemFree (pv=0x1a798fe0) [0035.921] CoTaskMemAlloc (cb=0x5c) returned 0x1a798fe0 [0035.921] CoTaskMemFree (pv=0x1a798fe0) [0035.921] GdipDeleteGraphics (graphics=0x1b86e110) returned 0x0 [0035.921] ReleaseDC (hWnd=0x0, hDC=0x60109d6) returned 1 [0035.921] CoTaskMemAlloc (cb=0x5c) returned 0x1a798fe0 [0035.921] CreateFontIndirectW (lplf=0x1a798fe0) returned 0x110a09fc [0035.921] CoTaskMemFree (pv=0x1a798fe0) [0035.922] SelectObject (hdc=0x170109b1, h=0x110a09fc) returned 0x18a002e [0035.922] GetTextMetricsW (in: hdc=0x170109b1, lptm=0x26ec08 | out: lptm=0x26ec08) returned 1 [0035.923] GetTextExtentPoint32W (in: hdc=0x170109b1, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x26eeaa8 | out: psizl=0x26eeaa8) returned 1 [0035.925] SelectObject (hdc=0x170109b1, h=0x18a002e) returned 0x110a09fc [0035.926] DeleteDC (hdc=0x170109b1) returned 1 [0035.927] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.927] AdjustWindowRectEx (in: lpRect=0x26e870, dwStyle=0x2010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26e870) returned 1 [0035.927] GetCursorPos (in: lpPoint=0x26eeae0 | out: lpPoint=0x26eeae0*(x=10, y=201)) returned 1 [0035.928] GetSystemMetrics (nIndex=80) returned 1 [0035.929] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e620 | out: lpmi=0x26e620) returned 1 [0035.929] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x190109b1 [0035.930] GetDeviceCaps (hdc=0x190109b1, index=12) returned 32 [0035.930] GetDeviceCaps (hdc=0x190109b1, index=14) returned 1 [0035.930] DeleteDC (hdc=0x190109b1) returned 1 [0035.931] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e6f0 | out: lpmi=0x26e6f0) returned 1 [0035.931] AdjustWindowRectEx (in: lpRect=0x26eaf0, dwStyle=0x3010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26eaf0) returned 1 [0035.931] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.932] AdjustWindowRectEx (in: lpRect=0x26e760, dwStyle=0x2010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26e760) returned 1 [0035.932] GetCursorPos (in: lpPoint=0x26eef48 | out: lpPoint=0x26eef48*(x=10, y=201)) returned 1 [0035.932] MonitorFromPoint (pt=0xc90000000b, dwFlags=0x2) returned 0x10001 [0035.932] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e510 | out: lpmi=0x26e510) returned 1 [0035.932] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1a0109b1 [0035.932] GetDeviceCaps (hdc=0x1a0109b1, index=12) returned 32 [0035.932] GetDeviceCaps (hdc=0x1a0109b1, index=14) returned 1 [0035.932] DeleteDC (hdc=0x1a0109b1) returned 1 [0035.932] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e5e0 | out: lpmi=0x26e5e0) returned 1 [0035.932] AdjustWindowRectEx (in: lpRect=0x26e8e0, dwStyle=0x3010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26e8e0) returned 1 [0035.932] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.932] AdjustWindowRectEx (in: lpRect=0x26e650, dwStyle=0x2010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26e650) returned 1 [0035.932] GetCursorPos (in: lpPoint=0x26ef248 | out: lpPoint=0x26ef248*(x=10, y=201)) returned 1 [0035.932] MonitorFromPoint (pt=0xc90000000a, dwFlags=0x2) returned 0x10001 [0035.932] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e400 | out: lpmi=0x26e400) returned 1 [0035.932] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1b0109b1 [0035.932] GetDeviceCaps (hdc=0x1b0109b1, index=12) returned 32 [0035.933] GetDeviceCaps (hdc=0x1b0109b1, index=14) returned 1 [0035.933] DeleteDC (hdc=0x1b0109b1) returned 1 [0035.933] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e4d0 | out: lpmi=0x26e4d0) returned 1 [0035.933] AdjustWindowRectEx (in: lpRect=0x26e7d8, dwStyle=0x3010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26e7d8) returned 1 [0035.933] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.933] AdjustWindowRectEx (in: lpRect=0x26eb00, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26eb00) returned 1 [0035.933] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef9100000 [0035.933] AdjustWindowRectEx (in: lpRect=0x26e950, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e950) returned 1 [0035.935] GetCurrentActCtx (in: lphActCtx=0x26eec0 | out: lphActCtx=0x26eec0*=0x0) returned 1 [0035.935] ActivateActCtx (in: hActCtx=0x1a744ea8, lpCookie=0x26ef00 | out: hActCtx=0x1a744ea8, lpCookie=0x26ef00) returned 1 [0035.937] GetCurrentActCtx (in: lphActCtx=0x26eb50 | out: lphActCtx=0x26eb50*=0x1a744ea8) returned 1 [0035.937] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0035.937] AdjustWindowRectEx (in: lpRect=0x26ea70, dwStyle=0x2010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26ea70) returned 1 [0035.937] GetCursorPos (in: lpPoint=0x26ef748 | out: lpPoint=0x26ef748*(x=10, y=201)) returned 1 [0035.937] MonitorFromPoint (pt=0xcc0000000a, dwFlags=0x2) returned 0x10001 [0035.937] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e820 | out: lpmi=0x26e820) returned 1 [0035.937] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1c0109b1 [0035.937] GetDeviceCaps (hdc=0x1c0109b1, index=12) returned 32 [0035.937] GetDeviceCaps (hdc=0x1c0109b1, index=14) returned 1 [0035.937] DeleteDC (hdc=0x1c0109b1) returned 1 [0035.937] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e8f0 | out: lpmi=0x26e8f0) returned 1 [0035.937] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0035.937] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName="Form1", dwStyle=0x3010000, X=-1, Y=-1, nWidth=1264, nHeight=681, hWndParent=0x0, hMenu=0x0, hInstance=0x1200000, lpParam=0x0) returned 0x50114 [0035.938] SetWindowLongPtrW (hWnd=0x50114, nIndex=-4, dwNewLong=0x77a8b0ac) returned 0x1b37141c [0035.938] GetWindowLongPtrW (hWnd=0x50114, nIndex=-4) returned 0x77a8b0ac [0035.938] SetWindowLongPtrW (hWnd=0x50114, nIndex=-4, dwNewLong=0x1b371cbc) returned 0x77a8b0ac [0035.938] GetWindowLongPtrW (hWnd=0x50114, nIndex=-4) returned 0x1b371cbc [0035.938] GetWindowLongPtrW (hWnd=0x50114, nIndex=-16) returned 0x7c10000 [0035.938] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x81, wParam=0x0, lParam=0x26e210) returned 0x1 [0035.938] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x83, wParam=0x0, lParam=0x26e2c0) returned 0x0 [0036.033] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x1, wParam=0x0, lParam=0x26e1f0) returned 0x0 [0036.033] GetClientRect (in: hWnd=0x50114, lpRect=0x26dc70 | out: lpRect=0x26dc70) returned 1 [0036.033] GetWindowRect (in: hWnd=0x50114, lpRect=0x26dc70 | out: lpRect=0x26dc70) returned 1 [0036.034] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.034] GetWindowLongPtrW (hWnd=0x50114, nIndex=-16) returned 0x7c10000 [0036.034] AdjustWindowRectEx (in: lpRect=0x26d6f0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26d6f0) returned 1 [0036.034] GetCursorPos (in: lpPoint=0x26efb90 | out: lpPoint=0x26efb90*(x=10, y=201)) returned 1 [0036.034] MonitorFromPoint (pt=0x26c0000016e, dwFlags=0x2) returned 0x10001 [0036.034] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26d4a0 | out: lpmi=0x26d4a0) returned 1 [0036.035] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x200109b1 [0036.035] GetDeviceCaps (hdc=0x200109b1, index=12) returned 32 [0036.035] GetDeviceCaps (hdc=0x200109b1, index=14) returned 1 [0036.035] DeleteDC (hdc=0x200109b1) returned 1 [0036.035] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26d570 | out: lpmi=0x26d570) returned 1 [0036.035] AdjustWindowRectEx (in: lpRect=0x26d868, dwStyle=0x3010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26d868) returned 1 [0036.042] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.042] AdjustWindowRectEx (in: lpRect=0x26d658, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26d658) returned 1 [0036.044] SetWindowTextW (hWnd=0x50114, lpString="Form1") returned 1 [0036.044] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xc, wParam=0x0, lParam=0x26ee624) returned 0x1 [0036.046] GetStartupInfoW (in: lpStartupInfo=0x26f0308 | out: lpStartupInfo=0x26f0308*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0036.046] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x46, wParam=0x0, lParam=0x26e2a0) returned 0x0 [0036.046] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x83, wParam=0x1, lParam=0x26e270) returned 0x0 [0036.047] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26de78 | out: lpwndpl=0x26de78) returned 1 [0036.047] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x47, wParam=0x0, lParam=0x26e2a0) returned 0x0 [0036.047] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x3, wParam=0x0, lParam=0x160000) returned 0x0 [0036.047] GetClientRect (in: hWnd=0x50114, lpRect=0x26d3f0 | out: lpRect=0x26d3f0) returned 1 [0036.047] GetWindowRect (in: hWnd=0x50114, lpRect=0x26d3f0 | out: lpRect=0x26d3f0) returned 1 [0036.047] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.047] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.048] GetSystemMetrics (nIndex=42) returned 0 [0036.048] GetWindowTextW (in: hWnd=0x50114, lpString=0x26d030, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.048] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26d030) returned 0x5 [0036.048] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.048] GetWindowLongPtrW (hWnd=0x50114, nIndex=-16) returned 0x7c10000 [0036.048] AdjustWindowRectEx (in: lpRect=0x26ce70, dwStyle=0x2010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26ce70) returned 1 [0036.048] GetCursorPos (in: lpPoint=0x26f0498 | out: lpPoint=0x26f0498*(x=10, y=201)) returned 1 [0036.049] MonitorFromPoint (pt=0xc90000000a, dwFlags=0x2) returned 0x10001 [0036.049] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26cc20 | out: lpmi=0x26cc20) returned 1 [0036.049] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x210109b1 [0036.049] GetDeviceCaps (hdc=0x210109b1, index=12) returned 32 [0036.049] GetDeviceCaps (hdc=0x210109b1, index=14) returned 1 [0036.049] DeleteDC (hdc=0x210109b1) returned 1 [0036.049] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26ccf0 | out: lpmi=0x26ccf0) returned 1 [0036.049] AdjustWindowRectEx (in: lpRect=0x26cfe8, dwStyle=0x3010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26cfe8) returned 1 [0036.049] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.049] AdjustWindowRectEx (in: lpRect=0x26cdd8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26cdd8) returned 1 [0036.049] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x5, wParam=0x2, lParam=0x34605a0) returned 0x0 [0036.049] GetClientRect (in: hWnd=0x50114, lpRect=0x26dd10 | out: lpRect=0x26dd10) returned 1 [0036.049] GetWindowRect (in: hWnd=0x50114, lpRect=0x26dd10 | out: lpRect=0x26dd10) returned 1 [0036.064] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x83, wParam=0x1, lParam=0x26dc00) returned 0x0 [0036.065] GetParent (hWnd=0x50114) returned 0x0 [0036.066] GetStockObject (i=5) returned 0x1900015 [0036.066] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0036.066] CoTaskMemAlloc (cb=0x5c) returned 0x1a799050 [0036.067] RegisterClassW (lpWndClass=0x26e840) returned 0xc165 [0036.067] CoTaskMemFree (pv=0x1a799050) [0036.067] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0036.067] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1200000, lpParam=0x0) returned 0x30274 [0036.067] SetWindowLongPtrW (hWnd=0x30274, nIndex=-4, dwNewLong=0x77a8b0ac) returned 0x1b371d0c [0036.067] GetWindowLongPtrW (hWnd=0x30274, nIndex=-4) returned 0x77a8b0ac [0036.067] SetWindowLongPtrW (hWnd=0x30274, nIndex=-4, dwNewLong=0x1b371d5c) returned 0x77a8b0ac [0036.067] GetWindowLongPtrW (hWnd=0x30274, nIndex=-4) returned 0x1b371d5c [0036.067] GetWindowLongPtrW (hWnd=0x30274, nIndex=-16) returned 0x4c00000 [0036.067] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x24, wParam=0x0, lParam=0x26e2b0) returned 0x0 [0036.067] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x81, wParam=0x0, lParam=0x26e220) returned 0x1 [0036.067] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x83, wParam=0x0, lParam=0x26e2d0) returned 0x0 [0036.068] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x1, wParam=0x0, lParam=0x26e220) returned 0x0 [0036.068] SetWindowLongPtrW (hWnd=0x50114, nIndex=-8, dwNewLong=0x30274) returned 0x0 [0036.069] SendMessageW (hWnd=0x50114, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0036.069] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0036.069] SendMessageW (hWnd=0x50114, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0036.069] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0036.071] GetSystemMenu (hWnd=0x50114, bRevert=0) returned 0x0 [0036.071] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26eb58 | out: lpwndpl=0x26eb58) returned 1 [0036.071] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0036.071] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0036.071] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0036.071] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x0) returned 1 [0036.071] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0036.071] SetWindowLongPtrW (hWnd=0x50114, nIndex=-8, dwNewLong=0x30274) returned 0x30274 [0036.075] GetSystemMetrics (nIndex=11) returned 32 [0036.075] GetSystemMetrics (nIndex=12) returned 32 [0036.075] GetDC (hWnd=0x0) returned 0x150109ce [0036.075] GetDeviceCaps (hdc=0x150109ce, index=12) returned 32 [0036.075] GetDeviceCaps (hdc=0x150109ce, index=14) returned 1 [0036.076] ReleaseDC (hWnd=0x0, hDC=0x150109ce) returned 1 [0036.076] CreateIconFromResourceEx (presbits=0x26f38d0, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x50243 [0036.078] SendMessageW (hWnd=0x30274, Msg=0x80, wParam=0x1, lParam=0x50243) returned 0x0 [0036.078] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x80, wParam=0x1, lParam=0x50243) returned 0x0 [0036.078] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0xd, wParam=0x104, lParam=0x1af94850) returned 0x0 [0036.078] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0xd, wParam=0x104, lParam=0x1af94850) returned 0x0 [0036.080] SetWindowPos (hWnd=0x50114, hWndInsertAfter=0xffffffffffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0036.080] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x46, wParam=0x0, lParam=0x26eae0) returned 0x0 [0036.081] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x46, wParam=0x0, lParam=0x26eae0) returned 0x0 [0036.081] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x46, wParam=0x0, lParam=0x26eae0) returned 0x0 [0036.081] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x46, wParam=0x0, lParam=0x26eae0) returned 0x0 [0036.081] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0036.081] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0036.081] NtdllDefWindowProc_W (hWnd=0x1c0270, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0036.081] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0036.084] OleInitialize (pvReserved=0x0) returned 0x0 [0036.085] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x26e6c8 | out: lplpMessageFilter=0x26e6c8*=0x0) returned 0x0 [0036.096] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0036.098] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0036.098] GetParent (hWnd=0x50114) returned 0x0 [0036.099] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0036.100] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0036.100] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26e6b8 | out: lpwndpl=0x26e6b8) returned 1 [0036.100] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x47, wParam=0x0, lParam=0x26eae0) returned 0x0 [0036.100] GetClientRect (in: hWnd=0x50114, lpRect=0x26e550 | out: lpRect=0x26e550) returned 1 [0036.100] GetWindowRect (in: hWnd=0x50114, lpRect=0x26e550 | out: lpRect=0x26e550) returned 1 [0036.100] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.100] GetWindowLongPtrW (hWnd=0x50114, nIndex=-16) returned 0x7c10000 [0036.100] AdjustWindowRectEx (in: lpRect=0x26ea40, dwStyle=0x2010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26ea40) returned 1 [0036.100] GetCursorPos (in: lpPoint=0x26f4d80 | out: lpPoint=0x26f4d80*(x=10, y=201)) returned 1 [0036.100] MonitorFromPoint (pt=0xc60000000a, dwFlags=0x2) returned 0x10001 [0036.100] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e7f0 | out: lpmi=0x26e7f0) returned 1 [0036.100] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x39010276 [0036.100] GetDeviceCaps (hdc=0x39010276, index=12) returned 32 [0036.101] GetDeviceCaps (hdc=0x39010276, index=14) returned 1 [0036.101] DeleteDC (hdc=0x39010276) returned 1 [0036.101] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e8c0 | out: lpmi=0x26e8c0) returned 1 [0036.101] GetWindowLongPtrW (hWnd=0x50114, nIndex=-16) returned 0x7c10000 [0036.101] GetWindowLongPtrW (hWnd=0x50114, nIndex=-20) returned 0x10108 [0036.101] SetWindowLongPtrW (hWnd=0x50114, nIndex=-16, dwNewLong=0x3010000) returned 0x7c10000 [0036.101] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x26ea30) returned 0x0 [0036.101] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x26ea30) returned 0x0 [0036.101] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x46, wParam=0x0, lParam=0x26de30) returned 0x0 [0036.101] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x83, wParam=0x1, lParam=0x26de00) returned 0x0 [0036.102] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26da08 | out: lpwndpl=0x26da08) returned 1 [0036.102] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x47, wParam=0x0, lParam=0x26de30) returned 0x0 [0036.102] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x3, wParam=0x0, lParam=0xfffdfffd) returned 0x0 [0036.102] GetClientRect (in: hWnd=0x50114, lpRect=0x26cf80 | out: lpRect=0x26cf80) returned 1 [0036.102] GetWindowRect (in: hWnd=0x50114, lpRect=0x26cf80 | out: lpRect=0x26cf80) returned 1 [0036.102] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.102] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.102] GetSystemMetrics (nIndex=42) returned 0 [0036.102] GetWindowTextW (in: hWnd=0x50114, lpString=0x26cbc0, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.102] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26cbc0) returned 0x5 [0036.103] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.103] GetWindowLongPtrW (hWnd=0x50114, nIndex=-16) returned 0x7010000 [0036.103] AdjustWindowRectEx (in: lpRect=0x26ca00, dwStyle=0x2010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26ca00) returned 1 [0036.103] GetCursorPos (in: lpPoint=0x26f5160 | out: lpPoint=0x26f5160*(x=10, y=201)) returned 1 [0036.103] MonitorFromPoint (pt=0xc90000000a, dwFlags=0x2) returned 0x10001 [0036.103] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26c7b0 | out: lpmi=0x26c7b0) returned 1 [0036.103] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x340109fb [0036.103] GetDeviceCaps (hdc=0x340109fb, index=12) returned 32 [0036.103] GetDeviceCaps (hdc=0x340109fb, index=14) returned 1 [0036.103] DeleteDC (hdc=0x340109fb) returned 1 [0036.103] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26c880 | out: lpmi=0x26c880) returned 1 [0036.103] AdjustWindowRectEx (in: lpRect=0x26cb78, dwStyle=0x3010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26cb78) returned 1 [0036.103] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.103] AdjustWindowRectEx (in: lpRect=0x26c968, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26c968) returned 1 [0036.103] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x5, wParam=0x2, lParam=0x36205a6) returned 0x0 [0036.103] GetClientRect (in: hWnd=0x50114, lpRect=0x26d8a0 | out: lpRect=0x26d8a0) returned 1 [0036.103] GetWindowRect (in: hWnd=0x50114, lpRect=0x26d8a0 | out: lpRect=0x26d8a0) returned 1 [0036.104] SetWindowLongPtrW (hWnd=0x50114, nIndex=-20, dwNewLong=0x10000) returned 0x10008 [0036.104] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x26ea30) returned 0x0 [0036.104] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x26ea30) returned 0x0 [0036.104] SetWindowPos (hWnd=0x50114, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0036.104] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x46, wParam=0x0, lParam=0x26ea80) returned 0x0 [0036.104] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x83, wParam=0x1, lParam=0x26ea50) returned 0x0 [0036.104] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26e658 | out: lpwndpl=0x26e658) returned 1 [0036.105] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x47, wParam=0x0, lParam=0x26ea80) returned 0x0 [0036.105] GetClientRect (in: hWnd=0x50114, lpRect=0x26e4f0 | out: lpRect=0x26e4f0) returned 1 [0036.105] GetWindowRect (in: hWnd=0x50114, lpRect=0x26e4f0 | out: lpRect=0x26e4f0) returned 1 [0036.105] RedrawWindow (hWnd=0x50114, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0036.105] GetSystemMenu (hWnd=0x50114, bRevert=0) returned 0x0 [0036.105] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26eaf8 | out: lpwndpl=0x26eaf8) returned 1 [0036.105] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0036.105] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0036.105] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0036.105] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x0) returned 1 [0036.105] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0036.105] ShowWindow (hWnd=0x50114, nCmdShow=3) returned 0 [0036.106] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x46, wParam=0x0, lParam=0x26ec90) returned 0x0 [0036.110] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x83, wParam=0x1, lParam=0x26ec60) returned 0x0 [0036.110] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x46, wParam=0x0, lParam=0x26ec90) returned 0x0 [0036.112] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0036.112] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26e888 | out: lpwndpl=0x26e888) returned 1 [0036.112] GetClientRect (in: hWnd=0x50114, lpRect=0x26e7a0 | out: lpRect=0x26e7a0) returned 1 [0036.113] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.113] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.113] GetSystemMetrics (nIndex=42) returned 0 [0036.113] GetWindowTextW (in: hWnd=0x50114, lpString=0x26e510, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.113] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26e510) returned 0x5 [0036.113] GetClientRect (in: hWnd=0x50114, lpRect=0x26e588 | out: lpRect=0x26e588) returned 1 [0036.115] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x1b371dac, dwData=0x0) returned 1 [0036.115] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26dd80 | out: lpmi=0x26dd80) returned 1 [0036.115] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x3c0109fb [0036.115] GetDeviceCaps (hdc=0x3c0109fb, index=12) returned 32 [0036.115] GetDeviceCaps (hdc=0x3c0109fb, index=14) returned 1 [0036.115] DeleteDC (hdc=0x3c0109fb) returned 1 [0036.115] GetCurrentObject (hdc=0x350109dd, type=0x1) returned 0x1b00017 [0036.116] GetCurrentObject (hdc=0x350109dd, type=0x2) returned 0x1900010 [0036.116] GetCurrentObject (hdc=0x350109dd, type=0x7) returned 0x1050032 [0036.116] GetCurrentObject (hdc=0x350109dd, type=0x6) returned 0x18a002e [0036.116] SaveDC (hdc=0x350109dd) returned 1 [0036.117] GetNearestColor (hdc=0x350109dd, color=0xf0f0f0) returned 0xf0f0f0 [0036.119] CreateSolidBrush (color=0xf0f0f0) returned 0x3c100276 [0036.119] FillRect (hDC=0x350109dd, lprc=0x26e278, hbr=0x3c100276) returned 1 [0036.120] DeleteObject (ho=0x3c100276) returned 1 [0036.121] RestoreDC (hdc=0x350109dd, nSavedDC=-1) returned 1 [0036.132] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26e868 | out: lpwndpl=0x26e868) returned 1 [0036.132] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x47, wParam=0x0, lParam=0x26ec90) returned 0x0 [0036.132] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0036.132] GetClientRect (in: hWnd=0x50114, lpRect=0x26dde0 | out: lpRect=0x26dde0) returned 1 [0036.132] GetWindowRect (in: hWnd=0x50114, lpRect=0x26dde0 | out: lpRect=0x26dde0) returned 1 [0036.132] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.132] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.132] GetSystemMetrics (nIndex=42) returned 0 [0036.132] GetWindowTextW (in: hWnd=0x50114, lpString=0x26da20, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.132] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26da20) returned 0x5 [0036.133] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.133] GetWindowLongPtrW (hWnd=0x50114, nIndex=-16) returned 0x17010000 [0036.133] AdjustWindowRectEx (in: lpRect=0x26d860, dwStyle=0x2010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26d860) returned 1 [0036.133] GetCursorPos (in: lpPoint=0x26f6090 | out: lpPoint=0x26f6090*(x=10, y=201)) returned 1 [0036.133] MonitorFromPoint (pt=0xc700000008, dwFlags=0x2) returned 0x10001 [0036.133] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26d610 | out: lpmi=0x26d610) returned 1 [0036.133] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x3e0109fb [0036.133] GetDeviceCaps (hdc=0x3e0109fb, index=12) returned 32 [0036.133] GetDeviceCaps (hdc=0x3e0109fb, index=14) returned 1 [0036.133] DeleteDC (hdc=0x3e0109fb) returned 1 [0036.133] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26d6e0 | out: lpmi=0x26d6e0) returned 1 [0036.133] AdjustWindowRectEx (in: lpRect=0x26d9d8, dwStyle=0x3010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26d9d8) returned 1 [0036.133] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.133] AdjustWindowRectEx (in: lpRect=0x26d7c8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26d7c8) returned 1 [0036.133] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x5, wParam=0x2, lParam=0x38405a0) returned 0x0 [0036.133] GetClientRect (in: hWnd=0x50114, lpRect=0x26e700 | out: lpRect=0x26e700) returned 1 [0036.133] GetWindowRect (in: hWnd=0x50114, lpRect=0x26e700 | out: lpRect=0x26e700) returned 1 [0036.133] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.133] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.133] GetSystemMetrics (nIndex=42) returned 0 [0036.133] GetWindowTextW (in: hWnd=0x50114, lpString=0x26ea70, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.134] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26ea70) returned 0x5 [0036.134] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.134] GetWindowLongPtrW (hWnd=0x50114, nIndex=-16) returned 0x17010000 [0036.134] AdjustWindowRectEx (in: lpRect=0x26e8b0, dwStyle=0x12010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26e8b0) returned 1 [0036.134] GetCursorPos (in: lpPoint=0x26f65d8 | out: lpPoint=0x26f65d8*(x=10, y=201)) returned 1 [0036.134] MonitorFromPoint (pt=0x5500000449, dwFlags=0x2) returned 0x10001 [0036.134] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e660 | out: lpmi=0x26e660) returned 1 [0036.134] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x3f0109fb [0036.134] GetDeviceCaps (hdc=0x3f0109fb, index=12) returned 32 [0036.134] GetDeviceCaps (hdc=0x3f0109fb, index=14) returned 1 [0036.134] DeleteDC (hdc=0x3f0109fb) returned 1 [0036.134] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x26e730 | out: lpmi=0x26e730) returned 1 [0036.134] AdjustWindowRectEx (in: lpRect=0x26ea28, dwStyle=0x3010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x26ea28) returned 1 [0036.134] GetCurrentActCtx (in: lphActCtx=0x26e9d0 | out: lphActCtx=0x26e9d0*=0x1a744ea8) returned 1 [0036.134] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.135] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x26f69c0 | out: lpWndClass=0x26f69c0) returned 1 [0036.135] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0036.136] CoTaskMemAlloc (cb=0x58) returned 0x1a7c6190 [0036.136] RegisterClassW (lpWndClass=0x26e6b0) returned 0xc164 [0036.136] CoTaskMemFree (pv=0x1a7c6190) [0036.136] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0036.136] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName="\"Multi-line \\r\\nlabel\"", dwStyle=0x5600000d, X=417, Y=278, nWidth=538, nHeight=325, hWndParent=0x50114, hMenu=0x0, hInstance=0x1200000, lpParam=0x0) returned 0x3015e [0036.136] SetWindowLongPtrW (hWnd=0x3015e, nIndex=-4, dwNewLong=0x7fefc5861b4) returned 0x1b371dfc [0036.136] GetWindowLongPtrW (hWnd=0x3015e, nIndex=-4) returned 0x7fefc5861b4 [0036.136] SetWindowLongPtrW (hWnd=0x3015e, nIndex=-4, dwNewLong=0x1b371e4c) returned 0x7fefc5861b4 [0036.136] GetWindowLongPtrW (hWnd=0x3015e, nIndex=-4) returned 0x1b371e4c [0036.136] GetWindowLongPtrW (hWnd=0x3015e, nIndex=-16) returned 0x4600000d [0036.136] GetWindowLongPtrW (hWnd=0x3015e, nIndex=-12) returned 0x0 [0036.136] SetWindowLongPtrW (hWnd=0x3015e, nIndex=-12, dwNewLong=0x3015e) returned 0x0 [0036.136] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x81, wParam=0x0, lParam=0x26e090) returned 0x1 [0036.136] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x83, wParam=0x0, lParam=0x26e140) returned 0x0 [0036.137] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x1, wParam=0x0, lParam=0x26e050) returned 0x0 [0036.137] GetWindow (hWnd=0x3015e, uCmd=0x3) returned 0x0 [0036.137] GetClientRect (in: hWnd=0x3015e, lpRect=0x26da90 | out: lpRect=0x26da90) returned 1 [0036.137] GetWindowRect (in: hWnd=0x3015e, lpRect=0x26da90 | out: lpRect=0x26da90) returned 1 [0036.137] GetParent (hWnd=0x3015e) returned 0x50114 [0036.137] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50114, lpPoints=0x26da90, cPoints=0x2 | out: lpPoints=0x26da90) returned 0 [0036.138] SetWindowTextW (hWnd=0x3015e, lpString="\"Multi-line \\r\\nlabel\"") returned 1 [0036.138] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xc, wParam=0x0, lParam=0x26ee12c) returned 0x1 [0036.138] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x5, wParam=0x0, lParam=0x145021a) returned 0x0 [0036.138] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x3, wParam=0x0, lParam=0x11601a1) returned 0x0 [0036.138] GetClientRect (in: hWnd=0x3015e, lpRect=0x26dbe0 | out: lpRect=0x26dbe0) returned 1 [0036.138] GetWindowRect (in: hWnd=0x3015e, lpRect=0x26dbe0 | out: lpRect=0x26dbe0) returned 1 [0036.138] GetParent (hWnd=0x3015e) returned 0x50114 [0036.138] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50114, lpPoints=0x26dbe0, cPoints=0x2 | out: lpPoints=0x26dbe0) returned 0 [0036.139] SendMessageW (hWnd=0x3015e, Msg=0x2210, wParam=0x15e0001, lParam=0x3015e) returned 0x0 [0036.139] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x2210, wParam=0x15e0001, lParam=0x3015e) returned 0x0 [0036.139] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0036.139] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x46, wParam=0x0, lParam=0x26e120) returned 0x0 [0036.139] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0036.139] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x47, wParam=0x0, lParam=0x26e120) returned 0x0 [0036.139] GetClientRect (in: hWnd=0x3015e, lpRect=0x26db50 | out: lpRect=0x26db50) returned 1 [0036.139] GetWindowRect (in: hWnd=0x3015e, lpRect=0x26db50 | out: lpRect=0x26db50) returned 1 [0036.140] GetParent (hWnd=0x3015e) returned 0x50114 [0036.140] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50114, lpPoints=0x26db50, cPoints=0x2 | out: lpPoints=0x26db50) returned 0 [0036.140] GetParent (hWnd=0x3015e) returned 0x50114 [0036.140] GetParent (hWnd=0x3015e) returned 0x50114 [0036.140] GdipImageGetFrameDimensionsCount (image=0x1d0552e0, count=0x26ea70) returned 0x0 [0036.140] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1a79d6d0 [0036.140] GdipImageGetFrameDimensionsList (image=0x1d0552e0, dimensionIDs=0x1a79d6d0*(Data1=0x6e0070, Data2=0x6b, Data3=0x6e, Data4=([0]=0x6f, [1]=0x0, [2]=0x77, [3]=0x0, [4]=0x6e, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0 [0036.140] LocalFree (hMem=0x1a79d6d0) returned 0x0 [0036.140] GdipImageGetFrameCount (image=0x1d0552e0, dimensionID=0x26ea68*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), count=0x26f6ec8) returned 0x0 [0036.140] GdipImageGetFrameCount (image=0x1d0552e0, dimensionID=0x26eaf8*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), count=0x26f6ee8) returned 0x0 [0036.140] GdipGetPropertyItemSize (image=0x1d0552e0, propId=0x5100, size=0x26eb08) returned 0x0 [0036.144] LocalAlloc (uFlags=0x0, uBytes=0x144) returned 0x1a7e0180 [0036.144] GdipGetPropertyItem (image=0x1d0552e0, propId=0x5100, propSize=0x144, buffer=0x1a7e0180) returned 0x0 [0036.145] LocalFree (hMem=0x1a7e0180) returned 0x0 [0036.197] SendMessageW (hWnd=0x50114, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0036.197] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0036.198] GetParent (hWnd=0x3015e) returned 0x50114 [0036.198] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.198] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.198] GetSystemMetrics (nIndex=42) returned 0 [0036.198] GetWindowTextW (in: hWnd=0x50114, lpString=0x26e5f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.198] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26e5f0) returned 0x5 [0036.199] CoTaskMemAlloc (cb=0x215) returned 0x1a7930f0 [0036.239] CoTaskMemAlloc (cb=0xb) returned 0x1a79d750 [0036.240] GetCurrentProcessId () returned 0xa18 [0036.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x26e5f0 | out: SystemInformation=0x12641930, ResultLength=0x26e5f0*=0xfa00) returned 0x0 [0036.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x26e610 | out: SystemInformation=0x12641930, ResultLength=0x26e610*=0xfa00) returned 0x0 [0036.274] CoTaskMemAlloc (cb=0x12) returned 0x1a79d770 [0036.277] CoTaskMemAlloc (cb=0xf) returned 0x1a79d790 [0036.281] InvalidateRect (hWnd=0x50114, lpRect=0x0, bErase=1) returned 1 [0036.284] InvalidateRect (hWnd=0x3015e, lpRect=0x26e3d0, bErase=1) returned 1 [0036.284] CoTaskMemAlloc (cb=0x212) returned 0x1a793780 [0036.325] CoTaskMemAlloc (cb=0x14) returned 0x1a79d7b0 [0036.326] CoTaskMemAlloc (cb=0xe) returned 0x1a7e2b20 [0036.328] CoTaskMemAlloc (cb=0xb) returned 0x1a7e2b40 [0036.328] CoTaskMemAlloc (cb=0xf) returned 0x1a7e2b60 [0036.330] GetWindowTextLengthW (hWnd=0x3015e) returned 22 [0036.330] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x16 [0036.330] GetSystemMetrics (nIndex=42) returned 0 [0036.330] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e420, nMaxCount=23 | out: lpString="\"Multi-line \\r\\nlabel\"") returned 22 [0036.330] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x17, lParam=0x26e420) returned 0x16 [0036.330] GetWindowTextLengthW (hWnd=0x3015e) returned 22 [0036.330] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x16 [0036.330] GetSystemMetrics (nIndex=42) returned 0 [0036.330] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e3c0, nMaxCount=23 | out: lpString="\"Multi-line \\r\\nlabel\"") returned 22 [0036.330] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x17, lParam=0x26e3c0) returned 0x16 [0036.330] SetWindowTextW (hWnd=0x3015e, lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 1 [0036.330] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xc, wParam=0x0, lParam=0x27461e4) returned 0x1 [0036.330] GetStockObject (i=5) returned 0x1900015 [0036.331] GetDlgItem (hDlg=0x50114, nIDDlgItem=196958) returned 0x3015e [0036.331] SendMessageW (hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26dca0) returned 0x0 [0036.331] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26dca0) returned 0x0 [0036.331] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0036.332] CoTaskMemAlloc (cb=0x12) returned 0x1a7e2b80 [0036.336] CoTaskMemAlloc (cb=0x12) returned 0x1a7e2ba0 [0036.339] CoTaskMemAlloc (cb=0xe) returned 0x1a7e2bc0 [0036.344] GetModuleHandleW (lpModuleName=0x0) returned 0x1200000 [0036.344] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r12_ad1", lpWindowName="TimerNativeWindow", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x1200000, lpParam=0x0) returned 0x5015a [0036.344] SetWindowLongPtrW (hWnd=0x5015a, nIndex=-4, dwNewLong=0x77a8b0ac) returned 0x1b371d0c [0036.344] GetWindowLongPtrW (hWnd=0x5015a, nIndex=-4) returned 0x77a8b0ac [0036.344] SetWindowLongPtrW (hWnd=0x5015a, nIndex=-4, dwNewLong=0x1b371e9c) returned 0x77a8b0ac [0036.344] GetWindowLongPtrW (hWnd=0x5015a, nIndex=-4) returned 0x1b371e9c [0036.344] GetWindowLongPtrW (hWnd=0x5015a, nIndex=-16) returned 0x4c00000 [0036.344] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x5015a, Msg=0x24, wParam=0x0, lParam=0x26dbd0) returned 0x0 [0036.344] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x5015a, Msg=0x81, wParam=0x0, lParam=0x26db40) returned 0x1 [0036.344] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x5015a, Msg=0x83, wParam=0x0, lParam=0x26dbf0) returned 0x0 [0036.345] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x5015a, Msg=0x1, wParam=0x0, lParam=0x26db10) returned 0x0 [0036.345] SetTimer (hWnd=0x5015a, nIDEvent=0x1, uElapse=0x186a0, lpTimerFunc=0x0) returned 0x1 [0036.347] CoTaskMemAlloc (cb=0xe) returned 0x1a7e2c00 [0036.369] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0036.369] GetWindowThreadProcessId (in: hWnd=0x50114, lpdwProcessId=0x26e6b0 | out: lpdwProcessId=0x26e6b0) returned 0xa28 [0036.369] GetCurrentThreadId () returned 0xa28 [0036.370] PostMessageW (hWnd=0x50114, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0036.370] SetFocus (hWnd=0x50114) returned 0x50114 [0036.370] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.371] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.371] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.372] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.372] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.373] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0036.373] GetCurrentThreadId () returned 0xa28 [0036.373] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0036.373] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.373] IsWindowUnicode (hWnd=0x50114) returned 1 [0036.373] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.373] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.373] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.374] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.374] GetMessageA (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.374] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.374] DispatchMessageA (lpMsg=0x26ee10) returned 0x0 [0036.374] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.374] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0xc9000a) returned 0x1 [0036.374] IsWindowUnicode (hWnd=0x50114) returned 1 [0036.374] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.374] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0xc9000a) returned 0x1 [0036.375] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0036.375] SetCursor (hCursor=0x10007) returned 0x10007 [0036.375] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.375] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.381] _TrackMouseEvent (in: lpEventTrack=0x27477d0 | out: lpEventTrack=0x27477d0) returned 1 [0036.382] SendMessageW (hWnd=0x50114, Msg=0xc0e3, wParam=0x0, lParam=0x0) returned 0x0 [0036.382] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xc0e3, wParam=0x0, lParam=0x0) returned 0x0 [0036.382] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0xc9000a) returned 0x0 [0036.382] GetKeyState (nVirtKey=2) returned 0 [0036.382] GetKeyState (nVirtKey=4) returned 0 [0036.382] GetKeyState (nVirtKey=5) returned 0 [0036.382] GetKeyState (nVirtKey=6) returned 0 [0036.382] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.382] IsWindowUnicode (hWnd=0x50114) returned 1 [0036.382] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.382] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.382] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.383] BeginPaint (in: hWnd=0x50114, lpPaint=0x26e548 | out: lpPaint=0x26e548) returned 0x150109ce [0036.383] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26e068 | out: lpwndpl=0x26e068) returned 1 [0036.383] GetClientRect (in: hWnd=0x50114, lpRect=0x26df80 | out: lpRect=0x26df80) returned 1 [0036.383] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.383] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.384] GetSystemMetrics (nIndex=42) returned 0 [0036.384] GetWindowTextW (in: hWnd=0x50114, lpString=0x26dcf0, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.384] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26dcf0) returned 0x5 [0036.384] GetClientRect (in: hWnd=0x50114, lpRect=0x26dd68 | out: lpRect=0x26dd68) returned 1 [0036.384] GetCurrentObject (hdc=0x150109ce, type=0x1) returned 0x1b00017 [0036.384] GetCurrentObject (hdc=0x150109ce, type=0x2) returned 0x1900010 [0036.384] GetCurrentObject (hdc=0x150109ce, type=0x7) returned 0x1050032 [0036.384] GetCurrentObject (hdc=0x150109ce, type=0x6) returned 0x18a002e [0036.384] SaveDC (hdc=0x150109ce) returned 1 [0036.384] GetNearestColor (hdc=0x150109ce, color=0x6c4607) returned 0x6c4607 [0036.384] CreateSolidBrush (color=0x6c4607) returned 0x3d100276 [0036.384] FillRect (hDC=0x150109ce, lprc=0x26da58, hbr=0x3d100276) returned 1 [0036.384] DeleteObject (ho=0x3d100276) returned 1 [0036.384] RestoreDC (hdc=0x150109ce, nSavedDC=-1) returned 1 [0036.385] GdipCreateHalftonePalette () returned 0x2c0809d4 [0036.386] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0036.386] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.386] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.386] GetSystemMetrics (nIndex=42) returned 0 [0036.386] GetWindowTextW (in: hWnd=0x50114, lpString=0x26e3f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.386] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26e3f0) returned 0x5 [0036.386] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0036.386] EndPaint (hWnd=0x50114, lpPaint=0x26e4e8) returned 1 [0036.386] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.386] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.386] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.386] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.386] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.386] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0036.386] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0036.387] CreateCompatibleDC (hdc=0x60109d6) returned 0x200101b3 [0036.387] GetObjectType (h=0x60109d6) returned 0x3 [0036.388] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x2a0509d0 [0036.388] GetDIBits (in: hdc=0x60109d6, hbm=0x2a0509d0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.388] GetDIBits (in: hdc=0x60109d6, hbm=0x2a0509d0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.388] DeleteObject (ho=0x2a0509d0) returned 1 [0036.388] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x1b0501b8 [0036.388] SelectObject (hdc=0x200101b3, h=0x1b0501b8) returned 0x185000f [0036.388] GdipCreateFromHDC (hdc=0x200101b3, graphics=0x26e408) returned 0x0 [0036.389] GdipTranslateWorldTransform (graphics=0x1b86e570, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0036.390] GdipSetClipRectI (graphics=0x1b86e570, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0036.411] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0036.411] GdipGetWorldTransform (graphics=0x1b86e570, matrix=0x1b86e940) returned 0x0 [0036.412] GdipIsMatrixIdentity (matrix=0x1b86e940, result=0x26e518) returned 0x0 [0036.413] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d3fe0 [0036.413] GdipGetMatrixElements (matrix=0x1b86e940, matrixOut=0x1a7d3fe0) returned 0x0 [0036.413] LocalFree (hMem=0x1a7d3fe0) returned 0x0 [0036.413] GdipDeleteMatrix (matrix=0x1b86e940) returned 0x0 [0036.464] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0036.464] GdipGetClip (graphics=0x1b86e570, region=0x1b86e250) returned 0x0 [0036.466] GdipIsInfiniteRegion (region=0x1b86e250, graphics=0x1b86e570, result=0x26e510) returned 0x0 [0036.467] GdipSaveGraphics (graphics=0x1b86e570, state=0x26e5b0) returned 0x0 [0036.468] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.468] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.468] GetSystemMetrics (nIndex=42) returned 0 [0036.468] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.468] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.468] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0036.473] IsAppThemed () returned 0x1 [0036.474] GetThemeAppProperties () returned 0x3 [0036.474] GetThemeAppProperties () returned 0x3 [0036.474] OpenThemeData () returned 0x30002 [0036.477] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0036.477] GdipGetClip (graphics=0x1b86e570, region=0x1b86e310) returned 0x0 [0036.477] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0036.477] GdipGetWorldTransform (graphics=0x1b86e570, matrix=0x1d0562e0) returned 0x0 [0036.477] GdipIsMatrixIdentity (matrix=0x1d0562e0, result=0x26e158) returned 0x0 [0036.477] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d3fa0 [0036.477] GdipGetMatrixElements (matrix=0x1d0562e0, matrixOut=0x1a7d3fa0) returned 0x0 [0036.477] LocalFree (hMem=0x1a7d3fa0) returned 0x0 [0036.478] GdipCombineRegionRegion (region=0x1b86e310, region2=0x1b86e250, combineMode=0x1) returned 0x0 [0036.478] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d3fa0 [0036.478] GdipGetMatrixElements (matrix=0x1d0562e0, matrixOut=0x1a7d3fa0) returned 0x0 [0036.478] LocalFree (hMem=0x1a7d3fa0) returned 0x0 [0036.478] GdipDeleteMatrix (matrix=0x1d0562e0) returned 0x0 [0036.478] GdipIsInfiniteRegion (region=0x1b86e310, graphics=0x1b86e570, result=0x26e1c0) returned 0x0 [0036.478] GdipIsInfiniteRegion (region=0x1b86e310, graphics=0x1b86e570, result=0x26e180) returned 0x0 [0036.479] GdipGetRegionHRgn (region=0x1b86e310, graphics=0x1b86e570, hRgn=0x26e180) returned 0x0 [0036.480] GdipDeleteRegion (region=0x1b86e310) returned 0x0 [0036.480] GdipGetDC (graphics=0x1b86e570, hdc=0x26e1c8) returned 0x0 [0036.481] GetCurrentObject (hdc=0x200101b3, type=0x1) returned 0x1b00017 [0036.481] GetCurrentObject (hdc=0x200101b3, type=0x2) returned 0x1900010 [0036.481] GetCurrentObject (hdc=0x200101b3, type=0x7) returned 0x1b0501b8 [0036.481] GetCurrentObject (hdc=0x200101b3, type=0x6) returned 0x18a002e [0036.481] SaveDC (hdc=0x200101b3) returned 1 [0036.482] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x320409ff [0036.483] GetClipRgn (hdc=0x200101b3, hrgn=0x320409ff) returned 0 [0036.483] SelectClipRgn (hdc=0x200101b3, hrgn=0xe0409f1) returned 2 [0036.483] DeleteObject (ho=0x320409ff) returned 1 [0036.483] DeleteObject (ho=0xe0409f1) returned 1 [0036.483] OffsetViewportOrgEx (in: hdc=0x200101b3, x=0, y=0, lppt=0x274a0b8 | out: lppt=0x274a0b8) returned 1 [0036.483] OffsetViewportOrgEx (in: hdc=0x200101b3, x=-417, y=-278, lppt=0x274a0d0 | out: lppt=0x274a0d0) returned 1 [0036.483] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0036.484] GetCurrentObject (hdc=0x200101b3, type=0x1) returned 0x1b00017 [0036.484] GetCurrentObject (hdc=0x200101b3, type=0x2) returned 0x1900010 [0036.484] GetCurrentObject (hdc=0x200101b3, type=0x7) returned 0x1b0501b8 [0036.484] GetCurrentObject (hdc=0x200101b3, type=0x6) returned 0x18a002e [0036.484] SaveDC (hdc=0x200101b3) returned 2 [0036.484] GetNearestColor (hdc=0x200101b3, color=0x6c4607) returned 0x6c4607 [0036.484] CreateSolidBrush (color=0x6c4607) returned 0x3e100276 [0036.484] FillRect (hDC=0x200101b3, lprc=0x26de08, hbr=0x3e100276) returned 1 [0036.493] DeleteObject (ho=0x3e100276) returned 1 [0036.493] RestoreDC (hdc=0x200101b3, nSavedDC=-1) returned 1 [0036.493] RestoreDC (hdc=0x200101b3, nSavedDC=-1) returned 1 [0036.493] GdipReleaseDC (graphics=0x1b86e570, hdc=0x200101b3) returned 0x0 [0036.494] GdipRestoreGraphics (graphics=0x1b86e570, state=0xfffffffffdb80dbd) returned 0x0 [0036.494] GdipDeleteRegion (region=0x1b86e250) returned 0x0 [0036.494] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.494] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.494] GetSystemMetrics (nIndex=42) returned 0 [0036.494] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.494] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.495] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2) returned 0x0 [0036.497] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0036.497] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0036.502] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0036.503] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0036.509] GdipDrawImageRectI (graphics=0x1b86e570, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0036.515] GdipGetDC (graphics=0x1b86e570, hdc=0x26e3a8) returned 0x0 [0036.515] GetCurrentObject (hdc=0x200101b3, type=0x1) returned 0x1b00017 [0036.515] GetCurrentObject (hdc=0x200101b3, type=0x2) returned 0x1900010 [0036.515] GetCurrentObject (hdc=0x200101b3, type=0x7) returned 0x1b0501b8 [0036.515] GetCurrentObject (hdc=0x200101b3, type=0x6) returned 0x18a002e [0036.515] SaveDC (hdc=0x200101b3) returned 1 [0036.515] GetNearestColor (hdc=0x200101b3, color=0xf0f0f0) returned 0xf0f0f0 [0036.515] RestoreDC (hdc=0x200101b3, nSavedDC=-1) returned 1 [0036.515] GdipReleaseDC (graphics=0x1b86e570, hdc=0x200101b3) returned 0x0 [0036.515] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.515] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0036.516] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x26e2a8, fWinIni=0x0 | out: pvParam=0x26e2a8) returned 1 [0036.516] SendMessageW (hWnd=0x50114, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0036.516] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0036.516] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0036.516] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0036.516] RedrawWindow (hWnd=0x3015e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0036.516] RedrawWindow (hWnd=0x50114, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0036.516] InvalidateRect (hWnd=0x3015e, lpRect=0x26d300, bErase=1) returned 1 [0036.520] GdipGetFamilyName (in: family=0x1b8191f0, name=0x26dfa0, language=0x409 | out: name="Segoe UI Light") returned 0x0 [0036.520] CreateCompatibleDC (hdc=0x0) returned 0xffffffff81010269 [0036.520] GetCurrentObject (hdc=0xffffffff81010269, type=0x1) returned 0x1b00017 [0036.520] GetCurrentObject (hdc=0xffffffff81010269, type=0x2) returned 0x1900010 [0036.521] GetCurrentObject (hdc=0xffffffff81010269, type=0x7) returned 0x185000f [0036.521] GetCurrentObject (hdc=0xffffffff81010269, type=0x6) returned 0x18a002e [0036.521] SaveDC (hdc=0xffffffff81010269) returned 1 [0036.521] GetDeviceCaps (hdc=0xffffffff81010269, index=90) returned 96 [0036.522] CoTaskMemAlloc (cb=0x5c) returned 0x1a799520 [0036.522] CreateFontIndirectW (lplf=0x1a799520) returned 0x260a09ba [0036.522] CoTaskMemFree (pv=0x1a799520) [0036.522] GetObjectW (in: h=0x260a09ba, c=92, pv=0x26dfb0 | out: pv=0x26dfb0) returned 92 [0036.523] GetCurrentObject (hdc=0xffffffff81010269, type=0x6) returned 0x18a002e [0036.523] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddb0 | out: pv=0x26ddb0) returned 92 [0036.524] SelectObject (hdc=0xffffffff81010269, h=0x260a09ba) returned 0x18a002e [0036.524] GetMapMode (hdc=0xffffffff81010269) returned 1 [0036.525] GetTextMetricsW (in: hdc=0xffffffff81010269, lptm=0x26dfc0 | out: lptm=0x26dfc0) returned 1 [0036.526] DrawTextExW (in: hdc=0xffffffff81010269, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e1c8, format=0x102405, lpdtp=0x274bd90 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e1c8) returned 333 [0036.537] GdipGetTextRenderingHint (graphics=0x1b86e570, mode=0x26e2b8) returned 0x0 [0036.537] GdipGetDC (graphics=0x1b86e570, hdc=0x26e298) returned 0x0 [0036.537] GetCurrentObject (hdc=0x200101b3, type=0x1) returned 0x1b00017 [0036.537] GetCurrentObject (hdc=0x200101b3, type=0x2) returned 0x1900010 [0036.537] GetCurrentObject (hdc=0x200101b3, type=0x7) returned 0x1b0501b8 [0036.538] GetCurrentObject (hdc=0x200101b3, type=0x6) returned 0x18a002e [0036.538] SaveDC (hdc=0x200101b3) returned 1 [0036.539] GetTextAlign (hdc=0x200101b3) returned 0x0 [0036.540] GetTextColor (hdc=0x200101b3) returned 0x0 [0036.540] SetTextColor (hdc=0x200101b3, color=0xf0f0f0) returned 0x0 [0036.540] GetCurrentObject (hdc=0x200101b3, type=0x6) returned 0x18a002e [0036.540] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0036.540] SelectObject (hdc=0x200101b3, h=0x260a09ba) returned 0x18a002e [0036.541] GetBkMode (hdc=0x200101b3) returned 2 [0036.541] SetBkMode (hdc=0x200101b3, mode=1) returned 2 [0036.541] DrawTextExW (in: hdc=0x200101b3, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x274c220 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0036.541] DrawTextExW (in: hdc=0x200101b3, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x274c220 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0036.544] RestoreDC (hdc=0x200101b3, nSavedDC=-1) returned 1 [0036.544] GdipReleaseDC (graphics=0x1b86e570, hdc=0x200101b3) returned 0x0 [0036.544] GdipGetDC (graphics=0x1b86e570, hdc=0x26e4c8) returned 0x0 [0036.544] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x200101b3, x1=0, y1=0, rop=0xcc0020) returned 1 [0036.544] GdipReleaseDC (graphics=0x1b86e570, hdc=0x200101b3) returned 0x0 [0036.544] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0036.544] SelectObject (hdc=0x200101b3, h=0x185000f) returned 0x1b0501b8 [0036.545] DeleteDC (hdc=0x200101b3) returned 1 [0036.545] GdipDeleteGraphics (graphics=0x1b86e570) returned 0x0 [0036.545] DeleteObject (ho=0x1b0501b8) returned 1 [0036.548] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0036.548] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.548] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.548] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.548] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.548] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.548] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0036.548] GetCurrentThreadId () returned 0xa28 [0036.548] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0036.548] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.548] MapWindowPoints (in: hWndFrom=0x3015e, hWndTo=0x0, lpPoints=0x26e830, cPoints=0x2 | out: lpPoints=0x26e830) returned 18219425 [0036.549] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.549] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.549] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.549] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.551] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0036.551] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.551] MapWindowPoints (in: hWndFrom=0x3015e, hWndTo=0x0, lpPoints=0x26e830, cPoints=0x2 | out: lpPoints=0x26e830) returned 18219425 [0036.551] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.551] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.551] MapWindowPoints (in: hWndFrom=0x3015e, hWndTo=0x0, lpPoints=0x26e850, cPoints=0x2 | out: lpPoints=0x26e850) returned 18219425 [0036.551] SetCursor (hCursor=0x10007) returned 0x10007 [0036.551] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.551] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.551] _TrackMouseEvent (in: lpEventTrack=0x274c2d8 | out: lpEventTrack=0x274c2d8) returned 1 [0036.551] SendMessageW (hWnd=0x3015e, Msg=0xc0e3, wParam=0x0, lParam=0x0) returned 0x0 [0036.551] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xc0e3, wParam=0x0, lParam=0x0) returned 0x0 [0036.552] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x200, wParam=0x0, lParam=0x2700aa) returned 0x0 [0036.552] GetKeyState (nVirtKey=1) returned 0 [0036.552] GetKeyState (nVirtKey=2) returned 0 [0036.552] GetKeyState (nVirtKey=4) returned 0 [0036.552] GetKeyState (nVirtKey=5) returned 0 [0036.552] GetKeyState (nVirtKey=6) returned 0 [0036.552] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.552] IsWindowUnicode (hWnd=0x50114) returned 1 [0036.552] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.552] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.552] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.552] BeginPaint (in: hWnd=0x50114, lpPaint=0x26e548 | out: lpPaint=0x26e548) returned 0x150109ce [0036.552] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26e068 | out: lpwndpl=0x26e068) returned 1 [0036.552] GetClientRect (in: hWnd=0x50114, lpRect=0x26df80 | out: lpRect=0x26df80) returned 1 [0036.552] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.552] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.552] GetSystemMetrics (nIndex=42) returned 0 [0036.552] GetWindowTextW (in: hWnd=0x50114, lpString=0x26dcf0, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.552] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26dcf0) returned 0x5 [0036.552] GetClientRect (in: hWnd=0x50114, lpRect=0x26dd68 | out: lpRect=0x26dd68) returned 1 [0036.552] GetCurrentObject (hdc=0x150109ce, type=0x1) returned 0x1b00017 [0036.552] GetCurrentObject (hdc=0x150109ce, type=0x2) returned 0x1900010 [0036.552] GetCurrentObject (hdc=0x150109ce, type=0x7) returned 0x1050032 [0036.552] GetCurrentObject (hdc=0x150109ce, type=0x6) returned 0x18a002e [0036.553] SaveDC (hdc=0x150109ce) returned 1 [0036.553] GetNearestColor (hdc=0x150109ce, color=0x6c4607) returned 0x6c4607 [0036.553] CreateSolidBrush (color=0x6c4607) returned 0x3f100276 [0036.553] FillRect (hDC=0x150109ce, lprc=0x26da58, hbr=0x3f100276) returned 1 [0036.553] DeleteObject (ho=0x3f100276) returned 1 [0036.553] RestoreDC (hdc=0x150109ce, nSavedDC=-1) returned 1 [0036.553] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0036.554] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0036.554] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0036.554] GetSystemMetrics (nIndex=42) returned 0 [0036.554] GetWindowTextW (in: hWnd=0x50114, lpString=0x26e3f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0036.554] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26e3f0) returned 0x5 [0036.554] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0036.554] EndPaint (hWnd=0x50114, lpPaint=0x26e4e8) returned 1 [0036.554] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.554] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.554] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.554] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.554] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.554] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0036.554] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0036.554] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0036.554] CreateCompatibleDC (hdc=0x60109d6) returned 0x1d0101b8 [0036.554] GetObjectType (h=0x60109d6) returned 0x3 [0036.554] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x210501b3 [0036.555] GetDIBits (in: hdc=0x60109d6, hbm=0x210501b3, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.555] GetDIBits (in: hdc=0x60109d6, hbm=0x210501b3, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.555] DeleteObject (ho=0x210501b3) returned 1 [0036.555] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x130509c1 [0036.555] SelectObject (hdc=0x1d0101b8, h=0x130509c1) returned 0x185000f [0036.555] GdipCreateFromHDC (hdc=0x1d0101b8, graphics=0x26e408) returned 0x0 [0036.555] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0036.555] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0036.555] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0036.555] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0036.555] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0036.555] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d40a0 [0036.555] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d40a0) returned 0x0 [0036.555] LocalFree (hMem=0x1a7d40a0) returned 0x0 [0036.556] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0036.556] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0036.556] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0036.556] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0036.556] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0036.556] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.556] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.556] GetSystemMetrics (nIndex=42) returned 0 [0036.556] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.556] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.556] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0036.556] IsAppThemed () returned 0x1 [0036.556] GetThemeAppProperties () returned 0x3 [0036.556] GetThemeAppProperties () returned 0x3 [0036.556] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0036.556] GdipGetClip (graphics=0x1b86d040, region=0x1d0560d0) returned 0x0 [0036.556] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0036.556] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0036.556] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0036.556] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d40a0 [0036.556] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d40a0) returned 0x0 [0036.556] LocalFree (hMem=0x1a7d40a0) returned 0x0 [0036.556] GdipCombineRegionRegion (region=0x1d0560d0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0036.556] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d40a0 [0036.556] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d40a0) returned 0x0 [0036.556] LocalFree (hMem=0x1a7d40a0) returned 0x0 [0036.556] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0036.557] GdipIsInfiniteRegion (region=0x1d0560d0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0036.557] GdipIsInfiniteRegion (region=0x1d0560d0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0036.557] GdipGetRegionHRgn (region=0x1d0560d0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0036.557] GdipDeleteRegion (region=0x1d0560d0) returned 0x0 [0036.557] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0036.557] GetCurrentObject (hdc=0x1d0101b8, type=0x1) returned 0x1b00017 [0036.557] GetCurrentObject (hdc=0x1d0101b8, type=0x2) returned 0x1900010 [0036.557] GetCurrentObject (hdc=0x1d0101b8, type=0x7) returned 0x130509c1 [0036.557] GetCurrentObject (hdc=0x1d0101b8, type=0x6) returned 0x18a002e [0036.557] SaveDC (hdc=0x1d0101b8) returned 1 [0036.557] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xf0409f1 [0036.557] GetClipRgn (hdc=0x1d0101b8, hrgn=0xf0409f1) returned 0 [0036.557] SelectClipRgn (hdc=0x1d0101b8, hrgn=0x360409ff) returned 2 [0036.557] DeleteObject (ho=0xf0409f1) returned 1 [0036.557] DeleteObject (ho=0x360409ff) returned 1 [0036.557] OffsetViewportOrgEx (in: hdc=0x1d0101b8, x=0, y=0, lppt=0x274e170 | out: lppt=0x274e170) returned 1 [0036.557] OffsetViewportOrgEx (in: hdc=0x1d0101b8, x=-417, y=-278, lppt=0x274e188 | out: lppt=0x274e188) returned 1 [0036.557] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0036.557] GetCurrentObject (hdc=0x1d0101b8, type=0x1) returned 0x1b00017 [0036.557] GetCurrentObject (hdc=0x1d0101b8, type=0x2) returned 0x1900010 [0036.557] GetCurrentObject (hdc=0x1d0101b8, type=0x7) returned 0x130509c1 [0036.557] GetCurrentObject (hdc=0x1d0101b8, type=0x6) returned 0x18a002e [0036.557] SaveDC (hdc=0x1d0101b8) returned 2 [0036.558] GetNearestColor (hdc=0x1d0101b8, color=0x6c4607) returned 0x6c4607 [0036.558] CreateSolidBrush (color=0x6c4607) returned 0x40100276 [0036.558] FillRect (hDC=0x1d0101b8, lprc=0x26de08, hbr=0x40100276) returned 1 [0036.564] DeleteObject (ho=0x40100276) returned 1 [0036.564] RestoreDC (hdc=0x1d0101b8, nSavedDC=-1) returned 1 [0036.564] RestoreDC (hdc=0x1d0101b8, nSavedDC=-1) returned 1 [0036.564] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1d0101b8) returned 0x0 [0036.564] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffdb60dbd) returned 0x0 [0036.564] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0036.564] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.564] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.564] GetSystemMetrics (nIndex=42) returned 0 [0036.564] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.565] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.565] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0036.565] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0036.565] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0036.565] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0036.565] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0036.565] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0036.565] GetCurrentObject (hdc=0x1d0101b8, type=0x1) returned 0x1b00017 [0036.565] GetCurrentObject (hdc=0x1d0101b8, type=0x2) returned 0x1900010 [0036.565] GetCurrentObject (hdc=0x1d0101b8, type=0x7) returned 0x130509c1 [0036.565] GetCurrentObject (hdc=0x1d0101b8, type=0x6) returned 0x18a002e [0036.565] SaveDC (hdc=0x1d0101b8) returned 1 [0036.565] GetNearestColor (hdc=0x1d0101b8, color=0xf0f0f0) returned 0xf0f0f0 [0036.565] RestoreDC (hdc=0x1d0101b8, nSavedDC=-1) returned 1 [0036.565] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1d0101b8) returned 0x0 [0036.565] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.565] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0036.565] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0036.565] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0036.566] GetCurrentObject (hdc=0x1d0101b8, type=0x1) returned 0x1b00017 [0036.566] GetCurrentObject (hdc=0x1d0101b8, type=0x2) returned 0x1900010 [0036.566] GetCurrentObject (hdc=0x1d0101b8, type=0x7) returned 0x130509c1 [0036.566] GetCurrentObject (hdc=0x1d0101b8, type=0x6) returned 0x18a002e [0036.566] SaveDC (hdc=0x1d0101b8) returned 1 [0036.566] GetTextAlign (hdc=0x1d0101b8) returned 0x0 [0036.566] GetTextColor (hdc=0x1d0101b8) returned 0x0 [0036.566] SetTextColor (hdc=0x1d0101b8, color=0xf0f0f0) returned 0x0 [0036.566] GetCurrentObject (hdc=0x1d0101b8, type=0x6) returned 0x18a002e [0036.566] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0036.566] SelectObject (hdc=0x1d0101b8, h=0x260a09ba) returned 0x18a002e [0036.566] GetBkMode (hdc=0x1d0101b8) returned 2 [0036.566] SetBkMode (hdc=0x1d0101b8, mode=1) returned 2 [0036.566] DrawTextExW (in: hdc=0x1d0101b8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x274ee38 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0036.566] DrawTextExW (in: hdc=0x1d0101b8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x274ee38 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0036.567] RestoreDC (hdc=0x1d0101b8, nSavedDC=-1) returned 1 [0036.567] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1d0101b8) returned 0x0 [0036.567] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0036.567] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x1d0101b8, x1=0, y1=0, rop=0xcc0020) returned 1 [0036.567] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1d0101b8) returned 0x0 [0036.567] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0036.567] SelectObject (hdc=0x1d0101b8, h=0x185000f) returned 0x130509c1 [0036.567] DeleteDC (hdc=0x1d0101b8) returned 1 [0036.567] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0036.567] DeleteObject (ho=0x130509c1) returned 1 [0036.570] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0036.570] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.570] IsWindowUnicode (hWnd=0x3015c) returned 1 [0036.570] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.571] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.571] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.571] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.571] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.571] WaitMessage () returned 1 [0036.580] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.580] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.580] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.580] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.580] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.580] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0036.580] GetCurrentThreadId () returned 0xa28 [0036.580] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0036.580] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.580] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.580] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.580] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.580] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.581] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0036.581] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0036.581] CreateCompatibleDC (hdc=0x60109d6) returned 0x230101b3 [0036.581] GetObjectType (h=0x60109d6) returned 0x3 [0036.581] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x140509c1 [0036.581] GetDIBits (in: hdc=0x60109d6, hbm=0x140509c1, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.581] GetDIBits (in: hdc=0x60109d6, hbm=0x140509c1, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.581] DeleteObject (ho=0x140509c1) returned 1 [0036.581] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x1e0501b8 [0036.581] SelectObject (hdc=0x230101b3, h=0x1e0501b8) returned 0x185000f [0036.581] GdipCreateFromHDC (hdc=0x230101b3, graphics=0x26e408) returned 0x0 [0036.581] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0036.581] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0036.581] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0036.582] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0036.582] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0036.582] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d40a0 [0036.582] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d40a0) returned 0x0 [0036.582] LocalFree (hMem=0x1a7d40a0) returned 0x0 [0036.582] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0036.582] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0036.582] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0036.582] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0036.582] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0036.582] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.582] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.582] GetSystemMetrics (nIndex=42) returned 0 [0036.582] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.582] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.582] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0036.582] IsAppThemed () returned 0x1 [0036.582] GetThemeAppProperties () returned 0x3 [0036.582] GetThemeAppProperties () returned 0x3 [0036.582] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0036.582] GdipGetClip (graphics=0x1b86d040, region=0x1d0560d0) returned 0x0 [0036.582] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0036.582] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0036.582] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0036.582] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d40a0 [0036.582] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d40a0) returned 0x0 [0036.582] LocalFree (hMem=0x1a7d40a0) returned 0x0 [0036.582] GdipCombineRegionRegion (region=0x1d0560d0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0036.582] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d40a0 [0036.583] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d40a0) returned 0x0 [0036.583] LocalFree (hMem=0x1a7d40a0) returned 0x0 [0036.583] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0036.583] GdipIsInfiniteRegion (region=0x1d0560d0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0036.583] GdipIsInfiniteRegion (region=0x1d0560d0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0036.583] GdipGetRegionHRgn (region=0x1d0560d0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0036.583] GdipDeleteRegion (region=0x1d0560d0) returned 0x0 [0036.583] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0036.583] GetCurrentObject (hdc=0x230101b3, type=0x1) returned 0x1b00017 [0036.583] GetCurrentObject (hdc=0x230101b3, type=0x2) returned 0x1900010 [0036.583] GetCurrentObject (hdc=0x230101b3, type=0x7) returned 0x1e0501b8 [0036.583] GetCurrentObject (hdc=0x230101b3, type=0x6) returned 0x18a002e [0036.583] SaveDC (hdc=0x230101b3) returned 1 [0036.583] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x370409ff [0036.583] GetClipRgn (hdc=0x230101b3, hrgn=0x370409ff) returned 0 [0036.583] SelectClipRgn (hdc=0x230101b3, hrgn=0x120409f1) returned 2 [0036.583] DeleteObject (ho=0x370409ff) returned 1 [0036.583] DeleteObject (ho=0x120409f1) returned 1 [0036.583] OffsetViewportOrgEx (in: hdc=0x230101b3, x=0, y=0, lppt=0x2750a30 | out: lppt=0x2750a30) returned 1 [0036.583] OffsetViewportOrgEx (in: hdc=0x230101b3, x=-417, y=-278, lppt=0x2750a48 | out: lppt=0x2750a48) returned 1 [0036.583] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0036.583] GetCurrentObject (hdc=0x230101b3, type=0x1) returned 0x1b00017 [0036.583] GetCurrentObject (hdc=0x230101b3, type=0x2) returned 0x1900010 [0036.583] GetCurrentObject (hdc=0x230101b3, type=0x7) returned 0x1e0501b8 [0036.583] GetCurrentObject (hdc=0x230101b3, type=0x6) returned 0x18a002e [0036.583] SaveDC (hdc=0x230101b3) returned 2 [0036.584] GetNearestColor (hdc=0x230101b3, color=0x6c4607) returned 0x6c4607 [0036.584] CreateSolidBrush (color=0x6c4607) returned 0x41100276 [0036.584] FillRect (hDC=0x230101b3, lprc=0x26de08, hbr=0x41100276) returned 1 [0036.589] DeleteObject (ho=0x41100276) returned 1 [0036.589] RestoreDC (hdc=0x230101b3, nSavedDC=-1) returned 1 [0036.589] RestoreDC (hdc=0x230101b3, nSavedDC=-1) returned 1 [0036.589] GdipReleaseDC (graphics=0x1b86d040, hdc=0x230101b3) returned 0x0 [0036.589] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffdb40dbd) returned 0x0 [0036.589] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0036.589] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.589] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.589] GetSystemMetrics (nIndex=42) returned 0 [0036.589] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.589] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.589] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0036.589] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0036.589] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0036.589] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0036.589] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0036.589] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0036.589] GetCurrentObject (hdc=0x230101b3, type=0x1) returned 0x1b00017 [0036.589] GetCurrentObject (hdc=0x230101b3, type=0x2) returned 0x1900010 [0036.589] GetCurrentObject (hdc=0x230101b3, type=0x7) returned 0x1e0501b8 [0036.589] GetCurrentObject (hdc=0x230101b3, type=0x6) returned 0x18a002e [0036.589] SaveDC (hdc=0x230101b3) returned 1 [0036.589] GetNearestColor (hdc=0x230101b3, color=0xf0f0f0) returned 0xf0f0f0 [0036.590] RestoreDC (hdc=0x230101b3, nSavedDC=-1) returned 1 [0036.590] GdipReleaseDC (graphics=0x1b86d040, hdc=0x230101b3) returned 0x0 [0036.590] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.590] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0036.590] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0036.590] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0036.590] GetCurrentObject (hdc=0x230101b3, type=0x1) returned 0x1b00017 [0036.590] GetCurrentObject (hdc=0x230101b3, type=0x2) returned 0x1900010 [0036.590] GetCurrentObject (hdc=0x230101b3, type=0x7) returned 0x1e0501b8 [0036.590] GetCurrentObject (hdc=0x230101b3, type=0x6) returned 0x18a002e [0036.590] SaveDC (hdc=0x230101b3) returned 1 [0036.590] GetTextAlign (hdc=0x230101b3) returned 0x0 [0036.590] GetTextColor (hdc=0x230101b3) returned 0x0 [0036.590] SetTextColor (hdc=0x230101b3, color=0xf0f0f0) returned 0x0 [0036.590] GetCurrentObject (hdc=0x230101b3, type=0x6) returned 0x18a002e [0036.590] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0036.590] SelectObject (hdc=0x230101b3, h=0x260a09ba) returned 0x18a002e [0036.590] GetBkMode (hdc=0x230101b3) returned 2 [0036.590] SetBkMode (hdc=0x230101b3, mode=1) returned 2 [0036.590] DrawTextExW (in: hdc=0x230101b3, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27516f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0036.591] DrawTextExW (in: hdc=0x230101b3, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27516f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0036.591] RestoreDC (hdc=0x230101b3, nSavedDC=-1) returned 1 [0036.591] GdipReleaseDC (graphics=0x1b86d040, hdc=0x230101b3) returned 0x0 [0036.591] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0036.591] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x230101b3, x1=0, y1=0, rop=0xcc0020) returned 1 [0036.591] GdipReleaseDC (graphics=0x1b86d040, hdc=0x230101b3) returned 0x0 [0036.591] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0036.591] SelectObject (hdc=0x230101b3, h=0x185000f) returned 0x1e0501b8 [0036.591] DeleteDC (hdc=0x230101b3) returned 1 [0036.591] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0036.591] DeleteObject (ho=0x1e0501b8) returned 1 [0036.594] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0036.595] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.595] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.595] WaitMessage () returned 1 [0036.658] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.658] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.658] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.658] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.658] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.658] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.658] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.658] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.658] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.658] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.658] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x2a1, wParam=0x0, lParam=0x2700aa) returned 0x0 [0036.659] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.659] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.659] WaitMessage () returned 1 [0036.706] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.706] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.706] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.706] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.706] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.706] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0036.706] GetCurrentThreadId () returned 0xa28 [0036.706] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0036.706] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.706] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.706] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.706] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.706] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.706] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0036.706] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0036.706] CreateCompatibleDC (hdc=0x60109d6) returned 0x2701019e [0036.706] GetObjectType (h=0x60109d6) returned 0x3 [0036.706] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x1b0501a0 [0036.706] GetDIBits (in: hdc=0x60109d6, hbm=0x1b0501a0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.707] GetDIBits (in: hdc=0x60109d6, hbm=0x1b0501a0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.707] DeleteObject (ho=0x1b0501a0) returned 1 [0036.707] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x1c05008e [0036.707] SelectObject (hdc=0x2701019e, h=0x1c05008e) returned 0x185000f [0036.707] GdipCreateFromHDC (hdc=0x2701019e, graphics=0x26e408) returned 0x0 [0036.707] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0036.707] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0036.707] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0036.707] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0036.708] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0036.708] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d40a0 [0036.708] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d40a0) returned 0x0 [0036.708] LocalFree (hMem=0x1a7d40a0) returned 0x0 [0036.708] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0036.708] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0036.708] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0036.708] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0036.708] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0036.708] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.708] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.708] GetSystemMetrics (nIndex=42) returned 0 [0036.708] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.708] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.708] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0036.708] IsAppThemed () returned 0x1 [0036.708] GetThemeAppProperties () returned 0x3 [0036.708] GetThemeAppProperties () returned 0x3 [0036.708] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0036.708] GdipGetClip (graphics=0x1b86d040, region=0x1d0560d0) returned 0x0 [0036.708] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0036.708] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0036.708] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0036.708] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d40a0 [0036.708] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d40a0) returned 0x0 [0036.708] LocalFree (hMem=0x1a7d40a0) returned 0x0 [0036.708] GdipCombineRegionRegion (region=0x1d0560d0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0036.708] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d40a0 [0036.708] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d40a0) returned 0x0 [0036.709] LocalFree (hMem=0x1a7d40a0) returned 0x0 [0036.709] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0036.709] GdipIsInfiniteRegion (region=0x1d0560d0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0036.709] GdipIsInfiniteRegion (region=0x1d0560d0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0036.709] GdipGetRegionHRgn (region=0x1d0560d0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0036.709] GdipDeleteRegion (region=0x1d0560d0) returned 0x0 [0036.709] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0036.709] GetCurrentObject (hdc=0x2701019e, type=0x1) returned 0x1b00017 [0036.709] GetCurrentObject (hdc=0x2701019e, type=0x2) returned 0x1900010 [0036.709] GetCurrentObject (hdc=0x2701019e, type=0x7) returned 0x1c05008e [0036.709] GetCurrentObject (hdc=0x2701019e, type=0x6) returned 0x18a002e [0036.709] SaveDC (hdc=0x2701019e) returned 1 [0036.709] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x130409f1 [0036.709] GetClipRgn (hdc=0x2701019e, hrgn=0x130409f1) returned 0 [0036.709] SelectClipRgn (hdc=0x2701019e, hrgn=0x3a0409ff) returned 2 [0036.709] DeleteObject (ho=0x130409f1) returned 1 [0036.709] DeleteObject (ho=0x3a0409ff) returned 1 [0036.709] OffsetViewportOrgEx (in: hdc=0x2701019e, x=0, y=0, lppt=0x2753310 | out: lppt=0x2753310) returned 1 [0036.709] OffsetViewportOrgEx (in: hdc=0x2701019e, x=-417, y=-278, lppt=0x2753328 | out: lppt=0x2753328) returned 1 [0036.709] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0036.709] GetCurrentObject (hdc=0x2701019e, type=0x1) returned 0x1b00017 [0036.709] GetCurrentObject (hdc=0x2701019e, type=0x2) returned 0x1900010 [0036.709] GetCurrentObject (hdc=0x2701019e, type=0x7) returned 0x1c05008e [0036.709] GetCurrentObject (hdc=0x2701019e, type=0x6) returned 0x18a002e [0036.709] SaveDC (hdc=0x2701019e) returned 2 [0036.709] GetNearestColor (hdc=0x2701019e, color=0x6c4607) returned 0x6c4607 [0036.710] CreateSolidBrush (color=0x6c4607) returned 0x42100276 [0036.710] FillRect (hDC=0x2701019e, lprc=0x26de08, hbr=0x42100276) returned 1 [0036.715] DeleteObject (ho=0x42100276) returned 1 [0036.715] RestoreDC (hdc=0x2701019e, nSavedDC=-1) returned 1 [0036.715] RestoreDC (hdc=0x2701019e, nSavedDC=-1) returned 1 [0036.715] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2701019e) returned 0x0 [0036.715] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffdb20dbd) returned 0x0 [0036.715] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0036.715] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.715] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.715] GetSystemMetrics (nIndex=42) returned 0 [0036.715] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.715] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.715] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x4) returned 0x0 [0036.716] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0036.716] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0036.716] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0036.716] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0036.716] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0036.716] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0036.716] GetCurrentObject (hdc=0x2701019e, type=0x1) returned 0x1b00017 [0036.716] GetCurrentObject (hdc=0x2701019e, type=0x2) returned 0x1900010 [0036.716] GetCurrentObject (hdc=0x2701019e, type=0x7) returned 0x1c05008e [0036.716] GetCurrentObject (hdc=0x2701019e, type=0x6) returned 0x18a002e [0036.716] SaveDC (hdc=0x2701019e) returned 1 [0036.717] GetNearestColor (hdc=0x2701019e, color=0xf0f0f0) returned 0xf0f0f0 [0036.717] RestoreDC (hdc=0x2701019e, nSavedDC=-1) returned 1 [0036.717] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2701019e) returned 0x0 [0036.717] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.717] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0036.717] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0036.717] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0036.717] GetCurrentObject (hdc=0x2701019e, type=0x1) returned 0x1b00017 [0036.717] GetCurrentObject (hdc=0x2701019e, type=0x2) returned 0x1900010 [0036.717] GetCurrentObject (hdc=0x2701019e, type=0x7) returned 0x1c05008e [0036.717] GetCurrentObject (hdc=0x2701019e, type=0x6) returned 0x18a002e [0036.717] SaveDC (hdc=0x2701019e) returned 1 [0036.717] GetTextAlign (hdc=0x2701019e) returned 0x0 [0036.717] GetTextColor (hdc=0x2701019e) returned 0x0 [0036.717] SetTextColor (hdc=0x2701019e, color=0xf0f0f0) returned 0x0 [0036.717] GetCurrentObject (hdc=0x2701019e, type=0x6) returned 0x18a002e [0036.717] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0036.717] SelectObject (hdc=0x2701019e, h=0x260a09ba) returned 0x18a002e [0036.717] GetBkMode (hdc=0x2701019e) returned 2 [0036.717] SetBkMode (hdc=0x2701019e, mode=1) returned 2 [0036.718] DrawTextExW (in: hdc=0x2701019e, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27541a0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0036.718] DrawTextExW (in: hdc=0x2701019e, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27541a0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0036.718] RestoreDC (hdc=0x2701019e, nSavedDC=-1) returned 1 [0036.718] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2701019e) returned 0x0 [0036.718] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0036.718] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x2701019e, x1=0, y1=0, rop=0xcc0020) returned 1 [0036.719] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2701019e) returned 0x0 [0036.719] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0036.719] SelectObject (hdc=0x2701019e, h=0x185000f) returned 0x1c05008e [0036.719] DeleteDC (hdc=0x2701019e) returned 1 [0036.719] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0036.719] DeleteObject (ho=0x1c05008e) returned 1 [0036.723] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0036.723] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.723] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.723] WaitMessage () returned 1 [0036.846] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.846] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.846] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.846] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.846] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.846] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0036.846] GetCurrentThreadId () returned 0xa28 [0036.846] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0036.846] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.846] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.846] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.846] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.846] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.846] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0036.847] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0036.847] CreateCompatibleDC (hdc=0x60109d6) returned 0x2801019e [0036.847] GetObjectType (h=0x60109d6) returned 0x3 [0036.847] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x1d0501a4 [0036.847] GetDIBits (in: hdc=0x60109d6, hbm=0x1d0501a4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.847] GetDIBits (in: hdc=0x60109d6, hbm=0x1d0501a4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.847] DeleteObject (ho=0x1d0501a4) returned 1 [0036.847] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x1e0501b7 [0036.847] SelectObject (hdc=0x2801019e, h=0x1e0501b7) returned 0x185000f [0036.847] GdipCreateFromHDC (hdc=0x2801019e, graphics=0x26e408) returned 0x0 [0036.847] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0036.847] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0036.847] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0036.847] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0036.848] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0036.848] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4120 [0036.848] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4120) returned 0x0 [0036.848] LocalFree (hMem=0x1a7d4120) returned 0x0 [0036.848] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0036.848] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0036.848] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0036.848] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0036.848] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0036.848] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.848] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.848] GetSystemMetrics (nIndex=42) returned 0 [0036.848] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.848] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.848] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0036.848] IsAppThemed () returned 0x1 [0036.848] GetThemeAppProperties () returned 0x3 [0036.848] GetThemeAppProperties () returned 0x3 [0036.848] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0036.848] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0036.848] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0036.848] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0036.848] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0036.848] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4120 [0036.848] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4120) returned 0x0 [0036.848] LocalFree (hMem=0x1a7d4120) returned 0x0 [0036.848] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0036.848] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4120 [0036.848] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4120) returned 0x0 [0036.848] LocalFree (hMem=0x1a7d4120) returned 0x0 [0036.849] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0036.849] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0036.849] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0036.849] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0036.849] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0036.849] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0036.849] GetCurrentObject (hdc=0x2801019e, type=0x1) returned 0x1b00017 [0036.849] GetCurrentObject (hdc=0x2801019e, type=0x2) returned 0x1900010 [0036.849] GetCurrentObject (hdc=0x2801019e, type=0x7) returned 0x1e0501b7 [0036.849] GetCurrentObject (hdc=0x2801019e, type=0x6) returned 0x18a002e [0036.849] SaveDC (hdc=0x2801019e) returned 1 [0036.849] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3b0409ff [0036.849] GetClipRgn (hdc=0x2801019e, hrgn=0x3b0409ff) returned 0 [0036.849] SelectClipRgn (hdc=0x2801019e, hrgn=0x160409f1) returned 2 [0036.849] DeleteObject (ho=0x3b0409ff) returned 1 [0036.849] DeleteObject (ho=0x160409f1) returned 1 [0036.849] OffsetViewportOrgEx (in: hdc=0x2801019e, x=0, y=0, lppt=0x2755d80 | out: lppt=0x2755d80) returned 1 [0036.849] OffsetViewportOrgEx (in: hdc=0x2801019e, x=-417, y=-278, lppt=0x2755d98 | out: lppt=0x2755d98) returned 1 [0036.849] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0036.849] GetCurrentObject (hdc=0x2801019e, type=0x1) returned 0x1b00017 [0036.849] GetCurrentObject (hdc=0x2801019e, type=0x2) returned 0x1900010 [0036.849] GetCurrentObject (hdc=0x2801019e, type=0x7) returned 0x1e0501b7 [0036.849] GetCurrentObject (hdc=0x2801019e, type=0x6) returned 0x18a002e [0036.849] SaveDC (hdc=0x2801019e) returned 2 [0036.849] GetNearestColor (hdc=0x2801019e, color=0x6c4607) returned 0x6c4607 [0036.849] CreateSolidBrush (color=0x6c4607) returned 0x43100276 [0036.850] FillRect (hDC=0x2801019e, lprc=0x26de08, hbr=0x43100276) returned 1 [0036.853] DeleteObject (ho=0x43100276) returned 1 [0036.853] RestoreDC (hdc=0x2801019e, nSavedDC=-1) returned 1 [0036.853] RestoreDC (hdc=0x2801019e, nSavedDC=-1) returned 1 [0036.853] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2801019e) returned 0x0 [0036.853] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffdb00dbd) returned 0x0 [0036.853] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0036.853] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.853] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.853] GetSystemMetrics (nIndex=42) returned 0 [0036.853] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.854] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.854] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0036.854] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0036.854] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0036.854] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0036.854] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0036.854] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0036.854] GetCurrentObject (hdc=0x2801019e, type=0x1) returned 0x1b00017 [0036.854] GetCurrentObject (hdc=0x2801019e, type=0x2) returned 0x1900010 [0036.854] GetCurrentObject (hdc=0x2801019e, type=0x7) returned 0x1e0501b7 [0036.854] GetCurrentObject (hdc=0x2801019e, type=0x6) returned 0x18a002e [0036.854] SaveDC (hdc=0x2801019e) returned 1 [0036.854] GetNearestColor (hdc=0x2801019e, color=0xf0f0f0) returned 0xf0f0f0 [0036.854] RestoreDC (hdc=0x2801019e, nSavedDC=-1) returned 1 [0036.854] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2801019e) returned 0x0 [0036.854] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.854] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0036.854] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0036.854] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0036.855] GetCurrentObject (hdc=0x2801019e, type=0x1) returned 0x1b00017 [0036.855] GetCurrentObject (hdc=0x2801019e, type=0x2) returned 0x1900010 [0036.855] GetCurrentObject (hdc=0x2801019e, type=0x7) returned 0x1e0501b7 [0036.855] GetCurrentObject (hdc=0x2801019e, type=0x6) returned 0x18a002e [0036.855] SaveDC (hdc=0x2801019e) returned 1 [0036.855] GetTextAlign (hdc=0x2801019e) returned 0x0 [0036.855] GetTextColor (hdc=0x2801019e) returned 0x0 [0036.855] SetTextColor (hdc=0x2801019e, color=0xf0f0f0) returned 0x0 [0036.855] GetCurrentObject (hdc=0x2801019e, type=0x6) returned 0x18a002e [0036.855] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0036.855] SelectObject (hdc=0x2801019e, h=0x260a09ba) returned 0x18a002e [0036.855] GetBkMode (hdc=0x2801019e) returned 2 [0036.855] SetBkMode (hdc=0x2801019e, mode=1) returned 2 [0036.855] DrawTextExW (in: hdc=0x2801019e, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2756a48 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0036.855] DrawTextExW (in: hdc=0x2801019e, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2756a48 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0036.856] RestoreDC (hdc=0x2801019e, nSavedDC=-1) returned 1 [0036.856] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2801019e) returned 0x0 [0036.856] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0036.856] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x2801019e, x1=0, y1=0, rop=0xcc0020) returned 1 [0036.856] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2801019e) returned 0x0 [0036.856] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0036.856] SelectObject (hdc=0x2801019e, h=0x185000f) returned 0x1e0501b7 [0036.856] DeleteDC (hdc=0x2801019e) returned 1 [0036.856] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0036.856] DeleteObject (ho=0x1e0501b7) returned 1 [0036.859] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0036.859] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.859] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.859] WaitMessage () returned 1 [0036.970] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.970] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.970] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.971] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.971] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.971] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0036.971] GetCurrentThreadId () returned 0xa28 [0036.971] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0036.971] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.971] IsWindowUnicode (hWnd=0x3015e) returned 1 [0036.971] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0036.971] TranslateMessage (lpMsg=0x26ee10) returned 0 [0036.971] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0036.971] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0036.971] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0036.971] CreateCompatibleDC (hdc=0x60109d6) returned 0x100109d7 [0036.971] GetObjectType (h=0x60109d6) returned 0x3 [0036.971] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x1c0509d2 [0036.971] GetDIBits (in: hdc=0x60109d6, hbm=0x1c0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.971] GetDIBits (in: hdc=0x60109d6, hbm=0x1c0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0036.971] DeleteObject (ho=0x1c0509d2) returned 1 [0036.971] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4d0509c0 [0036.972] SelectObject (hdc=0x100109d7, h=0x4d0509c0) returned 0x185000f [0036.972] GdipCreateFromHDC (hdc=0x100109d7, graphics=0x26e408) returned 0x0 [0036.972] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0036.972] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0036.972] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0036.972] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0036.972] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0036.972] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4120 [0036.972] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4120) returned 0x0 [0036.972] LocalFree (hMem=0x1a7d4120) returned 0x0 [0036.972] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0036.972] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0036.972] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0036.972] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0036.972] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0036.972] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.972] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.972] GetSystemMetrics (nIndex=42) returned 0 [0036.972] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.972] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.972] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0036.973] IsAppThemed () returned 0x1 [0036.973] GetThemeAppProperties () returned 0x3 [0036.973] GetThemeAppProperties () returned 0x3 [0036.973] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0036.973] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0036.973] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0036.973] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0036.973] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0036.973] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4120 [0036.973] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4120) returned 0x0 [0036.973] LocalFree (hMem=0x1a7d4120) returned 0x0 [0036.973] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0036.973] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4120 [0036.973] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4120) returned 0x0 [0036.973] LocalFree (hMem=0x1a7d4120) returned 0x0 [0036.973] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0036.973] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0036.973] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0036.973] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0036.973] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0036.973] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0036.973] GetCurrentObject (hdc=0x100109d7, type=0x1) returned 0x1b00017 [0036.973] GetCurrentObject (hdc=0x100109d7, type=0x2) returned 0x1900010 [0036.973] GetCurrentObject (hdc=0x100109d7, type=0x7) returned 0x4d0509c0 [0036.973] GetCurrentObject (hdc=0x100109d7, type=0x6) returned 0x18a002e [0036.973] SaveDC (hdc=0x100109d7) returned 1 [0036.973] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x170409f1 [0036.973] GetClipRgn (hdc=0x100109d7, hrgn=0x170409f1) returned 0 [0036.973] SelectClipRgn (hdc=0x100109d7, hrgn=0x3e0409ff) returned 2 [0036.973] DeleteObject (ho=0x170409f1) returned 1 [0036.974] DeleteObject (ho=0x3e0409ff) returned 1 [0036.974] OffsetViewportOrgEx (in: hdc=0x100109d7, x=0, y=0, lppt=0x2758628 | out: lppt=0x2758628) returned 1 [0036.974] OffsetViewportOrgEx (in: hdc=0x100109d7, x=-417, y=-278, lppt=0x2758640 | out: lppt=0x2758640) returned 1 [0036.974] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0036.974] GetCurrentObject (hdc=0x100109d7, type=0x1) returned 0x1b00017 [0036.974] GetCurrentObject (hdc=0x100109d7, type=0x2) returned 0x1900010 [0036.974] GetCurrentObject (hdc=0x100109d7, type=0x7) returned 0x4d0509c0 [0036.974] GetCurrentObject (hdc=0x100109d7, type=0x6) returned 0x18a002e [0036.974] SaveDC (hdc=0x100109d7) returned 2 [0036.974] GetNearestColor (hdc=0x100109d7, color=0x6c4607) returned 0x6c4607 [0036.974] CreateSolidBrush (color=0x6c4607) returned 0x44100276 [0036.974] FillRect (hDC=0x100109d7, lprc=0x26de08, hbr=0x44100276) returned 1 [0036.978] DeleteObject (ho=0x44100276) returned 1 [0036.978] RestoreDC (hdc=0x100109d7, nSavedDC=-1) returned 1 [0036.978] RestoreDC (hdc=0x100109d7, nSavedDC=-1) returned 1 [0036.978] GdipReleaseDC (graphics=0x1b86d040, hdc=0x100109d7) returned 0x0 [0036.978] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffdae0dbd) returned 0x0 [0036.978] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0036.978] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0036.978] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0036.978] GetSystemMetrics (nIndex=42) returned 0 [0036.978] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0036.978] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0036.978] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x6) returned 0x0 [0036.979] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0036.979] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0036.979] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0036.979] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0036.979] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0036.979] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0036.979] GetCurrentObject (hdc=0x100109d7, type=0x1) returned 0x1b00017 [0036.979] GetCurrentObject (hdc=0x100109d7, type=0x2) returned 0x1900010 [0036.979] GetCurrentObject (hdc=0x100109d7, type=0x7) returned 0x4d0509c0 [0036.979] GetCurrentObject (hdc=0x100109d7, type=0x6) returned 0x18a002e [0036.979] SaveDC (hdc=0x100109d7) returned 1 [0036.980] GetNearestColor (hdc=0x100109d7, color=0xf0f0f0) returned 0xf0f0f0 [0036.980] RestoreDC (hdc=0x100109d7, nSavedDC=-1) returned 1 [0036.980] GdipReleaseDC (graphics=0x1b86d040, hdc=0x100109d7) returned 0x0 [0036.980] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0036.980] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0036.980] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0036.980] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0036.980] GetCurrentObject (hdc=0x100109d7, type=0x1) returned 0x1b00017 [0036.980] GetCurrentObject (hdc=0x100109d7, type=0x2) returned 0x1900010 [0036.980] GetCurrentObject (hdc=0x100109d7, type=0x7) returned 0x4d0509c0 [0036.980] GetCurrentObject (hdc=0x100109d7, type=0x6) returned 0x18a002e [0036.980] SaveDC (hdc=0x100109d7) returned 1 [0036.980] GetTextAlign (hdc=0x100109d7) returned 0x0 [0036.980] GetTextColor (hdc=0x100109d7) returned 0x0 [0036.980] SetTextColor (hdc=0x100109d7, color=0xf0f0f0) returned 0x0 [0036.980] GetCurrentObject (hdc=0x100109d7, type=0x6) returned 0x18a002e [0036.980] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0036.980] SelectObject (hdc=0x100109d7, h=0x260a09ba) returned 0x18a002e [0036.980] GetBkMode (hdc=0x100109d7) returned 2 [0036.980] SetBkMode (hdc=0x100109d7, mode=1) returned 2 [0036.981] DrawTextExW (in: hdc=0x100109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27594c8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0036.981] DrawTextExW (in: hdc=0x100109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27594c8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0036.981] RestoreDC (hdc=0x100109d7, nSavedDC=-1) returned 1 [0036.981] GdipReleaseDC (graphics=0x1b86d040, hdc=0x100109d7) returned 0x0 [0036.981] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0036.981] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x100109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0036.982] GdipReleaseDC (graphics=0x1b86d040, hdc=0x100109d7) returned 0x0 [0036.982] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0036.982] SelectObject (hdc=0x100109d7, h=0x185000f) returned 0x4d0509c0 [0036.982] DeleteDC (hdc=0x100109d7) returned 1 [0036.982] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0036.982] DeleteObject (ho=0x4d0509c0) returned 1 [0036.985] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0036.985] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.985] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0036.985] WaitMessage () returned 1 [0037.500] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.500] IsWindowUnicode (hWnd=0x3015e) returned 1 [0037.500] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.500] TranslateMessage (lpMsg=0x26ee10) returned 0 [0037.500] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0037.500] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0037.500] GetCurrentThreadId () returned 0xa28 [0037.500] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0037.501] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.501] IsWindowUnicode (hWnd=0x3015e) returned 1 [0037.501] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.501] TranslateMessage (lpMsg=0x26ee10) returned 0 [0037.501] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0037.501] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0037.501] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0037.501] CreateCompatibleDC (hdc=0x60109d6) returned 0x1e0109d2 [0037.501] GetObjectType (h=0x60109d6) returned 0x3 [0037.501] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x4e0509c0 [0037.501] GetDIBits (in: hdc=0x60109d6, hbm=0x4e0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0037.501] GetDIBits (in: hdc=0x60109d6, hbm=0x4e0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0037.502] DeleteObject (ho=0x4e0509c0) returned 1 [0037.502] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x110509d7 [0037.502] SelectObject (hdc=0x1e0109d2, h=0x110509d7) returned 0x185000f [0037.502] GdipCreateFromHDC (hdc=0x1e0109d2, graphics=0x26e408) returned 0x0 [0037.502] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0037.503] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0037.503] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0037.503] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0037.503] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0037.503] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d41a0 [0037.503] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d41a0) returned 0x0 [0037.503] LocalFree (hMem=0x1a7d41a0) returned 0x0 [0037.503] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0037.503] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0037.503] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0037.503] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0037.503] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0037.503] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0037.503] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0037.504] GetSystemMetrics (nIndex=42) returned 0 [0037.504] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0037.504] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0037.504] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0037.504] IsAppThemed () returned 0x1 [0037.504] GetThemeAppProperties () returned 0x3 [0037.504] GetThemeAppProperties () returned 0x3 [0037.504] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0037.504] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0037.504] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0037.504] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0037.504] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0037.504] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d41a0 [0037.504] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d41a0) returned 0x0 [0037.504] LocalFree (hMem=0x1a7d41a0) returned 0x0 [0037.504] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0037.504] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d41a0 [0037.504] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d41a0) returned 0x0 [0037.504] LocalFree (hMem=0x1a7d41a0) returned 0x0 [0037.504] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0037.504] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0037.504] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0037.504] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0037.504] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0037.504] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0037.505] GetCurrentObject (hdc=0x1e0109d2, type=0x1) returned 0x1b00017 [0037.505] GetCurrentObject (hdc=0x1e0109d2, type=0x2) returned 0x1900010 [0037.505] GetCurrentObject (hdc=0x1e0109d2, type=0x7) returned 0x110509d7 [0037.505] GetCurrentObject (hdc=0x1e0109d2, type=0x6) returned 0x18a002e [0037.505] SaveDC (hdc=0x1e0109d2) returned 1 [0037.505] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3f0409ff [0037.505] GetClipRgn (hdc=0x1e0109d2, hrgn=0x3f0409ff) returned 0 [0037.505] SelectClipRgn (hdc=0x1e0109d2, hrgn=0x1a0409f1) returned 2 [0037.505] DeleteObject (ho=0x3f0409ff) returned 1 [0037.505] DeleteObject (ho=0x1a0409f1) returned 1 [0037.505] OffsetViewportOrgEx (in: hdc=0x1e0109d2, x=0, y=0, lppt=0x275b0a8 | out: lppt=0x275b0a8) returned 1 [0037.505] OffsetViewportOrgEx (in: hdc=0x1e0109d2, x=-417, y=-278, lppt=0x275b0c0 | out: lppt=0x275b0c0) returned 1 [0037.505] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0037.505] GetCurrentObject (hdc=0x1e0109d2, type=0x1) returned 0x1b00017 [0037.505] GetCurrentObject (hdc=0x1e0109d2, type=0x2) returned 0x1900010 [0037.505] GetCurrentObject (hdc=0x1e0109d2, type=0x7) returned 0x110509d7 [0037.505] GetCurrentObject (hdc=0x1e0109d2, type=0x6) returned 0x18a002e [0037.505] SaveDC (hdc=0x1e0109d2) returned 2 [0037.505] GetNearestColor (hdc=0x1e0109d2, color=0x6c4607) returned 0x6c4607 [0037.505] CreateSolidBrush (color=0x6c4607) returned 0x45100276 [0037.505] FillRect (hDC=0x1e0109d2, lprc=0x26de08, hbr=0x45100276) returned 1 [0037.512] DeleteObject (ho=0x45100276) returned 1 [0037.512] RestoreDC (hdc=0x1e0109d2, nSavedDC=-1) returned 1 [0037.512] RestoreDC (hdc=0x1e0109d2, nSavedDC=-1) returned 1 [0037.512] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1e0109d2) returned 0x0 [0037.512] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffdac0dbd) returned 0x0 [0037.512] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0037.512] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0037.512] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0037.512] GetSystemMetrics (nIndex=42) returned 0 [0037.512] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0037.512] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0037.512] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0037.512] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0037.512] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0037.512] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0037.512] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0037.513] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0037.513] GetCurrentObject (hdc=0x1e0109d2, type=0x1) returned 0x1b00017 [0037.513] GetCurrentObject (hdc=0x1e0109d2, type=0x2) returned 0x1900010 [0037.513] GetCurrentObject (hdc=0x1e0109d2, type=0x7) returned 0x110509d7 [0037.513] GetCurrentObject (hdc=0x1e0109d2, type=0x6) returned 0x18a002e [0037.513] SaveDC (hdc=0x1e0109d2) returned 1 [0037.513] GetNearestColor (hdc=0x1e0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0037.513] RestoreDC (hdc=0x1e0109d2, nSavedDC=-1) returned 1 [0037.513] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1e0109d2) returned 0x0 [0037.514] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0037.514] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0037.514] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0037.514] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0037.514] GetCurrentObject (hdc=0x1e0109d2, type=0x1) returned 0x1b00017 [0037.514] GetCurrentObject (hdc=0x1e0109d2, type=0x2) returned 0x1900010 [0037.514] GetCurrentObject (hdc=0x1e0109d2, type=0x7) returned 0x110509d7 [0037.514] GetCurrentObject (hdc=0x1e0109d2, type=0x6) returned 0x18a002e [0037.514] SaveDC (hdc=0x1e0109d2) returned 1 [0037.514] GetTextAlign (hdc=0x1e0109d2) returned 0x0 [0037.514] GetTextColor (hdc=0x1e0109d2) returned 0x0 [0037.514] SetTextColor (hdc=0x1e0109d2, color=0xf0f0f0) returned 0x0 [0037.514] GetCurrentObject (hdc=0x1e0109d2, type=0x6) returned 0x18a002e [0037.514] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0037.514] SelectObject (hdc=0x1e0109d2, h=0x260a09ba) returned 0x18a002e [0037.514] GetBkMode (hdc=0x1e0109d2) returned 2 [0037.514] SetBkMode (hdc=0x1e0109d2, mode=1) returned 2 [0037.514] DrawTextExW (in: hdc=0x1e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x275bd70 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0037.515] DrawTextExW (in: hdc=0x1e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x275bd70 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0037.516] RestoreDC (hdc=0x1e0109d2, nSavedDC=-1) returned 1 [0037.516] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1e0109d2) returned 0x0 [0037.516] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0037.516] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x1e0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0037.516] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1e0109d2) returned 0x0 [0037.516] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0037.516] SelectObject (hdc=0x1e0109d2, h=0x185000f) returned 0x110509d7 [0037.516] DeleteDC (hdc=0x1e0109d2) returned 1 [0037.516] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0037.516] DeleteObject (ho=0x110509d7) returned 1 [0037.519] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0037.519] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0037.520] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0037.520] WaitMessage () returned 1 [0037.641] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.641] IsWindowUnicode (hWnd=0x3015e) returned 1 [0037.641] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.641] TranslateMessage (lpMsg=0x26ee10) returned 0 [0037.641] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0037.641] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0037.641] GetCurrentThreadId () returned 0xa28 [0037.641] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0037.642] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.642] IsWindowUnicode (hWnd=0x3015e) returned 1 [0037.642] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.642] TranslateMessage (lpMsg=0x26ee10) returned 0 [0037.642] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0037.642] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0037.642] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0037.642] CreateCompatibleDC (hdc=0x60109d6) returned 0x500109c0 [0037.642] GetObjectType (h=0x60109d6) returned 0x3 [0037.642] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x120509d7 [0037.642] GetDIBits (in: hdc=0x60109d6, hbm=0x120509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0037.642] GetDIBits (in: hdc=0x60109d6, hbm=0x120509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0037.642] DeleteObject (ho=0x120509d7) returned 1 [0037.642] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x1f0509d2 [0037.643] SelectObject (hdc=0x500109c0, h=0x1f0509d2) returned 0x185000f [0037.643] GdipCreateFromHDC (hdc=0x500109c0, graphics=0x26e408) returned 0x0 [0037.643] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0037.643] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0037.643] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0037.643] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0037.643] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0037.643] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d41a0 [0037.643] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d41a0) returned 0x0 [0037.643] LocalFree (hMem=0x1a7d41a0) returned 0x0 [0037.643] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0037.643] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0037.643] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0037.643] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0037.643] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0037.643] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0037.643] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0037.643] GetSystemMetrics (nIndex=42) returned 0 [0037.643] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0037.643] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0037.644] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0037.644] IsAppThemed () returned 0x1 [0037.644] GetThemeAppProperties () returned 0x3 [0037.644] GetThemeAppProperties () returned 0x3 [0037.644] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0037.644] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0037.644] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0037.644] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0037.644] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0037.644] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d41a0 [0037.644] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d41a0) returned 0x0 [0037.644] LocalFree (hMem=0x1a7d41a0) returned 0x0 [0037.644] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0037.644] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d41a0 [0037.644] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d41a0) returned 0x0 [0037.644] LocalFree (hMem=0x1a7d41a0) returned 0x0 [0037.644] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0037.644] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0037.644] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0037.644] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0037.644] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0037.644] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0037.644] GetCurrentObject (hdc=0x500109c0, type=0x1) returned 0x1b00017 [0037.644] GetCurrentObject (hdc=0x500109c0, type=0x2) returned 0x1900010 [0037.644] GetCurrentObject (hdc=0x500109c0, type=0x7) returned 0x1f0509d2 [0037.644] GetCurrentObject (hdc=0x500109c0, type=0x6) returned 0x18a002e [0037.644] SaveDC (hdc=0x500109c0) returned 1 [0037.644] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1b0409f1 [0037.645] GetClipRgn (hdc=0x500109c0, hrgn=0x1b0409f1) returned 0 [0037.645] SelectClipRgn (hdc=0x500109c0, hrgn=0x420409ff) returned 2 [0037.645] DeleteObject (ho=0x1b0409f1) returned 1 [0037.645] DeleteObject (ho=0x420409ff) returned 1 [0037.645] OffsetViewportOrgEx (in: hdc=0x500109c0, x=0, y=0, lppt=0x275d950 | out: lppt=0x275d950) returned 1 [0037.645] OffsetViewportOrgEx (in: hdc=0x500109c0, x=-417, y=-278, lppt=0x275d968 | out: lppt=0x275d968) returned 1 [0037.645] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0037.645] GetCurrentObject (hdc=0x500109c0, type=0x1) returned 0x1b00017 [0037.645] GetCurrentObject (hdc=0x500109c0, type=0x2) returned 0x1900010 [0037.645] GetCurrentObject (hdc=0x500109c0, type=0x7) returned 0x1f0509d2 [0037.645] GetCurrentObject (hdc=0x500109c0, type=0x6) returned 0x18a002e [0037.645] SaveDC (hdc=0x500109c0) returned 2 [0037.645] GetNearestColor (hdc=0x500109c0, color=0x6c4607) returned 0x6c4607 [0037.645] CreateSolidBrush (color=0x6c4607) returned 0x46100276 [0037.645] FillRect (hDC=0x500109c0, lprc=0x26de08, hbr=0x46100276) returned 1 [0037.651] DeleteObject (ho=0x46100276) returned 1 [0037.651] RestoreDC (hdc=0x500109c0, nSavedDC=-1) returned 1 [0037.651] RestoreDC (hdc=0x500109c0, nSavedDC=-1) returned 1 [0037.651] GdipReleaseDC (graphics=0x1b86d040, hdc=0x500109c0) returned 0x0 [0037.651] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffdaa0dbd) returned 0x0 [0037.651] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0037.651] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0037.651] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0037.651] GetSystemMetrics (nIndex=42) returned 0 [0037.651] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0037.651] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0037.651] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x8) returned 0x0 [0037.655] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0037.655] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0037.655] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0037.655] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0037.655] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0037.655] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0037.655] GetCurrentObject (hdc=0x500109c0, type=0x1) returned 0x1b00017 [0037.655] GetCurrentObject (hdc=0x500109c0, type=0x2) returned 0x1900010 [0037.655] GetCurrentObject (hdc=0x500109c0, type=0x7) returned 0x1f0509d2 [0037.655] GetCurrentObject (hdc=0x500109c0, type=0x6) returned 0x18a002e [0037.655] SaveDC (hdc=0x500109c0) returned 1 [0037.655] GetNearestColor (hdc=0x500109c0, color=0xf0f0f0) returned 0xf0f0f0 [0037.655] RestoreDC (hdc=0x500109c0, nSavedDC=-1) returned 1 [0037.655] GdipReleaseDC (graphics=0x1b86d040, hdc=0x500109c0) returned 0x0 [0037.655] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0037.655] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0037.655] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0037.655] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0037.655] GetCurrentObject (hdc=0x500109c0, type=0x1) returned 0x1b00017 [0037.655] GetCurrentObject (hdc=0x500109c0, type=0x2) returned 0x1900010 [0037.655] GetCurrentObject (hdc=0x500109c0, type=0x7) returned 0x1f0509d2 [0037.655] GetCurrentObject (hdc=0x500109c0, type=0x6) returned 0x18a002e [0037.656] SaveDC (hdc=0x500109c0) returned 1 [0037.656] GetTextAlign (hdc=0x500109c0) returned 0x0 [0037.656] GetTextColor (hdc=0x500109c0) returned 0x0 [0037.656] SetTextColor (hdc=0x500109c0, color=0xf0f0f0) returned 0x0 [0037.656] GetCurrentObject (hdc=0x500109c0, type=0x6) returned 0x18a002e [0037.656] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0037.656] SelectObject (hdc=0x500109c0, h=0x260a09ba) returned 0x18a002e [0037.656] GetBkMode (hdc=0x500109c0) returned 2 [0037.656] SetBkMode (hdc=0x500109c0, mode=1) returned 2 [0037.656] DrawTextExW (in: hdc=0x500109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x275e808 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0037.656] DrawTextExW (in: hdc=0x500109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x275e808 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0037.657] RestoreDC (hdc=0x500109c0, nSavedDC=-1) returned 1 [0037.657] GdipReleaseDC (graphics=0x1b86d040, hdc=0x500109c0) returned 0x0 [0037.657] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0037.657] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x500109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0037.657] GdipReleaseDC (graphics=0x1b86d040, hdc=0x500109c0) returned 0x0 [0037.657] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0037.657] SelectObject (hdc=0x500109c0, h=0x185000f) returned 0x1f0509d2 [0037.657] DeleteDC (hdc=0x500109c0) returned 1 [0037.657] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0037.657] DeleteObject (ho=0x1f0509d2) returned 1 [0037.661] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0037.661] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0037.661] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0037.661] WaitMessage () returned 1 [0037.786] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.786] IsWindowUnicode (hWnd=0x3015e) returned 1 [0037.786] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.786] TranslateMessage (lpMsg=0x26ee10) returned 0 [0037.786] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0037.786] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0037.786] GetCurrentThreadId () returned 0xa28 [0037.786] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0037.786] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.786] IsWindowUnicode (hWnd=0x3015e) returned 1 [0037.786] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.786] TranslateMessage (lpMsg=0x26ee10) returned 0 [0037.786] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0037.786] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0037.786] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0037.786] CreateCompatibleDC (hdc=0x60109d6) returned 0x140109d7 [0037.786] GetObjectType (h=0x60109d6) returned 0x3 [0037.786] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x200509d2 [0037.786] GetDIBits (in: hdc=0x60109d6, hbm=0x200509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0037.787] GetDIBits (in: hdc=0x60109d6, hbm=0x200509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0037.787] DeleteObject (ho=0x200509d2) returned 1 [0037.787] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x510509c0 [0037.787] SelectObject (hdc=0x140109d7, h=0x510509c0) returned 0x185000f [0037.787] GdipCreateFromHDC (hdc=0x140109d7, graphics=0x26e408) returned 0x0 [0037.787] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0037.787] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0037.787] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0037.787] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0037.787] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0037.787] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4220 [0037.787] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4220) returned 0x0 [0037.787] LocalFree (hMem=0x1a7d4220) returned 0x0 [0037.787] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0037.787] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0037.787] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0037.787] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0037.787] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0037.788] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0037.788] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0037.788] GetSystemMetrics (nIndex=42) returned 0 [0037.788] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0037.788] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0037.788] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0037.788] IsAppThemed () returned 0x1 [0037.788] GetThemeAppProperties () returned 0x3 [0037.788] GetThemeAppProperties () returned 0x3 [0037.788] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0037.788] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0037.788] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0037.788] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0037.788] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0037.788] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4220 [0037.788] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4220) returned 0x0 [0037.788] LocalFree (hMem=0x1a7d4220) returned 0x0 [0037.788] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0037.788] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4220 [0037.788] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4220) returned 0x0 [0037.788] LocalFree (hMem=0x1a7d4220) returned 0x0 [0037.788] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0037.788] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0037.788] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0037.788] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0037.788] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0037.788] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0037.788] GetCurrentObject (hdc=0x140109d7, type=0x1) returned 0x1b00017 [0037.788] GetCurrentObject (hdc=0x140109d7, type=0x2) returned 0x1900010 [0037.789] GetCurrentObject (hdc=0x140109d7, type=0x7) returned 0x510509c0 [0037.789] GetCurrentObject (hdc=0x140109d7, type=0x6) returned 0x18a002e [0037.789] SaveDC (hdc=0x140109d7) returned 1 [0037.789] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x430409ff [0037.789] GetClipRgn (hdc=0x140109d7, hrgn=0x430409ff) returned 0 [0037.789] SelectClipRgn (hdc=0x140109d7, hrgn=0x1e0409f1) returned 2 [0037.789] DeleteObject (ho=0x430409ff) returned 1 [0037.789] DeleteObject (ho=0x1e0409f1) returned 1 [0037.789] OffsetViewportOrgEx (in: hdc=0x140109d7, x=0, y=0, lppt=0x27603e8 | out: lppt=0x27603e8) returned 1 [0037.789] OffsetViewportOrgEx (in: hdc=0x140109d7, x=-417, y=-278, lppt=0x2760400 | out: lppt=0x2760400) returned 1 [0037.789] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0037.789] GetCurrentObject (hdc=0x140109d7, type=0x1) returned 0x1b00017 [0037.789] GetCurrentObject (hdc=0x140109d7, type=0x2) returned 0x1900010 [0037.789] GetCurrentObject (hdc=0x140109d7, type=0x7) returned 0x510509c0 [0037.789] GetCurrentObject (hdc=0x140109d7, type=0x6) returned 0x18a002e [0037.789] SaveDC (hdc=0x140109d7) returned 2 [0037.789] GetNearestColor (hdc=0x140109d7, color=0x6c4607) returned 0x6c4607 [0037.789] CreateSolidBrush (color=0x6c4607) returned 0x47100276 [0037.789] FillRect (hDC=0x140109d7, lprc=0x26de08, hbr=0x47100276) returned 1 [0037.794] DeleteObject (ho=0x47100276) returned 1 [0037.794] RestoreDC (hdc=0x140109d7, nSavedDC=-1) returned 1 [0037.794] RestoreDC (hdc=0x140109d7, nSavedDC=-1) returned 1 [0037.794] GdipReleaseDC (graphics=0x1b86d040, hdc=0x140109d7) returned 0x0 [0037.794] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffda80dbd) returned 0x0 [0037.794] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0037.794] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0037.794] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0037.794] GetSystemMetrics (nIndex=42) returned 0 [0037.794] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0037.794] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0037.794] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0037.794] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0037.794] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0037.794] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0037.794] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0037.794] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0037.795] GetCurrentObject (hdc=0x140109d7, type=0x1) returned 0x1b00017 [0037.795] GetCurrentObject (hdc=0x140109d7, type=0x2) returned 0x1900010 [0037.795] GetCurrentObject (hdc=0x140109d7, type=0x7) returned 0x510509c0 [0037.795] GetCurrentObject (hdc=0x140109d7, type=0x6) returned 0x18a002e [0037.795] SaveDC (hdc=0x140109d7) returned 1 [0037.795] GetNearestColor (hdc=0x140109d7, color=0xf0f0f0) returned 0xf0f0f0 [0037.795] RestoreDC (hdc=0x140109d7, nSavedDC=-1) returned 1 [0037.795] GdipReleaseDC (graphics=0x1b86d040, hdc=0x140109d7) returned 0x0 [0037.795] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0037.795] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0037.795] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0037.795] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0037.795] GetCurrentObject (hdc=0x140109d7, type=0x1) returned 0x1b00017 [0037.795] GetCurrentObject (hdc=0x140109d7, type=0x2) returned 0x1900010 [0037.795] GetCurrentObject (hdc=0x140109d7, type=0x7) returned 0x510509c0 [0037.795] GetCurrentObject (hdc=0x140109d7, type=0x6) returned 0x18a002e [0037.795] SaveDC (hdc=0x140109d7) returned 1 [0037.795] GetTextAlign (hdc=0x140109d7) returned 0x0 [0037.795] GetTextColor (hdc=0x140109d7) returned 0x0 [0037.796] SetTextColor (hdc=0x140109d7, color=0xf0f0f0) returned 0x0 [0037.796] GetCurrentObject (hdc=0x140109d7, type=0x6) returned 0x18a002e [0037.796] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0037.796] SelectObject (hdc=0x140109d7, h=0x260a09ba) returned 0x18a002e [0037.796] GetBkMode (hdc=0x140109d7) returned 2 [0037.796] SetBkMode (hdc=0x140109d7, mode=1) returned 2 [0037.796] DrawTextExW (in: hdc=0x140109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27610b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0037.796] DrawTextExW (in: hdc=0x140109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27610b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0037.796] RestoreDC (hdc=0x140109d7, nSavedDC=-1) returned 1 [0037.797] GdipReleaseDC (graphics=0x1b86d040, hdc=0x140109d7) returned 0x0 [0037.797] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0037.797] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x140109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0037.797] GdipReleaseDC (graphics=0x1b86d040, hdc=0x140109d7) returned 0x0 [0037.797] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0037.797] SelectObject (hdc=0x140109d7, h=0x185000f) returned 0x510509c0 [0037.797] DeleteDC (hdc=0x140109d7) returned 1 [0037.797] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0037.797] DeleteObject (ho=0x510509c0) returned 1 [0037.800] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0037.800] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0037.800] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0037.800] WaitMessage () returned 1 [0037.922] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.922] IsWindowUnicode (hWnd=0x3015e) returned 1 [0037.922] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.922] TranslateMessage (lpMsg=0x26ee10) returned 0 [0037.922] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0037.922] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0037.922] GetCurrentThreadId () returned 0xa28 [0037.922] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0037.922] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.922] IsWindowUnicode (hWnd=0x3015e) returned 1 [0037.922] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0037.922] TranslateMessage (lpMsg=0x26ee10) returned 0 [0037.922] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0037.922] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0037.923] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0037.923] CreateCompatibleDC (hdc=0x60109d6) returned 0x220109d2 [0037.923] GetObjectType (h=0x60109d6) returned 0x3 [0037.923] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x520509c0 [0037.923] GetDIBits (in: hdc=0x60109d6, hbm=0x520509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0037.923] GetDIBits (in: hdc=0x60109d6, hbm=0x520509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0037.923] DeleteObject (ho=0x520509c0) returned 1 [0037.923] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x150509d7 [0037.924] SelectObject (hdc=0x220109d2, h=0x150509d7) returned 0x185000f [0037.924] GdipCreateFromHDC (hdc=0x220109d2, graphics=0x26e408) returned 0x0 [0037.924] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0037.924] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0037.924] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0037.924] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0037.924] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0037.924] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4220 [0037.924] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4220) returned 0x0 [0037.924] LocalFree (hMem=0x1a7d4220) returned 0x0 [0037.924] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0037.924] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0037.924] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0037.924] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0037.924] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0037.924] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0037.924] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0037.924] GetSystemMetrics (nIndex=42) returned 0 [0037.924] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0037.924] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0037.925] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0037.925] IsAppThemed () returned 0x1 [0037.925] GetThemeAppProperties () returned 0x3 [0037.925] GetThemeAppProperties () returned 0x3 [0037.925] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0037.925] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0037.925] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0037.925] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0037.925] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0037.925] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4220 [0037.925] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4220) returned 0x0 [0037.925] LocalFree (hMem=0x1a7d4220) returned 0x0 [0037.925] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0037.925] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4220 [0037.925] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4220) returned 0x0 [0037.925] LocalFree (hMem=0x1a7d4220) returned 0x0 [0037.925] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0037.925] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0037.925] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0037.925] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0037.925] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0037.925] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0037.925] GetCurrentObject (hdc=0x220109d2, type=0x1) returned 0x1b00017 [0037.925] GetCurrentObject (hdc=0x220109d2, type=0x2) returned 0x1900010 [0037.925] GetCurrentObject (hdc=0x220109d2, type=0x7) returned 0x150509d7 [0037.925] GetCurrentObject (hdc=0x220109d2, type=0x6) returned 0x18a002e [0037.925] SaveDC (hdc=0x220109d2) returned 1 [0037.925] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1f0409f1 [0037.925] GetClipRgn (hdc=0x220109d2, hrgn=0x1f0409f1) returned 0 [0037.925] SelectClipRgn (hdc=0x220109d2, hrgn=0x460409ff) returned 2 [0037.926] DeleteObject (ho=0x1f0409f1) returned 1 [0037.926] DeleteObject (ho=0x460409ff) returned 1 [0037.926] OffsetViewportOrgEx (in: hdc=0x220109d2, x=0, y=0, lppt=0x2762c90 | out: lppt=0x2762c90) returned 1 [0037.926] OffsetViewportOrgEx (in: hdc=0x220109d2, x=-417, y=-278, lppt=0x2762ca8 | out: lppt=0x2762ca8) returned 1 [0037.926] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0037.926] GetCurrentObject (hdc=0x220109d2, type=0x1) returned 0x1b00017 [0037.926] GetCurrentObject (hdc=0x220109d2, type=0x2) returned 0x1900010 [0037.926] GetCurrentObject (hdc=0x220109d2, type=0x7) returned 0x150509d7 [0037.926] GetCurrentObject (hdc=0x220109d2, type=0x6) returned 0x18a002e [0037.926] SaveDC (hdc=0x220109d2) returned 2 [0037.926] GetNearestColor (hdc=0x220109d2, color=0x6c4607) returned 0x6c4607 [0037.926] CreateSolidBrush (color=0x6c4607) returned 0x48100276 [0037.926] FillRect (hDC=0x220109d2, lprc=0x26de08, hbr=0x48100276) returned 1 [0037.930] DeleteObject (ho=0x48100276) returned 1 [0037.930] RestoreDC (hdc=0x220109d2, nSavedDC=-1) returned 1 [0037.930] RestoreDC (hdc=0x220109d2, nSavedDC=-1) returned 1 [0037.930] GdipReleaseDC (graphics=0x1b86d040, hdc=0x220109d2) returned 0x0 [0037.930] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffda60dbd) returned 0x0 [0037.930] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0037.930] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0037.930] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0037.930] GetSystemMetrics (nIndex=42) returned 0 [0037.930] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0037.930] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0037.930] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xa) returned 0x0 [0037.931] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0037.931] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0037.931] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0037.931] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0037.931] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0037.931] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0037.931] GetCurrentObject (hdc=0x220109d2, type=0x1) returned 0x1b00017 [0037.931] GetCurrentObject (hdc=0x220109d2, type=0x2) returned 0x1900010 [0037.932] GetCurrentObject (hdc=0x220109d2, type=0x7) returned 0x150509d7 [0037.932] GetCurrentObject (hdc=0x220109d2, type=0x6) returned 0x18a002e [0037.932] SaveDC (hdc=0x220109d2) returned 1 [0037.932] GetNearestColor (hdc=0x220109d2, color=0xf0f0f0) returned 0xf0f0f0 [0037.932] RestoreDC (hdc=0x220109d2, nSavedDC=-1) returned 1 [0037.932] GdipReleaseDC (graphics=0x1b86d040, hdc=0x220109d2) returned 0x0 [0037.932] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0037.932] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0037.932] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0037.932] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0037.932] GetCurrentObject (hdc=0x220109d2, type=0x1) returned 0x1b00017 [0037.932] GetCurrentObject (hdc=0x220109d2, type=0x2) returned 0x1900010 [0037.932] GetCurrentObject (hdc=0x220109d2, type=0x7) returned 0x150509d7 [0037.932] GetCurrentObject (hdc=0x220109d2, type=0x6) returned 0x18a002e [0037.932] SaveDC (hdc=0x220109d2) returned 1 [0037.932] GetTextAlign (hdc=0x220109d2) returned 0x0 [0037.932] GetTextColor (hdc=0x220109d2) returned 0x0 [0037.932] SetTextColor (hdc=0x220109d2, color=0xf0f0f0) returned 0x0 [0037.932] GetCurrentObject (hdc=0x220109d2, type=0x6) returned 0x18a002e [0037.932] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0037.932] SelectObject (hdc=0x220109d2, h=0x260a09ba) returned 0x18a002e [0037.932] GetBkMode (hdc=0x220109d2) returned 2 [0037.933] SetBkMode (hdc=0x220109d2, mode=1) returned 2 [0037.933] DrawTextExW (in: hdc=0x220109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2763b80 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0037.933] DrawTextExW (in: hdc=0x220109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2763b80 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0037.933] RestoreDC (hdc=0x220109d2, nSavedDC=-1) returned 1 [0037.933] GdipReleaseDC (graphics=0x1b86d040, hdc=0x220109d2) returned 0x0 [0037.933] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0037.933] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x220109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0037.934] GdipReleaseDC (graphics=0x1b86d040, hdc=0x220109d2) returned 0x0 [0037.934] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0037.934] SelectObject (hdc=0x220109d2, h=0x185000f) returned 0x150509d7 [0037.934] DeleteDC (hdc=0x220109d2) returned 1 [0037.934] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0037.934] DeleteObject (ho=0x150509d7) returned 1 [0037.937] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0037.937] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0037.937] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0037.937] WaitMessage () returned 1 [0038.062] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.062] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.062] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.063] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.063] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.063] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0038.063] GetCurrentThreadId () returned 0xa28 [0038.063] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0038.063] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.063] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.063] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.063] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.063] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.063] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0038.063] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0038.063] CreateCompatibleDC (hdc=0x60109d6) returned 0x540109c0 [0038.063] GetObjectType (h=0x60109d6) returned 0x3 [0038.063] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x160509d7 [0038.063] GetDIBits (in: hdc=0x60109d6, hbm=0x160509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.063] GetDIBits (in: hdc=0x60109d6, hbm=0x160509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.063] DeleteObject (ho=0x160509d7) returned 1 [0038.063] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x230509d2 [0038.064] SelectObject (hdc=0x540109c0, h=0x230509d2) returned 0x185000f [0038.064] GdipCreateFromHDC (hdc=0x540109c0, graphics=0x26e408) returned 0x0 [0038.064] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0038.064] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0038.064] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0038.064] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0038.064] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0038.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d42a0 [0038.064] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d42a0) returned 0x0 [0038.064] LocalFree (hMem=0x1a7d42a0) returned 0x0 [0038.064] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0038.064] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0038.064] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0038.064] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0038.064] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0038.064] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.064] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.064] GetSystemMetrics (nIndex=42) returned 0 [0038.064] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.064] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.064] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0038.064] IsAppThemed () returned 0x1 [0038.064] GetThemeAppProperties () returned 0x3 [0038.064] GetThemeAppProperties () returned 0x3 [0038.065] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0038.065] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0038.065] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0038.065] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0038.065] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0038.065] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d42a0 [0038.065] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d42a0) returned 0x0 [0038.065] LocalFree (hMem=0x1a7d42a0) returned 0x0 [0038.065] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0038.065] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d42a0 [0038.065] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d42a0) returned 0x0 [0038.065] LocalFree (hMem=0x1a7d42a0) returned 0x0 [0038.065] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0038.065] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0038.065] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0038.065] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0038.065] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0038.065] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0038.065] GetCurrentObject (hdc=0x540109c0, type=0x1) returned 0x1b00017 [0038.065] GetCurrentObject (hdc=0x540109c0, type=0x2) returned 0x1900010 [0038.065] GetCurrentObject (hdc=0x540109c0, type=0x7) returned 0x230509d2 [0038.065] GetCurrentObject (hdc=0x540109c0, type=0x6) returned 0x18a002e [0038.065] SaveDC (hdc=0x540109c0) returned 1 [0038.065] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x470409ff [0038.065] GetClipRgn (hdc=0x540109c0, hrgn=0x470409ff) returned 0 [0038.065] SelectClipRgn (hdc=0x540109c0, hrgn=0x220409f1) returned 2 [0038.065] DeleteObject (ho=0x470409ff) returned 1 [0038.065] DeleteObject (ho=0x220409f1) returned 1 [0038.065] OffsetViewportOrgEx (in: hdc=0x540109c0, x=0, y=0, lppt=0x2765760 | out: lppt=0x2765760) returned 1 [0038.065] OffsetViewportOrgEx (in: hdc=0x540109c0, x=-417, y=-278, lppt=0x2765778 | out: lppt=0x2765778) returned 1 [0038.065] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0038.066] GetCurrentObject (hdc=0x540109c0, type=0x1) returned 0x1b00017 [0038.066] GetCurrentObject (hdc=0x540109c0, type=0x2) returned 0x1900010 [0038.066] GetCurrentObject (hdc=0x540109c0, type=0x7) returned 0x230509d2 [0038.066] GetCurrentObject (hdc=0x540109c0, type=0x6) returned 0x18a002e [0038.066] SaveDC (hdc=0x540109c0) returned 2 [0038.066] GetNearestColor (hdc=0x540109c0, color=0x6c4607) returned 0x6c4607 [0038.066] CreateSolidBrush (color=0x6c4607) returned 0x49100276 [0038.066] FillRect (hDC=0x540109c0, lprc=0x26de08, hbr=0x49100276) returned 1 [0038.069] DeleteObject (ho=0x49100276) returned 1 [0038.069] RestoreDC (hdc=0x540109c0, nSavedDC=-1) returned 1 [0038.069] RestoreDC (hdc=0x540109c0, nSavedDC=-1) returned 1 [0038.069] GdipReleaseDC (graphics=0x1b86d040, hdc=0x540109c0) returned 0x0 [0038.069] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffda40dbd) returned 0x0 [0038.069] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0038.070] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.070] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.070] GetSystemMetrics (nIndex=42) returned 0 [0038.070] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.070] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.070] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0038.070] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0038.070] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0038.070] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0038.070] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0038.070] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0038.070] GetCurrentObject (hdc=0x540109c0, type=0x1) returned 0x1b00017 [0038.070] GetCurrentObject (hdc=0x540109c0, type=0x2) returned 0x1900010 [0038.070] GetCurrentObject (hdc=0x540109c0, type=0x7) returned 0x230509d2 [0038.070] GetCurrentObject (hdc=0x540109c0, type=0x6) returned 0x18a002e [0038.070] SaveDC (hdc=0x540109c0) returned 1 [0038.070] GetNearestColor (hdc=0x540109c0, color=0xf0f0f0) returned 0xf0f0f0 [0038.070] RestoreDC (hdc=0x540109c0, nSavedDC=-1) returned 1 [0038.070] GdipReleaseDC (graphics=0x1b86d040, hdc=0x540109c0) returned 0x0 [0038.070] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0038.070] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0038.071] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0038.071] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0038.071] GetCurrentObject (hdc=0x540109c0, type=0x1) returned 0x1b00017 [0038.071] GetCurrentObject (hdc=0x540109c0, type=0x2) returned 0x1900010 [0038.071] GetCurrentObject (hdc=0x540109c0, type=0x7) returned 0x230509d2 [0038.071] GetCurrentObject (hdc=0x540109c0, type=0x6) returned 0x18a002e [0038.071] SaveDC (hdc=0x540109c0) returned 1 [0038.071] GetTextAlign (hdc=0x540109c0) returned 0x0 [0038.071] GetTextColor (hdc=0x540109c0) returned 0x0 [0038.071] SetTextColor (hdc=0x540109c0, color=0xf0f0f0) returned 0x0 [0038.071] GetCurrentObject (hdc=0x540109c0, type=0x6) returned 0x18a002e [0038.071] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0038.071] SelectObject (hdc=0x540109c0, h=0x260a09ba) returned 0x18a002e [0038.071] GetBkMode (hdc=0x540109c0) returned 2 [0038.071] SetBkMode (hdc=0x540109c0, mode=1) returned 2 [0038.071] DrawTextExW (in: hdc=0x540109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2766428 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0038.071] DrawTextExW (in: hdc=0x540109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2766428 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0038.072] RestoreDC (hdc=0x540109c0, nSavedDC=-1) returned 1 [0038.072] GdipReleaseDC (graphics=0x1b86d040, hdc=0x540109c0) returned 0x0 [0038.072] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0038.072] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x540109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0038.072] GdipReleaseDC (graphics=0x1b86d040, hdc=0x540109c0) returned 0x0 [0038.072] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0038.072] SelectObject (hdc=0x540109c0, h=0x185000f) returned 0x230509d2 [0038.072] DeleteDC (hdc=0x540109c0) returned 1 [0038.072] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0038.072] DeleteObject (ho=0x230509d2) returned 1 [0038.075] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0038.075] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.075] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.075] WaitMessage () returned 1 [0038.187] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.187] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.187] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.187] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.187] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.188] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0038.188] GetCurrentThreadId () returned 0xa28 [0038.188] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0038.188] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.188] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.188] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.188] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.188] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.188] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0038.188] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0038.188] CreateCompatibleDC (hdc=0x60109d6) returned 0x180109d7 [0038.188] GetObjectType (h=0x60109d6) returned 0x3 [0038.188] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x240509d2 [0038.188] GetDIBits (in: hdc=0x60109d6, hbm=0x240509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.188] GetDIBits (in: hdc=0x60109d6, hbm=0x240509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.188] DeleteObject (ho=0x240509d2) returned 1 [0038.188] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x550509c0 [0038.188] SelectObject (hdc=0x180109d7, h=0x550509c0) returned 0x185000f [0038.188] GdipCreateFromHDC (hdc=0x180109d7, graphics=0x26e408) returned 0x0 [0038.189] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0038.189] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0038.189] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0038.189] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0038.189] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0038.189] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d42a0 [0038.189] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d42a0) returned 0x0 [0038.189] LocalFree (hMem=0x1a7d42a0) returned 0x0 [0038.189] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0038.189] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0038.189] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0038.189] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0038.189] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0038.189] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.189] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.189] GetSystemMetrics (nIndex=42) returned 0 [0038.189] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.189] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.189] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0038.189] IsAppThemed () returned 0x1 [0038.189] GetThemeAppProperties () returned 0x3 [0038.189] GetThemeAppProperties () returned 0x3 [0038.189] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0038.189] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0038.189] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0038.189] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0038.189] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0038.189] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d42a0 [0038.189] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d42a0) returned 0x0 [0038.190] LocalFree (hMem=0x1a7d42a0) returned 0x0 [0038.190] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0038.190] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d42a0 [0038.190] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d42a0) returned 0x0 [0038.190] LocalFree (hMem=0x1a7d42a0) returned 0x0 [0038.190] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0038.190] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0038.190] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0038.190] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0038.190] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0038.190] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0038.190] GetCurrentObject (hdc=0x180109d7, type=0x1) returned 0x1b00017 [0038.190] GetCurrentObject (hdc=0x180109d7, type=0x2) returned 0x1900010 [0038.190] GetCurrentObject (hdc=0x180109d7, type=0x7) returned 0x550509c0 [0038.190] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0038.190] SaveDC (hdc=0x180109d7) returned 1 [0038.190] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x230409f1 [0038.190] GetClipRgn (hdc=0x180109d7, hrgn=0x230409f1) returned 0 [0038.190] SelectClipRgn (hdc=0x180109d7, hrgn=0x4a0409ff) returned 2 [0038.190] DeleteObject (ho=0x230409f1) returned 1 [0038.190] DeleteObject (ho=0x4a0409ff) returned 1 [0038.190] OffsetViewportOrgEx (in: hdc=0x180109d7, x=0, y=0, lppt=0x2768008 | out: lppt=0x2768008) returned 1 [0038.190] OffsetViewportOrgEx (in: hdc=0x180109d7, x=-417, y=-278, lppt=0x2768020 | out: lppt=0x2768020) returned 1 [0038.190] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0038.190] GetCurrentObject (hdc=0x180109d7, type=0x1) returned 0x1b00017 [0038.190] GetCurrentObject (hdc=0x180109d7, type=0x2) returned 0x1900010 [0038.190] GetCurrentObject (hdc=0x180109d7, type=0x7) returned 0x550509c0 [0038.191] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0038.191] SaveDC (hdc=0x180109d7) returned 2 [0038.191] GetNearestColor (hdc=0x180109d7, color=0x6c4607) returned 0x6c4607 [0038.191] CreateSolidBrush (color=0x6c4607) returned 0x4a100276 [0038.191] FillRect (hDC=0x180109d7, lprc=0x26de08, hbr=0x4a100276) returned 1 [0038.194] DeleteObject (ho=0x4a100276) returned 1 [0038.194] RestoreDC (hdc=0x180109d7, nSavedDC=-1) returned 1 [0038.194] RestoreDC (hdc=0x180109d7, nSavedDC=-1) returned 1 [0038.194] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109d7) returned 0x0 [0038.194] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffda20dbd) returned 0x0 [0038.194] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0038.194] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.194] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.195] GetSystemMetrics (nIndex=42) returned 0 [0038.195] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.195] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.195] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xc) returned 0x0 [0038.196] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0038.196] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0038.196] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0038.196] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0038.196] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0038.196] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0038.196] GetCurrentObject (hdc=0x180109d7, type=0x1) returned 0x1b00017 [0038.196] GetCurrentObject (hdc=0x180109d7, type=0x2) returned 0x1900010 [0038.196] GetCurrentObject (hdc=0x180109d7, type=0x7) returned 0x550509c0 [0038.196] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0038.196] SaveDC (hdc=0x180109d7) returned 1 [0038.196] GetNearestColor (hdc=0x180109d7, color=0xf0f0f0) returned 0xf0f0f0 [0038.196] RestoreDC (hdc=0x180109d7, nSavedDC=-1) returned 1 [0038.196] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109d7) returned 0x0 [0038.197] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0038.197] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0038.197] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0038.197] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0038.197] GetCurrentObject (hdc=0x180109d7, type=0x1) returned 0x1b00017 [0038.197] GetCurrentObject (hdc=0x180109d7, type=0x2) returned 0x1900010 [0038.197] GetCurrentObject (hdc=0x180109d7, type=0x7) returned 0x550509c0 [0038.197] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0038.197] SaveDC (hdc=0x180109d7) returned 1 [0038.197] GetTextAlign (hdc=0x180109d7) returned 0x0 [0038.197] GetTextColor (hdc=0x180109d7) returned 0x0 [0038.197] SetTextColor (hdc=0x180109d7, color=0xf0f0f0) returned 0x0 [0038.197] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0038.197] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0038.197] SelectObject (hdc=0x180109d7, h=0x260a09ba) returned 0x18a002e [0038.197] GetBkMode (hdc=0x180109d7) returned 2 [0038.197] SetBkMode (hdc=0x180109d7, mode=1) returned 2 [0038.197] DrawTextExW (in: hdc=0x180109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2768f10 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0038.197] DrawTextExW (in: hdc=0x180109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2768f10 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0038.198] RestoreDC (hdc=0x180109d7, nSavedDC=-1) returned 1 [0038.198] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109d7) returned 0x0 [0038.198] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0038.198] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x180109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0038.198] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109d7) returned 0x0 [0038.198] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0038.198] SelectObject (hdc=0x180109d7, h=0x185000f) returned 0x550509c0 [0038.198] DeleteDC (hdc=0x180109d7) returned 1 [0038.198] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0038.198] DeleteObject (ho=0x550509c0) returned 1 [0038.201] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0038.201] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.201] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.201] WaitMessage () returned 1 [0038.312] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.312] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.312] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.312] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.312] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.312] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0038.312] GetCurrentThreadId () returned 0xa28 [0038.312] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0038.312] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.312] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.312] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.312] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.312] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.313] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0038.313] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0038.313] CreateCompatibleDC (hdc=0x60109d6) returned 0x260109d2 [0038.313] GetObjectType (h=0x60109d6) returned 0x3 [0038.313] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x560509c0 [0038.313] GetDIBits (in: hdc=0x60109d6, hbm=0x560509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.313] GetDIBits (in: hdc=0x60109d6, hbm=0x560509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.313] DeleteObject (ho=0x560509c0) returned 1 [0038.313] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x190509d7 [0038.313] SelectObject (hdc=0x260109d2, h=0x190509d7) returned 0x185000f [0038.313] GdipCreateFromHDC (hdc=0x260109d2, graphics=0x26e408) returned 0x0 [0038.313] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0038.313] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0038.313] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0038.314] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0038.314] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0038.314] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4320 [0038.314] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4320) returned 0x0 [0038.314] LocalFree (hMem=0x1a7d4320) returned 0x0 [0038.314] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0038.314] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0038.314] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0038.314] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0038.314] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0038.314] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.314] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.314] GetSystemMetrics (nIndex=42) returned 0 [0038.314] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.314] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.314] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0038.314] IsAppThemed () returned 0x1 [0038.314] GetThemeAppProperties () returned 0x3 [0038.314] GetThemeAppProperties () returned 0x3 [0038.314] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0038.314] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0038.314] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0038.314] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0038.314] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0038.314] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4320 [0038.314] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4320) returned 0x0 [0038.314] LocalFree (hMem=0x1a7d4320) returned 0x0 [0038.314] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0038.314] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4320 [0038.314] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4320) returned 0x0 [0038.315] LocalFree (hMem=0x1a7d4320) returned 0x0 [0038.315] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0038.315] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0038.315] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0038.315] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0038.315] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0038.315] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0038.315] GetCurrentObject (hdc=0x260109d2, type=0x1) returned 0x1b00017 [0038.315] GetCurrentObject (hdc=0x260109d2, type=0x2) returned 0x1900010 [0038.315] GetCurrentObject (hdc=0x260109d2, type=0x7) returned 0x190509d7 [0038.315] GetCurrentObject (hdc=0x260109d2, type=0x6) returned 0x18a002e [0038.315] SaveDC (hdc=0x260109d2) returned 1 [0038.315] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4b0409ff [0038.315] GetClipRgn (hdc=0x260109d2, hrgn=0x4b0409ff) returned 0 [0038.315] SelectClipRgn (hdc=0x260109d2, hrgn=0x260409f1) returned 2 [0038.315] DeleteObject (ho=0x4b0409ff) returned 1 [0038.315] DeleteObject (ho=0x260409f1) returned 1 [0038.315] OffsetViewportOrgEx (in: hdc=0x260109d2, x=0, y=0, lppt=0x276aaf0 | out: lppt=0x276aaf0) returned 1 [0038.315] OffsetViewportOrgEx (in: hdc=0x260109d2, x=-417, y=-278, lppt=0x276ab08 | out: lppt=0x276ab08) returned 1 [0038.315] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0038.315] GetCurrentObject (hdc=0x260109d2, type=0x1) returned 0x1b00017 [0038.315] GetCurrentObject (hdc=0x260109d2, type=0x2) returned 0x1900010 [0038.315] GetCurrentObject (hdc=0x260109d2, type=0x7) returned 0x190509d7 [0038.315] GetCurrentObject (hdc=0x260109d2, type=0x6) returned 0x18a002e [0038.315] SaveDC (hdc=0x260109d2) returned 2 [0038.315] GetNearestColor (hdc=0x260109d2, color=0x6c4607) returned 0x6c4607 [0038.315] CreateSolidBrush (color=0x6c4607) returned 0x4b100276 [0038.316] FillRect (hDC=0x260109d2, lprc=0x26de08, hbr=0x4b100276) returned 1 [0038.319] DeleteObject (ho=0x4b100276) returned 1 [0038.319] RestoreDC (hdc=0x260109d2, nSavedDC=-1) returned 1 [0038.319] RestoreDC (hdc=0x260109d2, nSavedDC=-1) returned 1 [0038.319] GdipReleaseDC (graphics=0x1b86d040, hdc=0x260109d2) returned 0x0 [0038.319] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffda00dbd) returned 0x0 [0038.319] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0038.319] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.319] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.319] GetSystemMetrics (nIndex=42) returned 0 [0038.319] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.319] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.319] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0038.319] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0038.319] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0038.319] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0038.320] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0038.320] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0038.320] GetCurrentObject (hdc=0x260109d2, type=0x1) returned 0x1b00017 [0038.320] GetCurrentObject (hdc=0x260109d2, type=0x2) returned 0x1900010 [0038.320] GetCurrentObject (hdc=0x260109d2, type=0x7) returned 0x190509d7 [0038.320] GetCurrentObject (hdc=0x260109d2, type=0x6) returned 0x18a002e [0038.320] SaveDC (hdc=0x260109d2) returned 1 [0038.320] GetNearestColor (hdc=0x260109d2, color=0xf0f0f0) returned 0xf0f0f0 [0038.320] RestoreDC (hdc=0x260109d2, nSavedDC=-1) returned 1 [0038.320] GdipReleaseDC (graphics=0x1b86d040, hdc=0x260109d2) returned 0x0 [0038.320] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0038.320] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0038.320] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0038.320] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0038.320] GetCurrentObject (hdc=0x260109d2, type=0x1) returned 0x1b00017 [0038.320] GetCurrentObject (hdc=0x260109d2, type=0x2) returned 0x1900010 [0038.320] GetCurrentObject (hdc=0x260109d2, type=0x7) returned 0x190509d7 [0038.320] GetCurrentObject (hdc=0x260109d2, type=0x6) returned 0x18a002e [0038.320] SaveDC (hdc=0x260109d2) returned 1 [0038.320] GetTextAlign (hdc=0x260109d2) returned 0x0 [0038.320] GetTextColor (hdc=0x260109d2) returned 0x0 [0038.320] SetTextColor (hdc=0x260109d2, color=0xf0f0f0) returned 0x0 [0038.321] GetCurrentObject (hdc=0x260109d2, type=0x6) returned 0x18a002e [0038.321] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0038.321] SelectObject (hdc=0x260109d2, h=0x260a09ba) returned 0x18a002e [0038.321] GetBkMode (hdc=0x260109d2) returned 2 [0038.321] SetBkMode (hdc=0x260109d2, mode=1) returned 2 [0038.321] DrawTextExW (in: hdc=0x260109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x276b7b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0038.321] DrawTextExW (in: hdc=0x260109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x276b7b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0038.321] RestoreDC (hdc=0x260109d2, nSavedDC=-1) returned 1 [0038.321] GdipReleaseDC (graphics=0x1b86d040, hdc=0x260109d2) returned 0x0 [0038.321] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0038.321] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x260109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0038.322] GdipReleaseDC (graphics=0x1b86d040, hdc=0x260109d2) returned 0x0 [0038.322] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0038.322] SelectObject (hdc=0x260109d2, h=0x185000f) returned 0x190509d7 [0038.322] DeleteDC (hdc=0x260109d2) returned 1 [0038.322] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0038.322] DeleteObject (ho=0x190509d7) returned 1 [0038.325] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0038.325] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.325] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.325] WaitMessage () returned 1 [0038.624] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.624] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.624] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.624] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.624] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.624] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0038.624] GetCurrentThreadId () returned 0xa28 [0038.624] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0038.624] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.624] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.624] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.624] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.624] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.624] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0038.625] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0038.625] CreateCompatibleDC (hdc=0x60109d6) returned 0x580109c0 [0038.625] GetObjectType (h=0x60109d6) returned 0x3 [0038.625] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x1a0509d7 [0038.625] GetDIBits (in: hdc=0x60109d6, hbm=0x1a0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.625] GetDIBits (in: hdc=0x60109d6, hbm=0x1a0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.625] DeleteObject (ho=0x1a0509d7) returned 1 [0038.625] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x270509d2 [0038.625] SelectObject (hdc=0x580109c0, h=0x270509d2) returned 0x185000f [0038.625] GdipCreateFromHDC (hdc=0x580109c0, graphics=0x26e408) returned 0x0 [0038.626] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0038.626] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0038.626] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0038.626] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0038.626] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0038.626] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4320 [0038.626] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4320) returned 0x0 [0038.626] LocalFree (hMem=0x1a7d4320) returned 0x0 [0038.626] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0038.626] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0038.626] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0038.626] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0038.626] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0038.626] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.626] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.626] GetSystemMetrics (nIndex=42) returned 0 [0038.626] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.626] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.626] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0038.626] IsAppThemed () returned 0x1 [0038.626] GetThemeAppProperties () returned 0x3 [0038.626] GetThemeAppProperties () returned 0x3 [0038.626] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0038.626] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0038.626] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0038.626] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0038.626] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0038.626] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4320 [0038.626] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4320) returned 0x0 [0038.627] LocalFree (hMem=0x1a7d4320) returned 0x0 [0038.627] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0038.627] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4320 [0038.627] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4320) returned 0x0 [0038.627] LocalFree (hMem=0x1a7d4320) returned 0x0 [0038.627] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0038.627] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0038.627] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0038.627] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0038.627] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0038.627] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0038.627] GetCurrentObject (hdc=0x580109c0, type=0x1) returned 0x1b00017 [0038.627] GetCurrentObject (hdc=0x580109c0, type=0x2) returned 0x1900010 [0038.627] GetCurrentObject (hdc=0x580109c0, type=0x7) returned 0x270509d2 [0038.627] GetCurrentObject (hdc=0x580109c0, type=0x6) returned 0x18a002e [0038.627] SaveDC (hdc=0x580109c0) returned 1 [0038.627] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x270409f1 [0038.627] GetClipRgn (hdc=0x580109c0, hrgn=0x270409f1) returned 0 [0038.627] SelectClipRgn (hdc=0x580109c0, hrgn=0x4e0409ff) returned 2 [0038.627] DeleteObject (ho=0x270409f1) returned 1 [0038.627] DeleteObject (ho=0x4e0409ff) returned 1 [0038.627] OffsetViewportOrgEx (in: hdc=0x580109c0, x=0, y=0, lppt=0x276d398 | out: lppt=0x276d398) returned 1 [0038.627] OffsetViewportOrgEx (in: hdc=0x580109c0, x=-417, y=-278, lppt=0x276d3b0 | out: lppt=0x276d3b0) returned 1 [0038.627] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0038.627] GetCurrentObject (hdc=0x580109c0, type=0x1) returned 0x1b00017 [0038.627] GetCurrentObject (hdc=0x580109c0, type=0x2) returned 0x1900010 [0038.627] GetCurrentObject (hdc=0x580109c0, type=0x7) returned 0x270509d2 [0038.628] GetCurrentObject (hdc=0x580109c0, type=0x6) returned 0x18a002e [0038.628] SaveDC (hdc=0x580109c0) returned 2 [0038.628] GetNearestColor (hdc=0x580109c0, color=0x6c4607) returned 0x6c4607 [0038.628] CreateSolidBrush (color=0x6c4607) returned 0x4c100276 [0038.628] FillRect (hDC=0x580109c0, lprc=0x26de08, hbr=0x4c100276) returned 1 [0038.634] DeleteObject (ho=0x4c100276) returned 1 [0038.634] RestoreDC (hdc=0x580109c0, nSavedDC=-1) returned 1 [0038.634] RestoreDC (hdc=0x580109c0, nSavedDC=-1) returned 1 [0038.634] GdipReleaseDC (graphics=0x1b86d040, hdc=0x580109c0) returned 0x0 [0038.634] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd9e0dbd) returned 0x0 [0038.634] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0038.634] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.634] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.634] GetSystemMetrics (nIndex=42) returned 0 [0038.634] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.634] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.634] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xe) returned 0x0 [0038.636] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0038.636] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0038.636] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0038.636] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0038.636] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0038.636] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0038.636] GetCurrentObject (hdc=0x580109c0, type=0x1) returned 0x1b00017 [0038.636] GetCurrentObject (hdc=0x580109c0, type=0x2) returned 0x1900010 [0038.636] GetCurrentObject (hdc=0x580109c0, type=0x7) returned 0x270509d2 [0038.636] GetCurrentObject (hdc=0x580109c0, type=0x6) returned 0x18a002e [0038.636] SaveDC (hdc=0x580109c0) returned 1 [0038.636] GetNearestColor (hdc=0x580109c0, color=0xf0f0f0) returned 0xf0f0f0 [0038.636] RestoreDC (hdc=0x580109c0, nSavedDC=-1) returned 1 [0038.636] GdipReleaseDC (graphics=0x1b86d040, hdc=0x580109c0) returned 0x0 [0038.636] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0038.636] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0038.636] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0038.636] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0038.637] GetCurrentObject (hdc=0x580109c0, type=0x1) returned 0x1b00017 [0038.637] GetCurrentObject (hdc=0x580109c0, type=0x2) returned 0x1900010 [0038.637] GetCurrentObject (hdc=0x580109c0, type=0x7) returned 0x270509d2 [0038.637] GetCurrentObject (hdc=0x580109c0, type=0x6) returned 0x18a002e [0038.637] SaveDC (hdc=0x580109c0) returned 1 [0038.637] GetTextAlign (hdc=0x580109c0) returned 0x0 [0038.637] GetTextColor (hdc=0x580109c0) returned 0x0 [0038.637] SetTextColor (hdc=0x580109c0, color=0xf0f0f0) returned 0x0 [0038.637] GetCurrentObject (hdc=0x580109c0, type=0x6) returned 0x18a002e [0038.637] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0038.637] SelectObject (hdc=0x580109c0, h=0x260a09ba) returned 0x18a002e [0038.637] GetBkMode (hdc=0x580109c0) returned 2 [0038.637] SetBkMode (hdc=0x580109c0, mode=1) returned 2 [0038.637] DrawTextExW (in: hdc=0x580109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x276e2b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0038.637] DrawTextExW (in: hdc=0x580109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x276e2b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0038.638] RestoreDC (hdc=0x580109c0, nSavedDC=-1) returned 1 [0038.638] GdipReleaseDC (graphics=0x1b86d040, hdc=0x580109c0) returned 0x0 [0038.638] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0038.638] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x580109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0038.638] GdipReleaseDC (graphics=0x1b86d040, hdc=0x580109c0) returned 0x0 [0038.638] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0038.638] SelectObject (hdc=0x580109c0, h=0x185000f) returned 0x270509d2 [0038.638] DeleteDC (hdc=0x580109c0) returned 1 [0038.638] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0038.638] DeleteObject (ho=0x270509d2) returned 1 [0038.642] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0038.642] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.642] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.642] WaitMessage () returned 1 [0038.772] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.772] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.772] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.772] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.772] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.773] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0038.773] GetCurrentThreadId () returned 0xa28 [0038.773] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0038.773] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.773] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.773] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.773] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.773] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.773] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0038.773] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0038.773] CreateCompatibleDC (hdc=0x60109d6) returned 0x1c0109d7 [0038.773] GetObjectType (h=0x60109d6) returned 0x3 [0038.773] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x280509d2 [0038.773] GetDIBits (in: hdc=0x60109d6, hbm=0x280509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.773] GetDIBits (in: hdc=0x60109d6, hbm=0x280509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.773] DeleteObject (ho=0x280509d2) returned 1 [0038.773] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x590509c0 [0038.773] SelectObject (hdc=0x1c0109d7, h=0x590509c0) returned 0x185000f [0038.773] GdipCreateFromHDC (hdc=0x1c0109d7, graphics=0x26e408) returned 0x0 [0038.774] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0038.774] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0038.774] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0038.774] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0038.774] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0038.774] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d43a0 [0038.774] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d43a0) returned 0x0 [0038.774] LocalFree (hMem=0x1a7d43a0) returned 0x0 [0038.774] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0038.774] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0038.774] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0038.774] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0038.774] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0038.774] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.774] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.774] GetSystemMetrics (nIndex=42) returned 0 [0038.774] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.774] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.774] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0038.774] IsAppThemed () returned 0x1 [0038.775] GetThemeAppProperties () returned 0x3 [0038.775] GetThemeAppProperties () returned 0x3 [0038.775] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0038.775] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0038.775] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0038.775] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0038.775] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0038.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d43a0 [0038.775] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d43a0) returned 0x0 [0038.775] LocalFree (hMem=0x1a7d43a0) returned 0x0 [0038.775] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0038.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d43a0 [0038.775] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d43a0) returned 0x0 [0038.775] LocalFree (hMem=0x1a7d43a0) returned 0x0 [0038.775] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0038.775] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0038.775] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0038.775] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0038.775] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0038.775] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0038.775] GetCurrentObject (hdc=0x1c0109d7, type=0x1) returned 0x1b00017 [0038.775] GetCurrentObject (hdc=0x1c0109d7, type=0x2) returned 0x1900010 [0038.775] GetCurrentObject (hdc=0x1c0109d7, type=0x7) returned 0x590509c0 [0038.775] GetCurrentObject (hdc=0x1c0109d7, type=0x6) returned 0x18a002e [0038.775] SaveDC (hdc=0x1c0109d7) returned 1 [0038.775] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4f0409ff [0038.775] GetClipRgn (hdc=0x1c0109d7, hrgn=0x4f0409ff) returned 0 [0038.775] SelectClipRgn (hdc=0x1c0109d7, hrgn=0x2a0409f1) returned 2 [0038.776] DeleteObject (ho=0x4f0409ff) returned 1 [0038.776] DeleteObject (ho=0x2a0409f1) returned 1 [0038.776] OffsetViewportOrgEx (in: hdc=0x1c0109d7, x=0, y=0, lppt=0x276fe98 | out: lppt=0x276fe98) returned 1 [0038.776] OffsetViewportOrgEx (in: hdc=0x1c0109d7, x=-417, y=-278, lppt=0x276feb0 | out: lppt=0x276feb0) returned 1 [0038.776] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0038.776] GetCurrentObject (hdc=0x1c0109d7, type=0x1) returned 0x1b00017 [0038.776] GetCurrentObject (hdc=0x1c0109d7, type=0x2) returned 0x1900010 [0038.776] GetCurrentObject (hdc=0x1c0109d7, type=0x7) returned 0x590509c0 [0038.776] GetCurrentObject (hdc=0x1c0109d7, type=0x6) returned 0x18a002e [0038.776] SaveDC (hdc=0x1c0109d7) returned 2 [0038.776] GetNearestColor (hdc=0x1c0109d7, color=0x6c4607) returned 0x6c4607 [0038.776] CreateSolidBrush (color=0x6c4607) returned 0x4d100276 [0038.776] FillRect (hDC=0x1c0109d7, lprc=0x26de08, hbr=0x4d100276) returned 1 [0038.782] DeleteObject (ho=0x4d100276) returned 1 [0038.782] RestoreDC (hdc=0x1c0109d7, nSavedDC=-1) returned 1 [0038.782] RestoreDC (hdc=0x1c0109d7, nSavedDC=-1) returned 1 [0038.782] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109d7) returned 0x0 [0038.782] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd9c0dbd) returned 0x0 [0038.782] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0038.782] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.782] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.783] GetSystemMetrics (nIndex=42) returned 0 [0038.783] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.783] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.783] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0038.783] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0038.783] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0038.783] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0038.783] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0038.783] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0038.783] GetCurrentObject (hdc=0x1c0109d7, type=0x1) returned 0x1b00017 [0038.783] GetCurrentObject (hdc=0x1c0109d7, type=0x2) returned 0x1900010 [0038.783] GetCurrentObject (hdc=0x1c0109d7, type=0x7) returned 0x590509c0 [0038.783] GetCurrentObject (hdc=0x1c0109d7, type=0x6) returned 0x18a002e [0038.783] SaveDC (hdc=0x1c0109d7) returned 1 [0038.783] GetNearestColor (hdc=0x1c0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0038.783] RestoreDC (hdc=0x1c0109d7, nSavedDC=-1) returned 1 [0038.783] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109d7) returned 0x0 [0038.783] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0038.784] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0038.784] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0038.784] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0038.784] GetCurrentObject (hdc=0x1c0109d7, type=0x1) returned 0x1b00017 [0038.784] GetCurrentObject (hdc=0x1c0109d7, type=0x2) returned 0x1900010 [0038.784] GetCurrentObject (hdc=0x1c0109d7, type=0x7) returned 0x590509c0 [0038.784] GetCurrentObject (hdc=0x1c0109d7, type=0x6) returned 0x18a002e [0038.784] SaveDC (hdc=0x1c0109d7) returned 1 [0038.784] GetTextAlign (hdc=0x1c0109d7) returned 0x0 [0038.784] GetTextColor (hdc=0x1c0109d7) returned 0x0 [0038.784] SetTextColor (hdc=0x1c0109d7, color=0xf0f0f0) returned 0x0 [0038.784] GetCurrentObject (hdc=0x1c0109d7, type=0x6) returned 0x18a002e [0038.784] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0038.784] SelectObject (hdc=0x1c0109d7, h=0x260a09ba) returned 0x18a002e [0038.784] GetBkMode (hdc=0x1c0109d7) returned 2 [0038.784] SetBkMode (hdc=0x1c0109d7, mode=1) returned 2 [0038.784] DrawTextExW (in: hdc=0x1c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2770b60 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0038.784] DrawTextExW (in: hdc=0x1c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2770b60 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0038.785] RestoreDC (hdc=0x1c0109d7, nSavedDC=-1) returned 1 [0038.785] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109d7) returned 0x0 [0038.785] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0038.785] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x1c0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0038.785] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109d7) returned 0x0 [0038.785] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0038.785] SelectObject (hdc=0x1c0109d7, h=0x185000f) returned 0x590509c0 [0038.785] DeleteDC (hdc=0x1c0109d7) returned 1 [0038.785] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0038.785] DeleteObject (ho=0x590509c0) returned 1 [0038.788] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0038.789] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.789] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.789] WaitMessage () returned 1 [0038.905] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.905] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.905] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.905] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.905] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.905] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0038.905] GetCurrentThreadId () returned 0xa28 [0038.905] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0038.905] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.905] IsWindowUnicode (hWnd=0x3015e) returned 1 [0038.905] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0038.905] TranslateMessage (lpMsg=0x26ee10) returned 0 [0038.905] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0038.905] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0038.905] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0038.905] CreateCompatibleDC (hdc=0x60109d6) returned 0x2a0109d2 [0038.905] GetObjectType (h=0x60109d6) returned 0x3 [0038.905] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x5a0509c0 [0038.905] GetDIBits (in: hdc=0x60109d6, hbm=0x5a0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.905] GetDIBits (in: hdc=0x60109d6, hbm=0x5a0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0038.906] DeleteObject (ho=0x5a0509c0) returned 1 [0038.906] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x1d0509d7 [0038.906] SelectObject (hdc=0x2a0109d2, h=0x1d0509d7) returned 0x185000f [0038.906] GdipCreateFromHDC (hdc=0x2a0109d2, graphics=0x26e408) returned 0x0 [0038.906] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0038.906] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0038.906] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0038.906] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0038.906] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0038.906] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d43a0 [0038.906] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d43a0) returned 0x0 [0038.906] LocalFree (hMem=0x1a7d43a0) returned 0x0 [0038.906] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0038.907] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0038.907] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0038.907] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0038.907] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0038.907] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.907] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.907] GetSystemMetrics (nIndex=42) returned 0 [0038.907] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.907] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.907] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0038.907] IsAppThemed () returned 0x1 [0038.907] GetThemeAppProperties () returned 0x3 [0038.907] GetThemeAppProperties () returned 0x3 [0038.907] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0038.907] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0038.907] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0038.907] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0038.907] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0038.908] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d43a0 [0038.908] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d43a0) returned 0x0 [0038.908] LocalFree (hMem=0x1a7d43a0) returned 0x0 [0038.908] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0038.908] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d43a0 [0038.908] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d43a0) returned 0x0 [0038.908] LocalFree (hMem=0x1a7d43a0) returned 0x0 [0038.908] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0038.908] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0038.908] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0038.908] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0038.908] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0038.908] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0038.908] GetCurrentObject (hdc=0x2a0109d2, type=0x1) returned 0x1b00017 [0038.908] GetCurrentObject (hdc=0x2a0109d2, type=0x2) returned 0x1900010 [0038.908] GetCurrentObject (hdc=0x2a0109d2, type=0x7) returned 0x1d0509d7 [0038.908] GetCurrentObject (hdc=0x2a0109d2, type=0x6) returned 0x18a002e [0038.908] SaveDC (hdc=0x2a0109d2) returned 1 [0038.908] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2b0409f1 [0038.908] GetClipRgn (hdc=0x2a0109d2, hrgn=0x2b0409f1) returned 0 [0038.908] SelectClipRgn (hdc=0x2a0109d2, hrgn=0x520409ff) returned 2 [0038.909] DeleteObject (ho=0x2b0409f1) returned 1 [0038.909] DeleteObject (ho=0x520409ff) returned 1 [0038.909] OffsetViewportOrgEx (in: hdc=0x2a0109d2, x=0, y=0, lppt=0x2772740 | out: lppt=0x2772740) returned 1 [0038.909] OffsetViewportOrgEx (in: hdc=0x2a0109d2, x=-417, y=-278, lppt=0x2772758 | out: lppt=0x2772758) returned 1 [0038.909] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0038.909] GetCurrentObject (hdc=0x2a0109d2, type=0x1) returned 0x1b00017 [0038.909] GetCurrentObject (hdc=0x2a0109d2, type=0x2) returned 0x1900010 [0038.909] GetCurrentObject (hdc=0x2a0109d2, type=0x7) returned 0x1d0509d7 [0038.909] GetCurrentObject (hdc=0x2a0109d2, type=0x6) returned 0x18a002e [0038.909] SaveDC (hdc=0x2a0109d2) returned 2 [0038.909] GetNearestColor (hdc=0x2a0109d2, color=0x6c4607) returned 0x6c4607 [0038.909] CreateSolidBrush (color=0x6c4607) returned 0x4e100276 [0038.909] FillRect (hDC=0x2a0109d2, lprc=0x26de08, hbr=0x4e100276) returned 1 [0038.915] DeleteObject (ho=0x4e100276) returned 1 [0038.915] RestoreDC (hdc=0x2a0109d2, nSavedDC=-1) returned 1 [0038.915] RestoreDC (hdc=0x2a0109d2, nSavedDC=-1) returned 1 [0038.915] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2a0109d2) returned 0x0 [0038.915] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd9a0dbd) returned 0x0 [0038.915] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0038.915] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0038.915] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0038.915] GetSystemMetrics (nIndex=42) returned 0 [0038.915] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0038.915] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0038.915] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x10) returned 0x0 [0038.916] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0038.916] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0038.916] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0038.916] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0038.916] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0038.916] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0038.916] GetCurrentObject (hdc=0x2a0109d2, type=0x1) returned 0x1b00017 [0038.916] GetCurrentObject (hdc=0x2a0109d2, type=0x2) returned 0x1900010 [0038.916] GetCurrentObject (hdc=0x2a0109d2, type=0x7) returned 0x1d0509d7 [0038.916] GetCurrentObject (hdc=0x2a0109d2, type=0x6) returned 0x18a002e [0038.916] SaveDC (hdc=0x2a0109d2) returned 1 [0038.917] GetNearestColor (hdc=0x2a0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0038.917] RestoreDC (hdc=0x2a0109d2, nSavedDC=-1) returned 1 [0038.917] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2a0109d2) returned 0x0 [0038.917] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0038.917] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0038.917] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0038.917] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0038.917] GetCurrentObject (hdc=0x2a0109d2, type=0x1) returned 0x1b00017 [0038.917] GetCurrentObject (hdc=0x2a0109d2, type=0x2) returned 0x1900010 [0038.917] GetCurrentObject (hdc=0x2a0109d2, type=0x7) returned 0x1d0509d7 [0038.917] GetCurrentObject (hdc=0x2a0109d2, type=0x6) returned 0x18a002e [0038.917] SaveDC (hdc=0x2a0109d2) returned 1 [0038.917] GetTextAlign (hdc=0x2a0109d2) returned 0x0 [0038.917] GetTextColor (hdc=0x2a0109d2) returned 0x0 [0038.917] SetTextColor (hdc=0x2a0109d2, color=0xf0f0f0) returned 0x0 [0038.917] GetCurrentObject (hdc=0x2a0109d2, type=0x6) returned 0x18a002e [0038.917] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0038.917] SelectObject (hdc=0x2a0109d2, h=0x260a09ba) returned 0x18a002e [0038.917] GetBkMode (hdc=0x2a0109d2) returned 2 [0038.917] SetBkMode (hdc=0x2a0109d2, mode=1) returned 2 [0038.917] DrawTextExW (in: hdc=0x2a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2773658 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0038.918] DrawTextExW (in: hdc=0x2a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2773658 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0038.918] RestoreDC (hdc=0x2a0109d2, nSavedDC=-1) returned 1 [0038.918] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2a0109d2) returned 0x0 [0038.918] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0038.918] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x2a0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0038.918] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2a0109d2) returned 0x0 [0038.918] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0038.919] SelectObject (hdc=0x2a0109d2, h=0x185000f) returned 0x1d0509d7 [0038.919] DeleteDC (hdc=0x2a0109d2) returned 1 [0038.919] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0038.919] DeleteObject (ho=0x1d0509d7) returned 1 [0038.922] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0038.922] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.922] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0038.922] WaitMessage () returned 1 [0039.045] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.045] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.045] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.045] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.045] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.045] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0039.045] GetCurrentThreadId () returned 0xa28 [0039.045] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0039.045] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.045] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.045] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.045] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.045] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.045] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0039.046] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0039.046] CreateCompatibleDC (hdc=0x60109d6) returned 0x5c0109c0 [0039.046] GetObjectType (h=0x60109d6) returned 0x3 [0039.046] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x1e0509d7 [0039.046] GetDIBits (in: hdc=0x60109d6, hbm=0x1e0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.046] GetDIBits (in: hdc=0x60109d6, hbm=0x1e0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.046] DeleteObject (ho=0x1e0509d7) returned 1 [0039.046] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x2b0509d2 [0039.046] SelectObject (hdc=0x5c0109c0, h=0x2b0509d2) returned 0x185000f [0039.046] GdipCreateFromHDC (hdc=0x5c0109c0, graphics=0x26e408) returned 0x0 [0039.047] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0039.047] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0039.047] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0039.047] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0039.047] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0039.047] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4420 [0039.047] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4420) returned 0x0 [0039.047] LocalFree (hMem=0x1a7d4420) returned 0x0 [0039.047] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0039.047] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0039.047] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0039.047] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0039.047] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0039.047] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.047] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.047] GetSystemMetrics (nIndex=42) returned 0 [0039.047] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.047] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.047] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0039.047] IsAppThemed () returned 0x1 [0039.047] GetThemeAppProperties () returned 0x3 [0039.047] GetThemeAppProperties () returned 0x3 [0039.047] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0039.048] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0039.048] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0039.048] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0039.048] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0039.048] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4420 [0039.048] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4420) returned 0x0 [0039.048] LocalFree (hMem=0x1a7d4420) returned 0x0 [0039.048] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0039.048] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4420 [0039.048] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4420) returned 0x0 [0039.048] LocalFree (hMem=0x1a7d4420) returned 0x0 [0039.048] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0039.048] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0039.048] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0039.048] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0039.048] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0039.048] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0039.048] GetCurrentObject (hdc=0x5c0109c0, type=0x1) returned 0x1b00017 [0039.048] GetCurrentObject (hdc=0x5c0109c0, type=0x2) returned 0x1900010 [0039.048] GetCurrentObject (hdc=0x5c0109c0, type=0x7) returned 0x2b0509d2 [0039.048] GetCurrentObject (hdc=0x5c0109c0, type=0x6) returned 0x18a002e [0039.048] SaveDC (hdc=0x5c0109c0) returned 1 [0039.048] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x530409ff [0039.048] GetClipRgn (hdc=0x5c0109c0, hrgn=0x530409ff) returned 0 [0039.048] SelectClipRgn (hdc=0x5c0109c0, hrgn=0x2e0409f1) returned 2 [0039.048] DeleteObject (ho=0x530409ff) returned 1 [0039.048] DeleteObject (ho=0x2e0409f1) returned 1 [0039.049] OffsetViewportOrgEx (in: hdc=0x5c0109c0, x=0, y=0, lppt=0x2775238 | out: lppt=0x2775238) returned 1 [0039.049] OffsetViewportOrgEx (in: hdc=0x5c0109c0, x=-417, y=-278, lppt=0x2775250 | out: lppt=0x2775250) returned 1 [0039.049] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0039.049] GetCurrentObject (hdc=0x5c0109c0, type=0x1) returned 0x1b00017 [0039.049] GetCurrentObject (hdc=0x5c0109c0, type=0x2) returned 0x1900010 [0039.049] GetCurrentObject (hdc=0x5c0109c0, type=0x7) returned 0x2b0509d2 [0039.049] GetCurrentObject (hdc=0x5c0109c0, type=0x6) returned 0x18a002e [0039.049] SaveDC (hdc=0x5c0109c0) returned 2 [0039.049] GetNearestColor (hdc=0x5c0109c0, color=0x6c4607) returned 0x6c4607 [0039.049] CreateSolidBrush (color=0x6c4607) returned 0x4f100276 [0039.049] FillRect (hDC=0x5c0109c0, lprc=0x26de08, hbr=0x4f100276) returned 1 [0039.055] DeleteObject (ho=0x4f100276) returned 1 [0039.056] RestoreDC (hdc=0x5c0109c0, nSavedDC=-1) returned 1 [0039.056] RestoreDC (hdc=0x5c0109c0, nSavedDC=-1) returned 1 [0039.056] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5c0109c0) returned 0x0 [0039.056] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd980dbd) returned 0x0 [0039.056] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0039.056] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.056] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.056] GetSystemMetrics (nIndex=42) returned 0 [0039.056] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.056] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.056] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0039.056] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0039.056] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0039.056] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0039.056] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0039.056] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0039.056] GetCurrentObject (hdc=0x5c0109c0, type=0x1) returned 0x1b00017 [0039.056] GetCurrentObject (hdc=0x5c0109c0, type=0x2) returned 0x1900010 [0039.056] GetCurrentObject (hdc=0x5c0109c0, type=0x7) returned 0x2b0509d2 [0039.056] GetCurrentObject (hdc=0x5c0109c0, type=0x6) returned 0x18a002e [0039.056] SaveDC (hdc=0x5c0109c0) returned 1 [0039.056] GetNearestColor (hdc=0x5c0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0039.056] RestoreDC (hdc=0x5c0109c0, nSavedDC=-1) returned 1 [0039.056] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5c0109c0) returned 0x0 [0039.057] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0039.057] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0039.057] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0039.057] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0039.057] GetCurrentObject (hdc=0x5c0109c0, type=0x1) returned 0x1b00017 [0039.057] GetCurrentObject (hdc=0x5c0109c0, type=0x2) returned 0x1900010 [0039.057] GetCurrentObject (hdc=0x5c0109c0, type=0x7) returned 0x2b0509d2 [0039.057] GetCurrentObject (hdc=0x5c0109c0, type=0x6) returned 0x18a002e [0039.057] SaveDC (hdc=0x5c0109c0) returned 1 [0039.057] GetTextAlign (hdc=0x5c0109c0) returned 0x0 [0039.057] GetTextColor (hdc=0x5c0109c0) returned 0x0 [0039.057] SetTextColor (hdc=0x5c0109c0, color=0xf0f0f0) returned 0x0 [0039.057] GetCurrentObject (hdc=0x5c0109c0, type=0x6) returned 0x18a002e [0039.057] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0039.057] SelectObject (hdc=0x5c0109c0, h=0x260a09ba) returned 0x18a002e [0039.057] GetBkMode (hdc=0x5c0109c0) returned 2 [0039.057] SetBkMode (hdc=0x5c0109c0, mode=1) returned 2 [0039.057] DrawTextExW (in: hdc=0x5c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2775f00 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0039.058] DrawTextExW (in: hdc=0x5c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2775f00 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0039.058] RestoreDC (hdc=0x5c0109c0, nSavedDC=-1) returned 1 [0039.058] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5c0109c0) returned 0x0 [0039.058] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0039.058] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x5c0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0039.059] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5c0109c0) returned 0x0 [0039.059] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0039.059] SelectObject (hdc=0x5c0109c0, h=0x185000f) returned 0x2b0509d2 [0039.059] DeleteDC (hdc=0x5c0109c0) returned 1 [0039.059] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0039.059] DeleteObject (ho=0x2b0509d2) returned 1 [0039.062] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0039.063] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.063] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.063] WaitMessage () returned 1 [0039.188] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.188] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.188] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.188] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.188] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.188] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0039.188] GetCurrentThreadId () returned 0xa28 [0039.188] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0039.188] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.188] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.188] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.188] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.188] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.188] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0039.188] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0039.188] CreateCompatibleDC (hdc=0x60109d6) returned 0x200109d7 [0039.188] GetObjectType (h=0x60109d6) returned 0x3 [0039.188] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x2c0509d2 [0039.188] GetDIBits (in: hdc=0x60109d6, hbm=0x2c0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.189] GetDIBits (in: hdc=0x60109d6, hbm=0x2c0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.189] DeleteObject (ho=0x2c0509d2) returned 1 [0039.189] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x5d0509c0 [0039.189] SelectObject (hdc=0x200109d7, h=0x5d0509c0) returned 0x185000f [0039.189] GdipCreateFromHDC (hdc=0x200109d7, graphics=0x26e408) returned 0x0 [0039.189] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0039.189] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0039.189] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0039.189] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0039.189] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0039.189] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4420 [0039.189] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4420) returned 0x0 [0039.189] LocalFree (hMem=0x1a7d4420) returned 0x0 [0039.189] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0039.189] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0039.189] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0039.189] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0039.189] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0039.190] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.190] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.190] GetSystemMetrics (nIndex=42) returned 0 [0039.190] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.190] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.190] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0039.190] IsAppThemed () returned 0x1 [0039.190] GetThemeAppProperties () returned 0x3 [0039.190] GetThemeAppProperties () returned 0x3 [0039.190] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0039.190] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0039.190] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0039.190] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0039.190] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0039.190] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4420 [0039.190] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4420) returned 0x0 [0039.190] LocalFree (hMem=0x1a7d4420) returned 0x0 [0039.190] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0039.190] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4420 [0039.190] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4420) returned 0x0 [0039.190] LocalFree (hMem=0x1a7d4420) returned 0x0 [0039.190] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0039.190] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0039.190] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0039.190] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0039.190] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0039.190] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0039.190] GetCurrentObject (hdc=0x200109d7, type=0x1) returned 0x1b00017 [0039.190] GetCurrentObject (hdc=0x200109d7, type=0x2) returned 0x1900010 [0039.191] GetCurrentObject (hdc=0x200109d7, type=0x7) returned 0x5d0509c0 [0039.191] GetCurrentObject (hdc=0x200109d7, type=0x6) returned 0x18a002e [0039.191] SaveDC (hdc=0x200109d7) returned 1 [0039.191] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2f0409f1 [0039.191] GetClipRgn (hdc=0x200109d7, hrgn=0x2f0409f1) returned 0 [0039.191] SelectClipRgn (hdc=0x200109d7, hrgn=0x560409ff) returned 2 [0039.191] DeleteObject (ho=0x2f0409f1) returned 1 [0039.191] DeleteObject (ho=0x560409ff) returned 1 [0039.191] OffsetViewportOrgEx (in: hdc=0x200109d7, x=0, y=0, lppt=0x2777ae0 | out: lppt=0x2777ae0) returned 1 [0039.191] OffsetViewportOrgEx (in: hdc=0x200109d7, x=-417, y=-278, lppt=0x2777af8 | out: lppt=0x2777af8) returned 1 [0039.191] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0039.191] GetCurrentObject (hdc=0x200109d7, type=0x1) returned 0x1b00017 [0039.191] GetCurrentObject (hdc=0x200109d7, type=0x2) returned 0x1900010 [0039.191] GetCurrentObject (hdc=0x200109d7, type=0x7) returned 0x5d0509c0 [0039.191] GetCurrentObject (hdc=0x200109d7, type=0x6) returned 0x18a002e [0039.191] SaveDC (hdc=0x200109d7) returned 2 [0039.191] GetNearestColor (hdc=0x200109d7, color=0x6c4607) returned 0x6c4607 [0039.191] CreateSolidBrush (color=0x6c4607) returned 0x50100276 [0039.191] FillRect (hDC=0x200109d7, lprc=0x26de08, hbr=0x50100276) returned 1 [0039.195] DeleteObject (ho=0x50100276) returned 1 [0039.195] RestoreDC (hdc=0x200109d7, nSavedDC=-1) returned 1 [0039.195] RestoreDC (hdc=0x200109d7, nSavedDC=-1) returned 1 [0039.195] GdipReleaseDC (graphics=0x1b86d040, hdc=0x200109d7) returned 0x0 [0039.195] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd960dbd) returned 0x0 [0039.195] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0039.195] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.195] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.196] GetSystemMetrics (nIndex=42) returned 0 [0039.196] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.196] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.196] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x12) returned 0x0 [0039.197] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0039.197] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0039.197] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0039.197] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0039.197] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0039.197] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0039.197] GetCurrentObject (hdc=0x200109d7, type=0x1) returned 0x1b00017 [0039.197] GetCurrentObject (hdc=0x200109d7, type=0x2) returned 0x1900010 [0039.197] GetCurrentObject (hdc=0x200109d7, type=0x7) returned 0x5d0509c0 [0039.197] GetCurrentObject (hdc=0x200109d7, type=0x6) returned 0x18a002e [0039.197] SaveDC (hdc=0x200109d7) returned 1 [0039.197] GetNearestColor (hdc=0x200109d7, color=0xf0f0f0) returned 0xf0f0f0 [0039.197] RestoreDC (hdc=0x200109d7, nSavedDC=-1) returned 1 [0039.197] GdipReleaseDC (graphics=0x1b86d040, hdc=0x200109d7) returned 0x0 [0039.197] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0039.197] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0039.197] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0039.197] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0039.197] GetCurrentObject (hdc=0x200109d7, type=0x1) returned 0x1b00017 [0039.198] GetCurrentObject (hdc=0x200109d7, type=0x2) returned 0x1900010 [0039.198] GetCurrentObject (hdc=0x200109d7, type=0x7) returned 0x5d0509c0 [0039.198] GetCurrentObject (hdc=0x200109d7, type=0x6) returned 0x18a002e [0039.198] SaveDC (hdc=0x200109d7) returned 1 [0039.198] GetTextAlign (hdc=0x200109d7) returned 0x0 [0039.198] GetTextColor (hdc=0x200109d7) returned 0x0 [0039.198] SetTextColor (hdc=0x200109d7, color=0xf0f0f0) returned 0x0 [0039.198] GetCurrentObject (hdc=0x200109d7, type=0x6) returned 0x18a002e [0039.198] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0039.198] SelectObject (hdc=0x200109d7, h=0x260a09ba) returned 0x18a002e [0039.198] GetBkMode (hdc=0x200109d7) returned 2 [0039.198] SetBkMode (hdc=0x200109d7, mode=1) returned 2 [0039.198] DrawTextExW (in: hdc=0x200109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27789f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0039.198] DrawTextExW (in: hdc=0x200109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27789f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0039.199] RestoreDC (hdc=0x200109d7, nSavedDC=-1) returned 1 [0039.199] GdipReleaseDC (graphics=0x1b86d040, hdc=0x200109d7) returned 0x0 [0039.199] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0039.199] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x200109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0039.199] GdipReleaseDC (graphics=0x1b86d040, hdc=0x200109d7) returned 0x0 [0039.199] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0039.199] SelectObject (hdc=0x200109d7, h=0x185000f) returned 0x5d0509c0 [0039.199] DeleteDC (hdc=0x200109d7) returned 1 [0039.199] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0039.199] DeleteObject (ho=0x5d0509c0) returned 1 [0039.203] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0039.203] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.203] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.203] WaitMessage () returned 1 [0039.326] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.326] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.326] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.326] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.326] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.326] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0039.326] GetCurrentThreadId () returned 0xa28 [0039.326] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0039.326] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.326] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.326] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.326] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.326] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.326] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0039.326] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0039.326] CreateCompatibleDC (hdc=0x60109d6) returned 0x2e0109d2 [0039.326] GetObjectType (h=0x60109d6) returned 0x3 [0039.326] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x5e0509c0 [0039.326] GetDIBits (in: hdc=0x60109d6, hbm=0x5e0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.327] GetDIBits (in: hdc=0x60109d6, hbm=0x5e0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.327] DeleteObject (ho=0x5e0509c0) returned 1 [0039.327] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x210509d7 [0039.327] SelectObject (hdc=0x2e0109d2, h=0x210509d7) returned 0x185000f [0039.327] GdipCreateFromHDC (hdc=0x2e0109d2, graphics=0x26e408) returned 0x0 [0039.327] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0039.327] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0039.327] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0039.327] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0039.327] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0039.327] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d44a0 [0039.327] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d44a0) returned 0x0 [0039.327] LocalFree (hMem=0x1a7d44a0) returned 0x0 [0039.327] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0039.327] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0039.327] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0039.327] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0039.328] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0039.328] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.328] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.328] GetSystemMetrics (nIndex=42) returned 0 [0039.328] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.328] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.328] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0039.328] IsAppThemed () returned 0x1 [0039.328] GetThemeAppProperties () returned 0x3 [0039.328] GetThemeAppProperties () returned 0x3 [0039.328] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0039.328] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0039.328] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0039.328] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0039.328] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0039.328] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d44a0 [0039.328] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d44a0) returned 0x0 [0039.328] LocalFree (hMem=0x1a7d44a0) returned 0x0 [0039.328] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0039.328] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d44a0 [0039.328] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d44a0) returned 0x0 [0039.328] LocalFree (hMem=0x1a7d44a0) returned 0x0 [0039.328] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0039.328] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0039.328] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0039.328] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0039.328] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0039.329] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0039.329] GetCurrentObject (hdc=0x2e0109d2, type=0x1) returned 0x1b00017 [0039.329] GetCurrentObject (hdc=0x2e0109d2, type=0x2) returned 0x1900010 [0039.329] GetCurrentObject (hdc=0x2e0109d2, type=0x7) returned 0x210509d7 [0039.329] GetCurrentObject (hdc=0x2e0109d2, type=0x6) returned 0x18a002e [0039.329] SaveDC (hdc=0x2e0109d2) returned 1 [0039.329] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x570409ff [0039.329] GetClipRgn (hdc=0x2e0109d2, hrgn=0x570409ff) returned 0 [0039.329] SelectClipRgn (hdc=0x2e0109d2, hrgn=0x320409f1) returned 2 [0039.329] DeleteObject (ho=0x570409ff) returned 1 [0039.329] DeleteObject (ho=0x320409f1) returned 1 [0039.329] OffsetViewportOrgEx (in: hdc=0x2e0109d2, x=0, y=0, lppt=0x277a5d8 | out: lppt=0x277a5d8) returned 1 [0039.329] OffsetViewportOrgEx (in: hdc=0x2e0109d2, x=-417, y=-278, lppt=0x277a5f0 | out: lppt=0x277a5f0) returned 1 [0039.329] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0039.329] GetCurrentObject (hdc=0x2e0109d2, type=0x1) returned 0x1b00017 [0039.329] GetCurrentObject (hdc=0x2e0109d2, type=0x2) returned 0x1900010 [0039.329] GetCurrentObject (hdc=0x2e0109d2, type=0x7) returned 0x210509d7 [0039.329] GetCurrentObject (hdc=0x2e0109d2, type=0x6) returned 0x18a002e [0039.329] SaveDC (hdc=0x2e0109d2) returned 2 [0039.329] GetNearestColor (hdc=0x2e0109d2, color=0x6c4607) returned 0x6c4607 [0039.329] CreateSolidBrush (color=0x6c4607) returned 0x51100276 [0039.329] FillRect (hDC=0x2e0109d2, lprc=0x26de08, hbr=0x51100276) returned 1 [0039.335] DeleteObject (ho=0x51100276) returned 1 [0039.335] RestoreDC (hdc=0x2e0109d2, nSavedDC=-1) returned 1 [0039.336] RestoreDC (hdc=0x2e0109d2, nSavedDC=-1) returned 1 [0039.336] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2e0109d2) returned 0x0 [0039.336] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd940dbd) returned 0x0 [0039.336] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0039.336] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.336] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.336] GetSystemMetrics (nIndex=42) returned 0 [0039.336] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.336] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.336] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0039.336] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0039.336] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0039.336] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0039.336] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0039.336] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0039.336] GetCurrentObject (hdc=0x2e0109d2, type=0x1) returned 0x1b00017 [0039.336] GetCurrentObject (hdc=0x2e0109d2, type=0x2) returned 0x1900010 [0039.336] GetCurrentObject (hdc=0x2e0109d2, type=0x7) returned 0x210509d7 [0039.336] GetCurrentObject (hdc=0x2e0109d2, type=0x6) returned 0x18a002e [0039.336] SaveDC (hdc=0x2e0109d2) returned 1 [0039.336] GetNearestColor (hdc=0x2e0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0039.336] RestoreDC (hdc=0x2e0109d2, nSavedDC=-1) returned 1 [0039.336] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2e0109d2) returned 0x0 [0039.337] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0039.337] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0039.337] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0039.337] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0039.337] GetCurrentObject (hdc=0x2e0109d2, type=0x1) returned 0x1b00017 [0039.337] GetCurrentObject (hdc=0x2e0109d2, type=0x2) returned 0x1900010 [0039.337] GetCurrentObject (hdc=0x2e0109d2, type=0x7) returned 0x210509d7 [0039.337] GetCurrentObject (hdc=0x2e0109d2, type=0x6) returned 0x18a002e [0039.337] SaveDC (hdc=0x2e0109d2) returned 1 [0039.337] GetTextAlign (hdc=0x2e0109d2) returned 0x0 [0039.337] GetTextColor (hdc=0x2e0109d2) returned 0x0 [0039.337] SetTextColor (hdc=0x2e0109d2, color=0xf0f0f0) returned 0x0 [0039.337] GetCurrentObject (hdc=0x2e0109d2, type=0x6) returned 0x18a002e [0039.337] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0039.337] SelectObject (hdc=0x2e0109d2, h=0x260a09ba) returned 0x18a002e [0039.337] GetBkMode (hdc=0x2e0109d2) returned 2 [0039.337] SetBkMode (hdc=0x2e0109d2, mode=1) returned 2 [0039.337] DrawTextExW (in: hdc=0x2e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x277b2a0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0039.337] DrawTextExW (in: hdc=0x2e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x277b2a0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0039.338] RestoreDC (hdc=0x2e0109d2, nSavedDC=-1) returned 1 [0039.338] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2e0109d2) returned 0x0 [0039.338] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0039.338] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x2e0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0039.338] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2e0109d2) returned 0x0 [0039.338] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0039.338] SelectObject (hdc=0x2e0109d2, h=0x185000f) returned 0x210509d7 [0039.338] DeleteDC (hdc=0x2e0109d2) returned 1 [0039.338] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0039.338] DeleteObject (ho=0x210509d7) returned 1 [0039.342] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0039.342] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.342] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.342] WaitMessage () returned 1 [0039.466] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.466] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.466] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.466] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.466] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.466] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0039.466] GetCurrentThreadId () returned 0xa28 [0039.466] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0039.466] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.466] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.466] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.466] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.466] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.466] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0039.467] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0039.467] CreateCompatibleDC (hdc=0x60109d6) returned 0x600109c0 [0039.467] GetObjectType (h=0x60109d6) returned 0x3 [0039.467] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x220509d7 [0039.467] GetDIBits (in: hdc=0x60109d6, hbm=0x220509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.467] GetDIBits (in: hdc=0x60109d6, hbm=0x220509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.467] DeleteObject (ho=0x220509d7) returned 1 [0039.467] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x2f0509d2 [0039.467] SelectObject (hdc=0x600109c0, h=0x2f0509d2) returned 0x185000f [0039.467] GdipCreateFromHDC (hdc=0x600109c0, graphics=0x26e408) returned 0x0 [0039.468] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0039.468] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0039.468] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0039.468] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0039.468] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0039.468] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d44a0 [0039.468] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d44a0) returned 0x0 [0039.468] LocalFree (hMem=0x1a7d44a0) returned 0x0 [0039.468] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0039.468] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0039.468] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0039.468] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0039.468] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0039.468] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.468] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.468] GetSystemMetrics (nIndex=42) returned 0 [0039.468] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.468] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.468] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0039.468] IsAppThemed () returned 0x1 [0039.468] GetThemeAppProperties () returned 0x3 [0039.468] GetThemeAppProperties () returned 0x3 [0039.468] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0039.468] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0039.468] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0039.468] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0039.468] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0039.469] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d44a0 [0039.469] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d44a0) returned 0x0 [0039.469] LocalFree (hMem=0x1a7d44a0) returned 0x0 [0039.469] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0039.469] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d44a0 [0039.469] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d44a0) returned 0x0 [0039.469] LocalFree (hMem=0x1a7d44a0) returned 0x0 [0039.469] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0039.469] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0039.469] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0039.469] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0039.469] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0039.469] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0039.469] GetCurrentObject (hdc=0x600109c0, type=0x1) returned 0x1b00017 [0039.469] GetCurrentObject (hdc=0x600109c0, type=0x2) returned 0x1900010 [0039.469] GetCurrentObject (hdc=0x600109c0, type=0x7) returned 0x2f0509d2 [0039.469] GetCurrentObject (hdc=0x600109c0, type=0x6) returned 0x18a002e [0039.469] SaveDC (hdc=0x600109c0) returned 1 [0039.469] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x330409f1 [0039.469] GetClipRgn (hdc=0x600109c0, hrgn=0x330409f1) returned 0 [0039.469] SelectClipRgn (hdc=0x600109c0, hrgn=0x5a0409ff) returned 2 [0039.469] DeleteObject (ho=0x330409f1) returned 1 [0039.469] DeleteObject (ho=0x5a0409ff) returned 1 [0039.469] OffsetViewportOrgEx (in: hdc=0x600109c0, x=0, y=0, lppt=0x277ce80 | out: lppt=0x277ce80) returned 1 [0039.469] OffsetViewportOrgEx (in: hdc=0x600109c0, x=-417, y=-278, lppt=0x277ce98 | out: lppt=0x277ce98) returned 1 [0039.469] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0039.469] GetCurrentObject (hdc=0x600109c0, type=0x1) returned 0x1b00017 [0039.469] GetCurrentObject (hdc=0x600109c0, type=0x2) returned 0x1900010 [0039.469] GetCurrentObject (hdc=0x600109c0, type=0x7) returned 0x2f0509d2 [0039.470] GetCurrentObject (hdc=0x600109c0, type=0x6) returned 0x18a002e [0039.470] SaveDC (hdc=0x600109c0) returned 2 [0039.470] GetNearestColor (hdc=0x600109c0, color=0x6c4607) returned 0x6c4607 [0039.470] CreateSolidBrush (color=0x6c4607) returned 0x52100276 [0039.470] FillRect (hDC=0x600109c0, lprc=0x26de08, hbr=0x52100276) returned 1 [0039.476] DeleteObject (ho=0x52100276) returned 1 [0039.476] RestoreDC (hdc=0x600109c0, nSavedDC=-1) returned 1 [0039.476] RestoreDC (hdc=0x600109c0, nSavedDC=-1) returned 1 [0039.476] GdipReleaseDC (graphics=0x1b86d040, hdc=0x600109c0) returned 0x0 [0039.476] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd920dbd) returned 0x0 [0039.476] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0039.476] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.476] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.476] GetSystemMetrics (nIndex=42) returned 0 [0039.476] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.476] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.476] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x14) returned 0x0 [0039.477] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0039.477] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0039.477] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0039.477] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0039.477] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0039.477] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0039.477] GetCurrentObject (hdc=0x600109c0, type=0x1) returned 0x1b00017 [0039.477] GetCurrentObject (hdc=0x600109c0, type=0x2) returned 0x1900010 [0039.477] GetCurrentObject (hdc=0x600109c0, type=0x7) returned 0x2f0509d2 [0039.478] GetCurrentObject (hdc=0x600109c0, type=0x6) returned 0x18a002e [0039.478] SaveDC (hdc=0x600109c0) returned 1 [0039.478] GetNearestColor (hdc=0x600109c0, color=0xf0f0f0) returned 0xf0f0f0 [0039.478] RestoreDC (hdc=0x600109c0, nSavedDC=-1) returned 1 [0039.478] GdipReleaseDC (graphics=0x1b86d040, hdc=0x600109c0) returned 0x0 [0039.478] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0039.478] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0039.478] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0039.478] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0039.478] GetCurrentObject (hdc=0x600109c0, type=0x1) returned 0x1b00017 [0039.478] GetCurrentObject (hdc=0x600109c0, type=0x2) returned 0x1900010 [0039.478] GetCurrentObject (hdc=0x600109c0, type=0x7) returned 0x2f0509d2 [0039.478] GetCurrentObject (hdc=0x600109c0, type=0x6) returned 0x18a002e [0039.478] SaveDC (hdc=0x600109c0) returned 1 [0039.478] GetTextAlign (hdc=0x600109c0) returned 0x0 [0039.478] GetTextColor (hdc=0x600109c0) returned 0x0 [0039.478] SetTextColor (hdc=0x600109c0, color=0xf0f0f0) returned 0x0 [0039.478] GetCurrentObject (hdc=0x600109c0, type=0x6) returned 0x18a002e [0039.478] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0039.478] SelectObject (hdc=0x600109c0, h=0x260a09ba) returned 0x18a002e [0039.479] GetBkMode (hdc=0x600109c0) returned 2 [0039.479] SetBkMode (hdc=0x600109c0, mode=1) returned 2 [0039.479] DrawTextExW (in: hdc=0x600109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x277dda0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0039.479] DrawTextExW (in: hdc=0x600109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x277dda0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0039.479] RestoreDC (hdc=0x600109c0, nSavedDC=-1) returned 1 [0039.479] GdipReleaseDC (graphics=0x1b86d040, hdc=0x600109c0) returned 0x0 [0039.479] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0039.479] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x600109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0039.480] GdipReleaseDC (graphics=0x1b86d040, hdc=0x600109c0) returned 0x0 [0039.480] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0039.480] SelectObject (hdc=0x600109c0, h=0x185000f) returned 0x2f0509d2 [0039.480] DeleteDC (hdc=0x600109c0) returned 1 [0039.480] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0039.480] DeleteObject (ho=0x2f0509d2) returned 1 [0039.483] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0039.483] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.483] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.483] WaitMessage () returned 1 [0039.607] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.607] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.607] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.607] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.607] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.607] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0039.607] GetCurrentThreadId () returned 0xa28 [0039.607] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0039.607] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.607] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.607] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.607] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.607] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.607] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0039.607] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0039.607] CreateCompatibleDC (hdc=0x60109d6) returned 0x240109d7 [0039.607] GetObjectType (h=0x60109d6) returned 0x3 [0039.607] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x300509d2 [0039.608] GetDIBits (in: hdc=0x60109d6, hbm=0x300509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.608] GetDIBits (in: hdc=0x60109d6, hbm=0x300509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.608] DeleteObject (ho=0x300509d2) returned 1 [0039.608] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x610509c0 [0039.608] SelectObject (hdc=0x240109d7, h=0x610509c0) returned 0x185000f [0039.608] GdipCreateFromHDC (hdc=0x240109d7, graphics=0x26e408) returned 0x0 [0039.608] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0039.608] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0039.608] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0039.608] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0039.608] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0039.608] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4520 [0039.608] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4520) returned 0x0 [0039.608] LocalFree (hMem=0x1a7d4520) returned 0x0 [0039.608] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0039.608] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0039.608] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0039.609] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0039.609] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0039.609] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.609] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.609] GetSystemMetrics (nIndex=42) returned 0 [0039.609] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.609] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.609] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0039.609] IsAppThemed () returned 0x1 [0039.609] GetThemeAppProperties () returned 0x3 [0039.609] GetThemeAppProperties () returned 0x3 [0039.609] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0039.609] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0039.609] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0039.609] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0039.609] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0039.609] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4520 [0039.609] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4520) returned 0x0 [0039.609] LocalFree (hMem=0x1a7d4520) returned 0x0 [0039.609] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0039.609] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4520 [0039.609] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4520) returned 0x0 [0039.609] LocalFree (hMem=0x1a7d4520) returned 0x0 [0039.609] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0039.609] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0039.609] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0039.609] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0039.609] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0039.610] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0039.610] GetCurrentObject (hdc=0x240109d7, type=0x1) returned 0x1b00017 [0039.610] GetCurrentObject (hdc=0x240109d7, type=0x2) returned 0x1900010 [0039.610] GetCurrentObject (hdc=0x240109d7, type=0x7) returned 0x610509c0 [0039.610] GetCurrentObject (hdc=0x240109d7, type=0x6) returned 0x18a002e [0039.610] SaveDC (hdc=0x240109d7) returned 1 [0039.610] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5b0409ff [0039.610] GetClipRgn (hdc=0x240109d7, hrgn=0x5b0409ff) returned 0 [0039.610] SelectClipRgn (hdc=0x240109d7, hrgn=0x360409f1) returned 2 [0039.610] DeleteObject (ho=0x5b0409ff) returned 1 [0039.610] DeleteObject (ho=0x360409f1) returned 1 [0039.610] OffsetViewportOrgEx (in: hdc=0x240109d7, x=0, y=0, lppt=0x277f980 | out: lppt=0x277f980) returned 1 [0039.610] OffsetViewportOrgEx (in: hdc=0x240109d7, x=-417, y=-278, lppt=0x277f998 | out: lppt=0x277f998) returned 1 [0039.610] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0039.610] GetCurrentObject (hdc=0x240109d7, type=0x1) returned 0x1b00017 [0039.610] GetCurrentObject (hdc=0x240109d7, type=0x2) returned 0x1900010 [0039.610] GetCurrentObject (hdc=0x240109d7, type=0x7) returned 0x610509c0 [0039.610] GetCurrentObject (hdc=0x240109d7, type=0x6) returned 0x18a002e [0039.610] SaveDC (hdc=0x240109d7) returned 2 [0039.610] GetNearestColor (hdc=0x240109d7, color=0x6c4607) returned 0x6c4607 [0039.610] CreateSolidBrush (color=0x6c4607) returned 0x53100276 [0039.610] FillRect (hDC=0x240109d7, lprc=0x26de08, hbr=0x53100276) returned 1 [0039.617] DeleteObject (ho=0x53100276) returned 1 [0039.617] RestoreDC (hdc=0x240109d7, nSavedDC=-1) returned 1 [0039.617] RestoreDC (hdc=0x240109d7, nSavedDC=-1) returned 1 [0039.617] GdipReleaseDC (graphics=0x1b86d040, hdc=0x240109d7) returned 0x0 [0039.617] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd900dbd) returned 0x0 [0039.617] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0039.617] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.617] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.617] GetSystemMetrics (nIndex=42) returned 0 [0039.617] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.617] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.617] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0039.617] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0039.617] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0039.617] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0039.617] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0039.617] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0039.617] GetCurrentObject (hdc=0x240109d7, type=0x1) returned 0x1b00017 [0039.617] GetCurrentObject (hdc=0x240109d7, type=0x2) returned 0x1900010 [0039.617] GetCurrentObject (hdc=0x240109d7, type=0x7) returned 0x610509c0 [0039.617] GetCurrentObject (hdc=0x240109d7, type=0x6) returned 0x18a002e [0039.618] SaveDC (hdc=0x240109d7) returned 1 [0039.618] GetNearestColor (hdc=0x240109d7, color=0xf0f0f0) returned 0xf0f0f0 [0039.618] RestoreDC (hdc=0x240109d7, nSavedDC=-1) returned 1 [0039.618] GdipReleaseDC (graphics=0x1b86d040, hdc=0x240109d7) returned 0x0 [0039.618] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0039.618] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0039.618] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0039.618] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0039.618] GetCurrentObject (hdc=0x240109d7, type=0x1) returned 0x1b00017 [0039.618] GetCurrentObject (hdc=0x240109d7, type=0x2) returned 0x1900010 [0039.618] GetCurrentObject (hdc=0x240109d7, type=0x7) returned 0x610509c0 [0039.618] GetCurrentObject (hdc=0x240109d7, type=0x6) returned 0x18a002e [0039.618] SaveDC (hdc=0x240109d7) returned 1 [0039.619] GetTextAlign (hdc=0x240109d7) returned 0x0 [0039.619] GetTextColor (hdc=0x240109d7) returned 0x0 [0039.619] SetTextColor (hdc=0x240109d7, color=0xf0f0f0) returned 0x0 [0039.619] GetCurrentObject (hdc=0x240109d7, type=0x6) returned 0x18a002e [0039.619] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0039.619] SelectObject (hdc=0x240109d7, h=0x260a09ba) returned 0x18a002e [0039.619] GetBkMode (hdc=0x240109d7) returned 2 [0039.619] SetBkMode (hdc=0x240109d7, mode=1) returned 2 [0039.619] DrawTextExW (in: hdc=0x240109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2780648 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0039.619] DrawTextExW (in: hdc=0x240109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2780648 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0039.619] RestoreDC (hdc=0x240109d7, nSavedDC=-1) returned 1 [0039.620] GdipReleaseDC (graphics=0x1b86d040, hdc=0x240109d7) returned 0x0 [0039.620] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0039.620] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x240109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0039.620] GdipReleaseDC (graphics=0x1b86d040, hdc=0x240109d7) returned 0x0 [0039.620] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0039.620] SelectObject (hdc=0x240109d7, h=0x185000f) returned 0x610509c0 [0039.620] DeleteDC (hdc=0x240109d7) returned 1 [0039.620] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0039.620] DeleteObject (ho=0x610509c0) returned 1 [0039.624] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0039.624] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.624] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.624] WaitMessage () returned 1 [0039.748] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.748] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.748] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.748] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.748] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.748] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0039.748] GetCurrentThreadId () returned 0xa28 [0039.748] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0039.748] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.748] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.748] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.748] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.748] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.748] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0039.748] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0039.748] CreateCompatibleDC (hdc=0x60109d6) returned 0x320109d2 [0039.748] GetObjectType (h=0x60109d6) returned 0x3 [0039.748] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x620509c0 [0039.749] GetDIBits (in: hdc=0x60109d6, hbm=0x620509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.749] GetDIBits (in: hdc=0x60109d6, hbm=0x620509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.749] DeleteObject (ho=0x620509c0) returned 1 [0039.749] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x250509d7 [0039.749] SelectObject (hdc=0x320109d2, h=0x250509d7) returned 0x185000f [0039.749] GdipCreateFromHDC (hdc=0x320109d2, graphics=0x26e408) returned 0x0 [0039.749] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0039.749] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0039.749] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0039.749] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0039.749] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0039.749] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4520 [0039.749] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4520) returned 0x0 [0039.750] LocalFree (hMem=0x1a7d4520) returned 0x0 [0039.750] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0039.750] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0039.750] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0039.750] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0039.750] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0039.750] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.750] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.750] GetSystemMetrics (nIndex=42) returned 0 [0039.750] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.750] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.750] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0039.750] IsAppThemed () returned 0x1 [0039.750] GetThemeAppProperties () returned 0x3 [0039.750] GetThemeAppProperties () returned 0x3 [0039.750] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0039.750] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0039.750] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0039.750] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0039.750] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0039.750] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4520 [0039.750] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4520) returned 0x0 [0039.750] LocalFree (hMem=0x1a7d4520) returned 0x0 [0039.750] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0039.750] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4520 [0039.750] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4520) returned 0x0 [0039.750] LocalFree (hMem=0x1a7d4520) returned 0x0 [0039.750] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0039.751] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0039.751] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0039.751] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0039.751] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0039.751] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0039.751] GetCurrentObject (hdc=0x320109d2, type=0x1) returned 0x1b00017 [0039.751] GetCurrentObject (hdc=0x320109d2, type=0x2) returned 0x1900010 [0039.751] GetCurrentObject (hdc=0x320109d2, type=0x7) returned 0x250509d7 [0039.751] GetCurrentObject (hdc=0x320109d2, type=0x6) returned 0x18a002e [0039.751] SaveDC (hdc=0x320109d2) returned 1 [0039.751] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x370409f1 [0039.751] GetClipRgn (hdc=0x320109d2, hrgn=0x370409f1) returned 0 [0039.751] SelectClipRgn (hdc=0x320109d2, hrgn=0x5e0409ff) returned 2 [0039.752] DeleteObject (ho=0x370409f1) returned 1 [0039.752] DeleteObject (ho=0x5e0409ff) returned 1 [0039.752] OffsetViewportOrgEx (in: hdc=0x320109d2, x=0, y=0, lppt=0x2782228 | out: lppt=0x2782228) returned 1 [0039.752] OffsetViewportOrgEx (in: hdc=0x320109d2, x=-417, y=-278, lppt=0x2782240 | out: lppt=0x2782240) returned 1 [0039.752] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0039.752] GetCurrentObject (hdc=0x320109d2, type=0x1) returned 0x1b00017 [0039.752] GetCurrentObject (hdc=0x320109d2, type=0x2) returned 0x1900010 [0039.752] GetCurrentObject (hdc=0x320109d2, type=0x7) returned 0x250509d7 [0039.752] GetCurrentObject (hdc=0x320109d2, type=0x6) returned 0x18a002e [0039.752] SaveDC (hdc=0x320109d2) returned 2 [0039.752] GetNearestColor (hdc=0x320109d2, color=0x6c4607) returned 0x6c4607 [0039.752] CreateSolidBrush (color=0x6c4607) returned 0x54100276 [0039.752] FillRect (hDC=0x320109d2, lprc=0x26de08, hbr=0x54100276) returned 1 [0039.758] DeleteObject (ho=0x54100276) returned 1 [0039.758] RestoreDC (hdc=0x320109d2, nSavedDC=-1) returned 1 [0039.758] RestoreDC (hdc=0x320109d2, nSavedDC=-1) returned 1 [0039.758] GdipReleaseDC (graphics=0x1b86d040, hdc=0x320109d2) returned 0x0 [0039.758] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd8e0dbd) returned 0x0 [0039.758] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0039.759] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.759] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.759] GetSystemMetrics (nIndex=42) returned 0 [0039.759] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.759] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.759] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x16) returned 0x0 [0039.760] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0039.760] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0039.760] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0039.760] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0039.760] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0039.760] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0039.760] GetCurrentObject (hdc=0x320109d2, type=0x1) returned 0x1b00017 [0039.760] GetCurrentObject (hdc=0x320109d2, type=0x2) returned 0x1900010 [0039.760] GetCurrentObject (hdc=0x320109d2, type=0x7) returned 0x250509d7 [0039.760] GetCurrentObject (hdc=0x320109d2, type=0x6) returned 0x18a002e [0039.760] SaveDC (hdc=0x320109d2) returned 1 [0039.760] GetNearestColor (hdc=0x320109d2, color=0xf0f0f0) returned 0xf0f0f0 [0039.760] RestoreDC (hdc=0x320109d2, nSavedDC=-1) returned 1 [0039.760] GdipReleaseDC (graphics=0x1b86d040, hdc=0x320109d2) returned 0x0 [0039.760] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0039.761] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0039.761] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0039.761] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0039.761] GetCurrentObject (hdc=0x320109d2, type=0x1) returned 0x1b00017 [0039.761] GetCurrentObject (hdc=0x320109d2, type=0x2) returned 0x1900010 [0039.761] GetCurrentObject (hdc=0x320109d2, type=0x7) returned 0x250509d7 [0039.761] GetCurrentObject (hdc=0x320109d2, type=0x6) returned 0x18a002e [0039.761] SaveDC (hdc=0x320109d2) returned 1 [0039.761] GetTextAlign (hdc=0x320109d2) returned 0x0 [0039.761] GetTextColor (hdc=0x320109d2) returned 0x0 [0039.761] SetTextColor (hdc=0x320109d2, color=0xf0f0f0) returned 0x0 [0039.761] GetCurrentObject (hdc=0x320109d2, type=0x6) returned 0x18a002e [0039.761] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0039.761] SelectObject (hdc=0x320109d2, h=0x260a09ba) returned 0x18a002e [0039.761] GetBkMode (hdc=0x320109d2) returned 2 [0039.761] SetBkMode (hdc=0x320109d2, mode=1) returned 2 [0039.761] DrawTextExW (in: hdc=0x320109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2783150 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0039.761] DrawTextExW (in: hdc=0x320109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2783150 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0039.762] RestoreDC (hdc=0x320109d2, nSavedDC=-1) returned 1 [0039.772] GdipReleaseDC (graphics=0x1b86d040, hdc=0x320109d2) returned 0x0 [0039.772] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0039.772] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x320109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0039.772] GdipReleaseDC (graphics=0x1b86d040, hdc=0x320109d2) returned 0x0 [0039.772] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0039.772] SelectObject (hdc=0x320109d2, h=0x185000f) returned 0x250509d7 [0039.772] DeleteDC (hdc=0x320109d2) returned 1 [0039.772] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0039.772] DeleteObject (ho=0x250509d7) returned 1 [0039.775] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0039.775] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.775] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.775] WaitMessage () returned 1 [0039.895] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.895] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.895] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.895] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.895] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.895] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0039.896] GetCurrentThreadId () returned 0xa28 [0039.896] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0039.896] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.896] IsWindowUnicode (hWnd=0x3015e) returned 1 [0039.896] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0039.896] TranslateMessage (lpMsg=0x26ee10) returned 0 [0039.896] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0039.896] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0039.896] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0039.896] CreateCompatibleDC (hdc=0x60109d6) returned 0x640109c0 [0039.896] GetObjectType (h=0x60109d6) returned 0x3 [0039.896] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x260509d7 [0039.896] GetDIBits (in: hdc=0x60109d6, hbm=0x260509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.896] GetDIBits (in: hdc=0x60109d6, hbm=0x260509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0039.896] DeleteObject (ho=0x260509d7) returned 1 [0039.896] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x330509d2 [0039.897] SelectObject (hdc=0x640109c0, h=0x330509d2) returned 0x185000f [0039.897] GdipCreateFromHDC (hdc=0x640109c0, graphics=0x26e408) returned 0x0 [0039.897] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0039.897] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0039.897] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0039.897] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0039.897] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0039.897] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d45a0 [0039.897] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d45a0) returned 0x0 [0039.897] LocalFree (hMem=0x1a7d45a0) returned 0x0 [0039.897] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0039.897] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0039.897] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0039.897] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0039.897] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0039.897] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.897] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.897] GetSystemMetrics (nIndex=42) returned 0 [0039.897] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.897] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.898] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0039.898] IsAppThemed () returned 0x1 [0039.898] GetThemeAppProperties () returned 0x3 [0039.898] GetThemeAppProperties () returned 0x3 [0039.898] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0039.898] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0039.898] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0039.898] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0039.898] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0039.898] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d45a0 [0039.898] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d45a0) returned 0x0 [0039.898] LocalFree (hMem=0x1a7d45a0) returned 0x0 [0039.898] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0039.898] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d45a0 [0039.898] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d45a0) returned 0x0 [0039.898] LocalFree (hMem=0x1a7d45a0) returned 0x0 [0039.898] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0039.898] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0039.898] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0039.898] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0039.898] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0039.898] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0039.898] GetCurrentObject (hdc=0x640109c0, type=0x1) returned 0x1b00017 [0039.898] GetCurrentObject (hdc=0x640109c0, type=0x2) returned 0x1900010 [0039.898] GetCurrentObject (hdc=0x640109c0, type=0x7) returned 0x330509d2 [0039.898] GetCurrentObject (hdc=0x640109c0, type=0x6) returned 0x18a002e [0039.898] SaveDC (hdc=0x640109c0) returned 1 [0039.898] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5f0409ff [0039.898] GetClipRgn (hdc=0x640109c0, hrgn=0x5f0409ff) returned 0 [0039.899] SelectClipRgn (hdc=0x640109c0, hrgn=0x3a0409f1) returned 2 [0039.899] DeleteObject (ho=0x5f0409ff) returned 1 [0039.899] DeleteObject (ho=0x3a0409f1) returned 1 [0039.899] OffsetViewportOrgEx (in: hdc=0x640109c0, x=0, y=0, lppt=0x2784d30 | out: lppt=0x2784d30) returned 1 [0039.899] OffsetViewportOrgEx (in: hdc=0x640109c0, x=-417, y=-278, lppt=0x2784d48 | out: lppt=0x2784d48) returned 1 [0039.899] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0039.899] GetCurrentObject (hdc=0x640109c0, type=0x1) returned 0x1b00017 [0039.899] GetCurrentObject (hdc=0x640109c0, type=0x2) returned 0x1900010 [0039.899] GetCurrentObject (hdc=0x640109c0, type=0x7) returned 0x330509d2 [0039.899] GetCurrentObject (hdc=0x640109c0, type=0x6) returned 0x18a002e [0039.899] SaveDC (hdc=0x640109c0) returned 2 [0039.899] GetNearestColor (hdc=0x640109c0, color=0x6c4607) returned 0x6c4607 [0039.899] CreateSolidBrush (color=0x6c4607) returned 0x55100276 [0039.899] FillRect (hDC=0x640109c0, lprc=0x26de08, hbr=0x55100276) returned 1 [0039.908] DeleteObject (ho=0x55100276) returned 1 [0039.908] RestoreDC (hdc=0x640109c0, nSavedDC=-1) returned 1 [0039.908] RestoreDC (hdc=0x640109c0, nSavedDC=-1) returned 1 [0039.908] GdipReleaseDC (graphics=0x1b86d040, hdc=0x640109c0) returned 0x0 [0039.908] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd8c0dbd) returned 0x0 [0039.908] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0039.908] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0039.908] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0039.908] GetSystemMetrics (nIndex=42) returned 0 [0039.908] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0039.908] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0039.908] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0039.908] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0039.909] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0039.909] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0039.909] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0039.909] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0039.909] GetCurrentObject (hdc=0x640109c0, type=0x1) returned 0x1b00017 [0039.909] GetCurrentObject (hdc=0x640109c0, type=0x2) returned 0x1900010 [0039.909] GetCurrentObject (hdc=0x640109c0, type=0x7) returned 0x330509d2 [0039.909] GetCurrentObject (hdc=0x640109c0, type=0x6) returned 0x18a002e [0039.909] SaveDC (hdc=0x640109c0) returned 1 [0039.909] GetNearestColor (hdc=0x640109c0, color=0xf0f0f0) returned 0xf0f0f0 [0039.909] RestoreDC (hdc=0x640109c0, nSavedDC=-1) returned 1 [0039.909] GdipReleaseDC (graphics=0x1b86d040, hdc=0x640109c0) returned 0x0 [0039.909] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0039.909] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0039.909] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0039.909] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0039.909] GetCurrentObject (hdc=0x640109c0, type=0x1) returned 0x1b00017 [0039.909] GetCurrentObject (hdc=0x640109c0, type=0x2) returned 0x1900010 [0039.909] GetCurrentObject (hdc=0x640109c0, type=0x7) returned 0x330509d2 [0039.909] GetCurrentObject (hdc=0x640109c0, type=0x6) returned 0x18a002e [0039.909] SaveDC (hdc=0x640109c0) returned 1 [0039.909] GetTextAlign (hdc=0x640109c0) returned 0x0 [0039.910] GetTextColor (hdc=0x640109c0) returned 0x0 [0039.910] SetTextColor (hdc=0x640109c0, color=0xf0f0f0) returned 0x0 [0039.910] GetCurrentObject (hdc=0x640109c0, type=0x6) returned 0x18a002e [0039.910] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0039.910] SelectObject (hdc=0x640109c0, h=0x260a09ba) returned 0x18a002e [0039.910] GetBkMode (hdc=0x640109c0) returned 2 [0039.910] SetBkMode (hdc=0x640109c0, mode=1) returned 2 [0039.910] DrawTextExW (in: hdc=0x640109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27859f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0039.910] DrawTextExW (in: hdc=0x640109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27859f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0039.910] RestoreDC (hdc=0x640109c0, nSavedDC=-1) returned 1 [0039.911] GdipReleaseDC (graphics=0x1b86d040, hdc=0x640109c0) returned 0x0 [0039.911] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0039.911] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x640109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0039.911] GdipReleaseDC (graphics=0x1b86d040, hdc=0x640109c0) returned 0x0 [0039.911] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0039.911] SelectObject (hdc=0x640109c0, h=0x185000f) returned 0x330509d2 [0039.911] DeleteDC (hdc=0x640109c0) returned 1 [0039.911] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0039.911] DeleteObject (ho=0x330509d2) returned 1 [0039.914] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0039.914] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.914] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0039.914] WaitMessage () returned 1 [0040.028] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.028] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.028] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.028] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.028] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.028] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0040.028] GetCurrentThreadId () returned 0xa28 [0040.028] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0040.028] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.028] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.028] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.028] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.028] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.028] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0040.028] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0040.028] CreateCompatibleDC (hdc=0x60109d6) returned 0x280109d7 [0040.028] GetObjectType (h=0x60109d6) returned 0x3 [0040.028] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x340509d2 [0040.029] GetDIBits (in: hdc=0x60109d6, hbm=0x340509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.029] GetDIBits (in: hdc=0x60109d6, hbm=0x340509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.029] DeleteObject (ho=0x340509d2) returned 1 [0040.029] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x650509c0 [0040.029] SelectObject (hdc=0x280109d7, h=0x650509c0) returned 0x185000f [0040.029] GdipCreateFromHDC (hdc=0x280109d7, graphics=0x26e408) returned 0x0 [0040.029] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0040.029] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0040.029] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0040.029] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0040.029] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0040.029] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d45a0 [0040.029] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d45a0) returned 0x0 [0040.029] LocalFree (hMem=0x1a7d45a0) returned 0x0 [0040.030] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0040.030] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0040.030] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0040.030] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0040.030] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0040.030] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.030] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.030] GetSystemMetrics (nIndex=42) returned 0 [0040.030] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.030] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.030] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0040.030] IsAppThemed () returned 0x1 [0040.030] GetThemeAppProperties () returned 0x3 [0040.030] GetThemeAppProperties () returned 0x3 [0040.030] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0040.030] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0040.030] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0040.030] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0040.030] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0040.030] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d45a0 [0040.030] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d45a0) returned 0x0 [0040.030] LocalFree (hMem=0x1a7d45a0) returned 0x0 [0040.030] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0040.030] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d45a0 [0040.030] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d45a0) returned 0x0 [0040.030] LocalFree (hMem=0x1a7d45a0) returned 0x0 [0040.030] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0040.030] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0040.030] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0040.031] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0040.031] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0040.031] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0040.031] GetCurrentObject (hdc=0x280109d7, type=0x1) returned 0x1b00017 [0040.031] GetCurrentObject (hdc=0x280109d7, type=0x2) returned 0x1900010 [0040.031] GetCurrentObject (hdc=0x280109d7, type=0x7) returned 0x650509c0 [0040.031] GetCurrentObject (hdc=0x280109d7, type=0x6) returned 0x18a002e [0040.031] SaveDC (hdc=0x280109d7) returned 1 [0040.031] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3b0409f1 [0040.031] GetClipRgn (hdc=0x280109d7, hrgn=0x3b0409f1) returned 0 [0040.031] SelectClipRgn (hdc=0x280109d7, hrgn=0x620409ff) returned 2 [0040.031] DeleteObject (ho=0x3b0409f1) returned 1 [0040.031] DeleteObject (ho=0x620409ff) returned 1 [0040.031] OffsetViewportOrgEx (in: hdc=0x280109d7, x=0, y=0, lppt=0x27875d8 | out: lppt=0x27875d8) returned 1 [0040.031] OffsetViewportOrgEx (in: hdc=0x280109d7, x=-417, y=-278, lppt=0x27875f0 | out: lppt=0x27875f0) returned 1 [0040.031] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0040.031] GetCurrentObject (hdc=0x280109d7, type=0x1) returned 0x1b00017 [0040.031] GetCurrentObject (hdc=0x280109d7, type=0x2) returned 0x1900010 [0040.031] GetCurrentObject (hdc=0x280109d7, type=0x7) returned 0x650509c0 [0040.031] GetCurrentObject (hdc=0x280109d7, type=0x6) returned 0x18a002e [0040.031] SaveDC (hdc=0x280109d7) returned 2 [0040.031] GetNearestColor (hdc=0x280109d7, color=0x6c4607) returned 0x6c4607 [0040.031] CreateSolidBrush (color=0x6c4607) returned 0x56100276 [0040.031] FillRect (hDC=0x280109d7, lprc=0x26de08, hbr=0x56100276) returned 1 [0040.037] DeleteObject (ho=0x56100276) returned 1 [0040.038] RestoreDC (hdc=0x280109d7, nSavedDC=-1) returned 1 [0040.038] RestoreDC (hdc=0x280109d7, nSavedDC=-1) returned 1 [0040.038] GdipReleaseDC (graphics=0x1b86d040, hdc=0x280109d7) returned 0x0 [0040.038] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd8a0dbd) returned 0x0 [0040.038] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0040.038] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.038] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.038] GetSystemMetrics (nIndex=42) returned 0 [0040.038] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.038] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.038] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x18) returned 0x0 [0040.039] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0040.039] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0040.039] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0040.039] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0040.039] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0040.039] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0040.039] GetCurrentObject (hdc=0x280109d7, type=0x1) returned 0x1b00017 [0040.039] GetCurrentObject (hdc=0x280109d7, type=0x2) returned 0x1900010 [0040.039] GetCurrentObject (hdc=0x280109d7, type=0x7) returned 0x650509c0 [0040.039] GetCurrentObject (hdc=0x280109d7, type=0x6) returned 0x18a002e [0040.039] SaveDC (hdc=0x280109d7) returned 1 [0040.039] GetNearestColor (hdc=0x280109d7, color=0xf0f0f0) returned 0xf0f0f0 [0040.039] RestoreDC (hdc=0x280109d7, nSavedDC=-1) returned 1 [0040.039] GdipReleaseDC (graphics=0x1b86d040, hdc=0x280109d7) returned 0x0 [0040.040] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0040.040] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0040.040] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0040.040] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0040.040] GetCurrentObject (hdc=0x280109d7, type=0x1) returned 0x1b00017 [0040.040] GetCurrentObject (hdc=0x280109d7, type=0x2) returned 0x1900010 [0040.040] GetCurrentObject (hdc=0x280109d7, type=0x7) returned 0x650509c0 [0040.040] GetCurrentObject (hdc=0x280109d7, type=0x6) returned 0x18a002e [0040.040] SaveDC (hdc=0x280109d7) returned 1 [0040.040] GetTextAlign (hdc=0x280109d7) returned 0x0 [0040.040] GetTextColor (hdc=0x280109d7) returned 0x0 [0040.040] SetTextColor (hdc=0x280109d7, color=0xf0f0f0) returned 0x0 [0040.040] GetCurrentObject (hdc=0x280109d7, type=0x6) returned 0x18a002e [0040.040] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0040.040] SelectObject (hdc=0x280109d7, h=0x260a09ba) returned 0x18a002e [0040.040] GetBkMode (hdc=0x280109d7) returned 2 [0040.040] SetBkMode (hdc=0x280109d7, mode=1) returned 2 [0040.040] DrawTextExW (in: hdc=0x280109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27884f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0040.040] DrawTextExW (in: hdc=0x280109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27884f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0040.041] RestoreDC (hdc=0x280109d7, nSavedDC=-1) returned 1 [0040.041] GdipReleaseDC (graphics=0x1b86d040, hdc=0x280109d7) returned 0x0 [0040.041] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0040.041] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x280109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0040.041] GdipReleaseDC (graphics=0x1b86d040, hdc=0x280109d7) returned 0x0 [0040.041] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0040.041] SelectObject (hdc=0x280109d7, h=0x185000f) returned 0x650509c0 [0040.041] DeleteDC (hdc=0x280109d7) returned 1 [0040.041] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0040.041] DeleteObject (ho=0x650509c0) returned 1 [0040.045] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0040.045] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.045] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.045] WaitMessage () returned 1 [0040.168] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.168] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.168] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.168] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.168] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.168] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0040.168] GetCurrentThreadId () returned 0xa28 [0040.168] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0040.168] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.168] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.168] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.168] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.168] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.168] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0040.169] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0040.169] CreateCompatibleDC (hdc=0x60109d6) returned 0x360109d2 [0040.169] GetObjectType (h=0x60109d6) returned 0x3 [0040.169] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x660509c0 [0040.169] GetDIBits (in: hdc=0x60109d6, hbm=0x660509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.169] GetDIBits (in: hdc=0x60109d6, hbm=0x660509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.169] DeleteObject (ho=0x660509c0) returned 1 [0040.169] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x290509d7 [0040.169] SelectObject (hdc=0x360109d2, h=0x290509d7) returned 0x185000f [0040.169] GdipCreateFromHDC (hdc=0x360109d2, graphics=0x26e408) returned 0x0 [0040.169] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0040.169] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0040.169] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0040.169] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0040.170] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0040.170] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4620 [0040.170] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4620) returned 0x0 [0040.170] LocalFree (hMem=0x1a7d4620) returned 0x0 [0040.170] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0040.170] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0040.170] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0040.170] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0040.170] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0040.170] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.170] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.170] GetSystemMetrics (nIndex=42) returned 0 [0040.170] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.170] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.170] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0040.170] IsAppThemed () returned 0x1 [0040.170] GetThemeAppProperties () returned 0x3 [0040.170] GetThemeAppProperties () returned 0x3 [0040.170] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0040.170] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0040.170] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0040.170] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0040.170] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0040.170] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4620 [0040.170] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4620) returned 0x0 [0040.170] LocalFree (hMem=0x1a7d4620) returned 0x0 [0040.170] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0040.170] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4620 [0040.170] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4620) returned 0x0 [0040.171] LocalFree (hMem=0x1a7d4620) returned 0x0 [0040.171] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0040.171] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0040.171] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0040.171] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0040.171] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0040.171] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0040.171] GetCurrentObject (hdc=0x360109d2, type=0x1) returned 0x1b00017 [0040.171] GetCurrentObject (hdc=0x360109d2, type=0x2) returned 0x1900010 [0040.171] GetCurrentObject (hdc=0x360109d2, type=0x7) returned 0x290509d7 [0040.171] GetCurrentObject (hdc=0x360109d2, type=0x6) returned 0x18a002e [0040.171] SaveDC (hdc=0x360109d2) returned 1 [0040.171] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x630409ff [0040.171] GetClipRgn (hdc=0x360109d2, hrgn=0x630409ff) returned 0 [0040.171] SelectClipRgn (hdc=0x360109d2, hrgn=0x3e0409f1) returned 2 [0040.171] DeleteObject (ho=0x630409ff) returned 1 [0040.171] DeleteObject (ho=0x3e0409f1) returned 1 [0040.171] OffsetViewportOrgEx (in: hdc=0x360109d2, x=0, y=0, lppt=0x278a0d0 | out: lppt=0x278a0d0) returned 1 [0040.171] OffsetViewportOrgEx (in: hdc=0x360109d2, x=-417, y=-278, lppt=0x278a0e8 | out: lppt=0x278a0e8) returned 1 [0040.171] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0040.171] GetCurrentObject (hdc=0x360109d2, type=0x1) returned 0x1b00017 [0040.171] GetCurrentObject (hdc=0x360109d2, type=0x2) returned 0x1900010 [0040.171] GetCurrentObject (hdc=0x360109d2, type=0x7) returned 0x290509d7 [0040.171] GetCurrentObject (hdc=0x360109d2, type=0x6) returned 0x18a002e [0040.171] SaveDC (hdc=0x360109d2) returned 2 [0040.172] GetNearestColor (hdc=0x360109d2, color=0x6c4607) returned 0x6c4607 [0040.172] CreateSolidBrush (color=0x6c4607) returned 0x57100276 [0040.172] FillRect (hDC=0x360109d2, lprc=0x26de08, hbr=0x57100276) returned 1 [0040.178] DeleteObject (ho=0x57100276) returned 1 [0040.178] RestoreDC (hdc=0x360109d2, nSavedDC=-1) returned 1 [0040.178] RestoreDC (hdc=0x360109d2, nSavedDC=-1) returned 1 [0040.178] GdipReleaseDC (graphics=0x1b86d040, hdc=0x360109d2) returned 0x0 [0040.178] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd880dbd) returned 0x0 [0040.178] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0040.178] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.178] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.178] GetSystemMetrics (nIndex=42) returned 0 [0040.178] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.178] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.178] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0040.178] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0040.178] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0040.178] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0040.178] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0040.178] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0040.178] GetCurrentObject (hdc=0x360109d2, type=0x1) returned 0x1b00017 [0040.178] GetCurrentObject (hdc=0x360109d2, type=0x2) returned 0x1900010 [0040.179] GetCurrentObject (hdc=0x360109d2, type=0x7) returned 0x290509d7 [0040.179] GetCurrentObject (hdc=0x360109d2, type=0x6) returned 0x18a002e [0040.179] SaveDC (hdc=0x360109d2) returned 1 [0040.179] GetNearestColor (hdc=0x360109d2, color=0xf0f0f0) returned 0xf0f0f0 [0040.179] RestoreDC (hdc=0x360109d2, nSavedDC=-1) returned 1 [0040.179] GdipReleaseDC (graphics=0x1b86d040, hdc=0x360109d2) returned 0x0 [0040.180] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0040.180] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0040.180] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0040.180] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0040.180] GetCurrentObject (hdc=0x360109d2, type=0x1) returned 0x1b00017 [0040.180] GetCurrentObject (hdc=0x360109d2, type=0x2) returned 0x1900010 [0040.180] GetCurrentObject (hdc=0x360109d2, type=0x7) returned 0x290509d7 [0040.180] GetCurrentObject (hdc=0x360109d2, type=0x6) returned 0x18a002e [0040.180] SaveDC (hdc=0x360109d2) returned 1 [0040.180] GetTextAlign (hdc=0x360109d2) returned 0x0 [0040.180] GetTextColor (hdc=0x360109d2) returned 0x0 [0040.180] SetTextColor (hdc=0x360109d2, color=0xf0f0f0) returned 0x0 [0040.180] GetCurrentObject (hdc=0x360109d2, type=0x6) returned 0x18a002e [0040.180] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0040.180] SelectObject (hdc=0x360109d2, h=0x260a09ba) returned 0x18a002e [0040.180] GetBkMode (hdc=0x360109d2) returned 2 [0040.180] SetBkMode (hdc=0x360109d2, mode=1) returned 2 [0040.180] DrawTextExW (in: hdc=0x360109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x278ad98 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0040.181] DrawTextExW (in: hdc=0x360109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x278ad98 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0040.181] RestoreDC (hdc=0x360109d2, nSavedDC=-1) returned 1 [0040.181] GdipReleaseDC (graphics=0x1b86d040, hdc=0x360109d2) returned 0x0 [0040.181] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0040.181] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x360109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0040.181] GdipReleaseDC (graphics=0x1b86d040, hdc=0x360109d2) returned 0x0 [0040.182] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0040.182] SelectObject (hdc=0x360109d2, h=0x185000f) returned 0x290509d7 [0040.182] DeleteDC (hdc=0x360109d2) returned 1 [0040.182] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0040.182] DeleteObject (ho=0x290509d7) returned 1 [0040.185] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0040.185] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.185] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.185] WaitMessage () returned 1 [0040.309] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.309] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.309] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.309] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.309] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.309] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0040.309] GetCurrentThreadId () returned 0xa28 [0040.309] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0040.309] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.309] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.309] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.309] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.309] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.309] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0040.309] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0040.309] CreateCompatibleDC (hdc=0x60109d6) returned 0x680109c0 [0040.310] GetObjectType (h=0x60109d6) returned 0x3 [0040.310] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x2a0509d7 [0040.310] GetDIBits (in: hdc=0x60109d6, hbm=0x2a0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.310] GetDIBits (in: hdc=0x60109d6, hbm=0x2a0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.310] DeleteObject (ho=0x2a0509d7) returned 1 [0040.310] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x370509d2 [0040.310] SelectObject (hdc=0x680109c0, h=0x370509d2) returned 0x185000f [0040.310] GdipCreateFromHDC (hdc=0x680109c0, graphics=0x26e408) returned 0x0 [0040.310] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0040.310] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0040.310] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0040.310] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0040.311] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0040.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4620 [0040.311] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4620) returned 0x0 [0040.311] LocalFree (hMem=0x1a7d4620) returned 0x0 [0040.311] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0040.311] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0040.311] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0040.311] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0040.311] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0040.311] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.311] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.311] GetSystemMetrics (nIndex=42) returned 0 [0040.311] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.311] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.311] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0040.311] IsAppThemed () returned 0x1 [0040.311] GetThemeAppProperties () returned 0x3 [0040.311] GetThemeAppProperties () returned 0x3 [0040.311] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0040.311] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0040.311] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0040.311] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0040.311] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0040.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4620 [0040.311] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4620) returned 0x0 [0040.311] LocalFree (hMem=0x1a7d4620) returned 0x0 [0040.311] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0040.311] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4620 [0040.312] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4620) returned 0x0 [0040.312] LocalFree (hMem=0x1a7d4620) returned 0x0 [0040.312] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0040.312] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0040.312] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0040.312] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0040.312] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0040.312] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0040.312] GetCurrentObject (hdc=0x680109c0, type=0x1) returned 0x1b00017 [0040.312] GetCurrentObject (hdc=0x680109c0, type=0x2) returned 0x1900010 [0040.312] GetCurrentObject (hdc=0x680109c0, type=0x7) returned 0x370509d2 [0040.312] GetCurrentObject (hdc=0x680109c0, type=0x6) returned 0x18a002e [0040.312] SaveDC (hdc=0x680109c0) returned 1 [0040.312] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3f0409f1 [0040.312] GetClipRgn (hdc=0x680109c0, hrgn=0x3f0409f1) returned 0 [0040.312] SelectClipRgn (hdc=0x680109c0, hrgn=0x660409ff) returned 2 [0040.312] DeleteObject (ho=0x3f0409f1) returned 1 [0040.312] DeleteObject (ho=0x660409ff) returned 1 [0040.312] OffsetViewportOrgEx (in: hdc=0x680109c0, x=0, y=0, lppt=0x278c978 | out: lppt=0x278c978) returned 1 [0040.312] OffsetViewportOrgEx (in: hdc=0x680109c0, x=-417, y=-278, lppt=0x278c990 | out: lppt=0x278c990) returned 1 [0040.312] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0040.312] GetCurrentObject (hdc=0x680109c0, type=0x1) returned 0x1b00017 [0040.312] GetCurrentObject (hdc=0x680109c0, type=0x2) returned 0x1900010 [0040.312] GetCurrentObject (hdc=0x680109c0, type=0x7) returned 0x370509d2 [0040.312] GetCurrentObject (hdc=0x680109c0, type=0x6) returned 0x18a002e [0040.312] SaveDC (hdc=0x680109c0) returned 2 [0040.312] GetNearestColor (hdc=0x680109c0, color=0x6c4607) returned 0x6c4607 [0040.312] CreateSolidBrush (color=0x6c4607) returned 0x58100276 [0040.313] FillRect (hDC=0x680109c0, lprc=0x26de08, hbr=0x58100276) returned 1 [0040.319] DeleteObject (ho=0x58100276) returned 1 [0040.319] RestoreDC (hdc=0x680109c0, nSavedDC=-1) returned 1 [0040.319] RestoreDC (hdc=0x680109c0, nSavedDC=-1) returned 1 [0040.319] GdipReleaseDC (graphics=0x1b86d040, hdc=0x680109c0) returned 0x0 [0040.319] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd860dbd) returned 0x0 [0040.319] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0040.319] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.319] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.319] GetSystemMetrics (nIndex=42) returned 0 [0040.319] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.319] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.319] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1a) returned 0x0 [0040.320] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0040.320] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0040.320] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0040.320] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0040.320] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0040.320] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0040.320] GetCurrentObject (hdc=0x680109c0, type=0x1) returned 0x1b00017 [0040.320] GetCurrentObject (hdc=0x680109c0, type=0x2) returned 0x1900010 [0040.320] GetCurrentObject (hdc=0x680109c0, type=0x7) returned 0x370509d2 [0040.320] GetCurrentObject (hdc=0x680109c0, type=0x6) returned 0x18a002e [0040.320] SaveDC (hdc=0x680109c0) returned 1 [0040.320] GetNearestColor (hdc=0x680109c0, color=0xf0f0f0) returned 0xf0f0f0 [0040.320] RestoreDC (hdc=0x680109c0, nSavedDC=-1) returned 1 [0040.321] GdipReleaseDC (graphics=0x1b86d040, hdc=0x680109c0) returned 0x0 [0040.321] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0040.321] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0040.321] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0040.321] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0040.321] GetCurrentObject (hdc=0x680109c0, type=0x1) returned 0x1b00017 [0040.321] GetCurrentObject (hdc=0x680109c0, type=0x2) returned 0x1900010 [0040.321] GetCurrentObject (hdc=0x680109c0, type=0x7) returned 0x370509d2 [0040.321] GetCurrentObject (hdc=0x680109c0, type=0x6) returned 0x18a002e [0040.321] SaveDC (hdc=0x680109c0) returned 1 [0040.321] GetTextAlign (hdc=0x680109c0) returned 0x0 [0040.321] GetTextColor (hdc=0x680109c0) returned 0x0 [0040.321] SetTextColor (hdc=0x680109c0, color=0xf0f0f0) returned 0x0 [0040.321] GetCurrentObject (hdc=0x680109c0, type=0x6) returned 0x18a002e [0040.321] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0040.321] SelectObject (hdc=0x680109c0, h=0x260a09ba) returned 0x18a002e [0040.321] GetBkMode (hdc=0x680109c0) returned 2 [0040.321] SetBkMode (hdc=0x680109c0, mode=1) returned 2 [0040.321] DrawTextExW (in: hdc=0x680109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x278d898 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0040.322] DrawTextExW (in: hdc=0x680109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x278d898 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0040.322] RestoreDC (hdc=0x680109c0, nSavedDC=-1) returned 1 [0040.322] GdipReleaseDC (graphics=0x1b86d040, hdc=0x680109c0) returned 0x0 [0040.322] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0040.322] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x680109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0040.322] GdipReleaseDC (graphics=0x1b86d040, hdc=0x680109c0) returned 0x0 [0040.322] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0040.322] SelectObject (hdc=0x680109c0, h=0x185000f) returned 0x370509d2 [0040.322] DeleteDC (hdc=0x680109c0) returned 1 [0040.323] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0040.323] DeleteObject (ho=0x370509d2) returned 1 [0040.326] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0040.326] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.326] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.326] WaitMessage () returned 1 [0040.480] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.480] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.480] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.480] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.480] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.480] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0040.480] GetCurrentThreadId () returned 0xa28 [0040.480] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0040.480] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.480] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.480] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.480] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.480] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.481] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0040.481] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0040.481] CreateCompatibleDC (hdc=0x60109d6) returned 0x2c0109d7 [0040.481] GetObjectType (h=0x60109d6) returned 0x3 [0040.481] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x380509d2 [0040.481] GetDIBits (in: hdc=0x60109d6, hbm=0x380509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.481] GetDIBits (in: hdc=0x60109d6, hbm=0x380509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.481] DeleteObject (ho=0x380509d2) returned 1 [0040.481] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x690509c0 [0040.481] SelectObject (hdc=0x2c0109d7, h=0x690509c0) returned 0x185000f [0040.481] GdipCreateFromHDC (hdc=0x2c0109d7, graphics=0x26e408) returned 0x0 [0040.482] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0040.482] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0040.482] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0040.482] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0040.482] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0040.482] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d46a0 [0040.482] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d46a0) returned 0x0 [0040.482] LocalFree (hMem=0x1a7d46a0) returned 0x0 [0040.482] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0040.482] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0040.482] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0040.482] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0040.482] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0040.482] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.482] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.482] GetSystemMetrics (nIndex=42) returned 0 [0040.482] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.482] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.482] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0040.482] IsAppThemed () returned 0x1 [0040.482] GetThemeAppProperties () returned 0x3 [0040.482] GetThemeAppProperties () returned 0x3 [0040.482] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0040.482] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0040.483] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0040.483] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0040.483] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0040.483] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d46a0 [0040.483] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d46a0) returned 0x0 [0040.483] LocalFree (hMem=0x1a7d46a0) returned 0x0 [0040.483] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0040.483] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d46a0 [0040.483] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d46a0) returned 0x0 [0040.483] LocalFree (hMem=0x1a7d46a0) returned 0x0 [0040.483] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0040.483] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0040.483] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0040.483] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0040.483] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0040.483] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0040.483] GetCurrentObject (hdc=0x2c0109d7, type=0x1) returned 0x1b00017 [0040.483] GetCurrentObject (hdc=0x2c0109d7, type=0x2) returned 0x1900010 [0040.483] GetCurrentObject (hdc=0x2c0109d7, type=0x7) returned 0x690509c0 [0040.483] GetCurrentObject (hdc=0x2c0109d7, type=0x6) returned 0x18a002e [0040.483] SaveDC (hdc=0x2c0109d7) returned 1 [0040.483] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x670409ff [0040.483] GetClipRgn (hdc=0x2c0109d7, hrgn=0x670409ff) returned 0 [0040.483] SelectClipRgn (hdc=0x2c0109d7, hrgn=0x420409f1) returned 2 [0040.483] DeleteObject (ho=0x670409ff) returned 1 [0040.483] DeleteObject (ho=0x420409f1) returned 1 [0040.483] OffsetViewportOrgEx (in: hdc=0x2c0109d7, x=0, y=0, lppt=0x278f478 | out: lppt=0x278f478) returned 1 [0040.483] OffsetViewportOrgEx (in: hdc=0x2c0109d7, x=-417, y=-278, lppt=0x278f490 | out: lppt=0x278f490) returned 1 [0040.484] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0040.484] GetCurrentObject (hdc=0x2c0109d7, type=0x1) returned 0x1b00017 [0040.484] GetCurrentObject (hdc=0x2c0109d7, type=0x2) returned 0x1900010 [0040.484] GetCurrentObject (hdc=0x2c0109d7, type=0x7) returned 0x690509c0 [0040.484] GetCurrentObject (hdc=0x2c0109d7, type=0x6) returned 0x18a002e [0040.484] SaveDC (hdc=0x2c0109d7) returned 2 [0040.484] GetNearestColor (hdc=0x2c0109d7, color=0x6c4607) returned 0x6c4607 [0040.484] CreateSolidBrush (color=0x6c4607) returned 0x59100276 [0040.484] FillRect (hDC=0x2c0109d7, lprc=0x26de08, hbr=0x59100276) returned 1 [0040.490] DeleteObject (ho=0x59100276) returned 1 [0040.490] RestoreDC (hdc=0x2c0109d7, nSavedDC=-1) returned 1 [0040.490] RestoreDC (hdc=0x2c0109d7, nSavedDC=-1) returned 1 [0040.490] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2c0109d7) returned 0x0 [0040.490] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd840dbd) returned 0x0 [0040.490] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0040.490] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.490] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.490] GetSystemMetrics (nIndex=42) returned 0 [0040.490] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.490] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.491] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0040.491] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0040.491] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0040.491] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0040.491] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0040.491] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0040.491] GetCurrentObject (hdc=0x2c0109d7, type=0x1) returned 0x1b00017 [0040.491] GetCurrentObject (hdc=0x2c0109d7, type=0x2) returned 0x1900010 [0040.491] GetCurrentObject (hdc=0x2c0109d7, type=0x7) returned 0x690509c0 [0040.491] GetCurrentObject (hdc=0x2c0109d7, type=0x6) returned 0x18a002e [0040.491] SaveDC (hdc=0x2c0109d7) returned 1 [0040.491] GetNearestColor (hdc=0x2c0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0040.491] RestoreDC (hdc=0x2c0109d7, nSavedDC=-1) returned 1 [0040.491] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2c0109d7) returned 0x0 [0040.491] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0040.491] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0040.491] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0040.491] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0040.491] GetCurrentObject (hdc=0x2c0109d7, type=0x1) returned 0x1b00017 [0040.491] GetCurrentObject (hdc=0x2c0109d7, type=0x2) returned 0x1900010 [0040.492] GetCurrentObject (hdc=0x2c0109d7, type=0x7) returned 0x690509c0 [0040.492] GetCurrentObject (hdc=0x2c0109d7, type=0x6) returned 0x18a002e [0040.492] SaveDC (hdc=0x2c0109d7) returned 1 [0040.492] GetTextAlign (hdc=0x2c0109d7) returned 0x0 [0040.492] GetTextColor (hdc=0x2c0109d7) returned 0x0 [0040.492] SetTextColor (hdc=0x2c0109d7, color=0xf0f0f0) returned 0x0 [0040.492] GetCurrentObject (hdc=0x2c0109d7, type=0x6) returned 0x18a002e [0040.492] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0040.492] SelectObject (hdc=0x2c0109d7, h=0x260a09ba) returned 0x18a002e [0040.492] GetBkMode (hdc=0x2c0109d7) returned 2 [0040.492] SetBkMode (hdc=0x2c0109d7, mode=1) returned 2 [0040.492] DrawTextExW (in: hdc=0x2c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2790140 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0040.492] DrawTextExW (in: hdc=0x2c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2790140 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0040.493] RestoreDC (hdc=0x2c0109d7, nSavedDC=-1) returned 1 [0040.493] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2c0109d7) returned 0x0 [0040.493] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0040.493] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x2c0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0040.493] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2c0109d7) returned 0x0 [0040.493] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0040.493] SelectObject (hdc=0x2c0109d7, h=0x185000f) returned 0x690509c0 [0040.493] DeleteDC (hdc=0x2c0109d7) returned 1 [0040.493] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0040.493] DeleteObject (ho=0x690509c0) returned 1 [0040.497] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0040.497] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.497] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.497] WaitMessage () returned 1 [0040.621] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.621] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.621] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.621] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.621] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.621] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0040.621] GetCurrentThreadId () returned 0xa28 [0040.621] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0040.621] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.621] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.621] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.621] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.621] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.621] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0040.621] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0040.621] CreateCompatibleDC (hdc=0x60109d6) returned 0x3a0109d2 [0040.621] GetObjectType (h=0x60109d6) returned 0x3 [0040.621] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x6a0509c0 [0040.622] GetDIBits (in: hdc=0x60109d6, hbm=0x6a0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.622] GetDIBits (in: hdc=0x60109d6, hbm=0x6a0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.622] DeleteObject (ho=0x6a0509c0) returned 1 [0040.622] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x2d0509d7 [0040.622] SelectObject (hdc=0x3a0109d2, h=0x2d0509d7) returned 0x185000f [0040.622] GdipCreateFromHDC (hdc=0x3a0109d2, graphics=0x26e408) returned 0x0 [0040.622] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0040.622] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0040.622] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0040.622] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0040.622] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0040.622] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d46a0 [0040.622] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d46a0) returned 0x0 [0040.622] LocalFree (hMem=0x1a7d46a0) returned 0x0 [0040.623] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0040.623] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0040.623] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0040.623] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0040.623] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0040.623] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.623] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.623] GetSystemMetrics (nIndex=42) returned 0 [0040.623] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.623] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.623] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0040.623] IsAppThemed () returned 0x1 [0040.623] GetThemeAppProperties () returned 0x3 [0040.623] GetThemeAppProperties () returned 0x3 [0040.623] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0040.623] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0040.623] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0040.623] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0040.623] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0040.623] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d46a0 [0040.623] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d46a0) returned 0x0 [0040.623] LocalFree (hMem=0x1a7d46a0) returned 0x0 [0040.623] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0040.623] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d46a0 [0040.623] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d46a0) returned 0x0 [0040.623] LocalFree (hMem=0x1a7d46a0) returned 0x0 [0040.623] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0040.623] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0040.623] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0040.623] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0040.624] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0040.624] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0040.624] GetCurrentObject (hdc=0x3a0109d2, type=0x1) returned 0x1b00017 [0040.624] GetCurrentObject (hdc=0x3a0109d2, type=0x2) returned 0x1900010 [0040.624] GetCurrentObject (hdc=0x3a0109d2, type=0x7) returned 0x2d0509d7 [0040.624] GetCurrentObject (hdc=0x3a0109d2, type=0x6) returned 0x18a002e [0040.624] SaveDC (hdc=0x3a0109d2) returned 1 [0040.624] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x430409f1 [0040.624] GetClipRgn (hdc=0x3a0109d2, hrgn=0x430409f1) returned 0 [0040.624] SelectClipRgn (hdc=0x3a0109d2, hrgn=0x6a0409ff) returned 2 [0040.624] DeleteObject (ho=0x430409f1) returned 1 [0040.624] DeleteObject (ho=0x6a0409ff) returned 1 [0040.624] OffsetViewportOrgEx (in: hdc=0x3a0109d2, x=0, y=0, lppt=0x2791d20 | out: lppt=0x2791d20) returned 1 [0040.624] OffsetViewportOrgEx (in: hdc=0x3a0109d2, x=-417, y=-278, lppt=0x2791d38 | out: lppt=0x2791d38) returned 1 [0040.624] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0040.624] GetCurrentObject (hdc=0x3a0109d2, type=0x1) returned 0x1b00017 [0040.624] GetCurrentObject (hdc=0x3a0109d2, type=0x2) returned 0x1900010 [0040.624] GetCurrentObject (hdc=0x3a0109d2, type=0x7) returned 0x2d0509d7 [0040.624] GetCurrentObject (hdc=0x3a0109d2, type=0x6) returned 0x18a002e [0040.624] SaveDC (hdc=0x3a0109d2) returned 2 [0040.624] GetNearestColor (hdc=0x3a0109d2, color=0x6c4607) returned 0x6c4607 [0040.624] CreateSolidBrush (color=0x6c4607) returned 0x5a100276 [0040.624] FillRect (hDC=0x3a0109d2, lprc=0x26de08, hbr=0x5a100276) returned 1 [0040.630] DeleteObject (ho=0x5a100276) returned 1 [0040.630] RestoreDC (hdc=0x3a0109d2, nSavedDC=-1) returned 1 [0040.630] RestoreDC (hdc=0x3a0109d2, nSavedDC=-1) returned 1 [0040.631] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3a0109d2) returned 0x0 [0040.631] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd820dbd) returned 0x0 [0040.631] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0040.631] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.631] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.631] GetSystemMetrics (nIndex=42) returned 0 [0040.631] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.631] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.631] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1c) returned 0x0 [0040.632] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0040.632] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0040.632] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0040.632] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0040.632] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0040.632] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0040.632] GetCurrentObject (hdc=0x3a0109d2, type=0x1) returned 0x1b00017 [0040.632] GetCurrentObject (hdc=0x3a0109d2, type=0x2) returned 0x1900010 [0040.632] GetCurrentObject (hdc=0x3a0109d2, type=0x7) returned 0x2d0509d7 [0040.632] GetCurrentObject (hdc=0x3a0109d2, type=0x6) returned 0x18a002e [0040.632] SaveDC (hdc=0x3a0109d2) returned 1 [0040.632] GetNearestColor (hdc=0x3a0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0040.633] RestoreDC (hdc=0x3a0109d2, nSavedDC=-1) returned 1 [0040.633] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3a0109d2) returned 0x0 [0040.633] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0040.633] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0040.633] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0040.633] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0040.633] GetCurrentObject (hdc=0x3a0109d2, type=0x1) returned 0x1b00017 [0040.633] GetCurrentObject (hdc=0x3a0109d2, type=0x2) returned 0x1900010 [0040.633] GetCurrentObject (hdc=0x3a0109d2, type=0x7) returned 0x2d0509d7 [0040.633] GetCurrentObject (hdc=0x3a0109d2, type=0x6) returned 0x18a002e [0040.633] SaveDC (hdc=0x3a0109d2) returned 1 [0040.633] GetTextAlign (hdc=0x3a0109d2) returned 0x0 [0040.633] GetTextColor (hdc=0x3a0109d2) returned 0x0 [0040.633] SetTextColor (hdc=0x3a0109d2, color=0xf0f0f0) returned 0x0 [0040.633] GetCurrentObject (hdc=0x3a0109d2, type=0x6) returned 0x18a002e [0040.633] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0040.633] SelectObject (hdc=0x3a0109d2, h=0x260a09ba) returned 0x18a002e [0040.633] GetBkMode (hdc=0x3a0109d2) returned 2 [0040.633] SetBkMode (hdc=0x3a0109d2, mode=1) returned 2 [0040.633] DrawTextExW (in: hdc=0x3a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2792c48 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0040.634] DrawTextExW (in: hdc=0x3a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2792c48 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0040.634] RestoreDC (hdc=0x3a0109d2, nSavedDC=-1) returned 1 [0040.634] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3a0109d2) returned 0x0 [0040.634] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0040.634] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x3a0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0040.634] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3a0109d2) returned 0x0 [0040.634] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0040.634] SelectObject (hdc=0x3a0109d2, h=0x185000f) returned 0x2d0509d7 [0040.635] DeleteDC (hdc=0x3a0109d2) returned 1 [0040.635] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0040.635] DeleteObject (ho=0x2d0509d7) returned 1 [0040.639] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0040.639] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.639] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.639] WaitMessage () returned 1 [0040.769] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.769] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.769] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.769] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.769] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.769] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0040.769] GetCurrentThreadId () returned 0xa28 [0040.769] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0040.769] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.769] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.769] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.769] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.769] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.769] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0040.769] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0040.769] CreateCompatibleDC (hdc=0x60109d6) returned 0x6c0109c0 [0040.769] GetObjectType (h=0x60109d6) returned 0x3 [0040.769] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x2e0509d7 [0040.769] GetDIBits (in: hdc=0x60109d6, hbm=0x2e0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.769] GetDIBits (in: hdc=0x60109d6, hbm=0x2e0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.769] DeleteObject (ho=0x2e0509d7) returned 1 [0040.770] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x3b0509d2 [0040.770] SelectObject (hdc=0x6c0109c0, h=0x3b0509d2) returned 0x185000f [0040.770] GdipCreateFromHDC (hdc=0x6c0109c0, graphics=0x26e408) returned 0x0 [0040.770] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0040.770] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0040.770] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0040.770] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0040.770] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0040.770] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4720 [0040.770] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4720) returned 0x0 [0040.770] LocalFree (hMem=0x1a7d4720) returned 0x0 [0040.770] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0040.770] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0040.770] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0040.770] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0040.770] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0040.771] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.771] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.771] GetSystemMetrics (nIndex=42) returned 0 [0040.771] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.771] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.771] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0040.771] IsAppThemed () returned 0x1 [0040.771] GetThemeAppProperties () returned 0x3 [0040.771] GetThemeAppProperties () returned 0x3 [0040.771] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0040.771] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0040.771] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0040.771] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0040.771] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0040.771] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4720 [0040.771] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4720) returned 0x0 [0040.771] LocalFree (hMem=0x1a7d4720) returned 0x0 [0040.771] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0040.771] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4720 [0040.771] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4720) returned 0x0 [0040.771] LocalFree (hMem=0x1a7d4720) returned 0x0 [0040.771] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0040.771] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0040.771] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0040.771] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0040.771] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0040.771] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0040.771] GetCurrentObject (hdc=0x6c0109c0, type=0x1) returned 0x1b00017 [0040.771] GetCurrentObject (hdc=0x6c0109c0, type=0x2) returned 0x1900010 [0040.771] GetCurrentObject (hdc=0x6c0109c0, type=0x7) returned 0x3b0509d2 [0040.772] GetCurrentObject (hdc=0x6c0109c0, type=0x6) returned 0x18a002e [0040.772] SaveDC (hdc=0x6c0109c0) returned 1 [0040.772] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b0409ff [0040.772] GetClipRgn (hdc=0x6c0109c0, hrgn=0x6b0409ff) returned 0 [0040.772] SelectClipRgn (hdc=0x6c0109c0, hrgn=0x460409f1) returned 2 [0040.772] DeleteObject (ho=0x6b0409ff) returned 1 [0040.772] DeleteObject (ho=0x460409f1) returned 1 [0040.772] OffsetViewportOrgEx (in: hdc=0x6c0109c0, x=0, y=0, lppt=0x2794828 | out: lppt=0x2794828) returned 1 [0040.772] OffsetViewportOrgEx (in: hdc=0x6c0109c0, x=-417, y=-278, lppt=0x2794840 | out: lppt=0x2794840) returned 1 [0040.772] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0040.772] GetCurrentObject (hdc=0x6c0109c0, type=0x1) returned 0x1b00017 [0040.772] GetCurrentObject (hdc=0x6c0109c0, type=0x2) returned 0x1900010 [0040.772] GetCurrentObject (hdc=0x6c0109c0, type=0x7) returned 0x3b0509d2 [0040.772] GetCurrentObject (hdc=0x6c0109c0, type=0x6) returned 0x18a002e [0040.772] SaveDC (hdc=0x6c0109c0) returned 2 [0040.772] GetNearestColor (hdc=0x6c0109c0, color=0x6c4607) returned 0x6c4607 [0040.772] CreateSolidBrush (color=0x6c4607) returned 0x5b100276 [0040.772] FillRect (hDC=0x6c0109c0, lprc=0x26de08, hbr=0x5b100276) returned 1 [0040.778] DeleteObject (ho=0x5b100276) returned 1 [0040.778] RestoreDC (hdc=0x6c0109c0, nSavedDC=-1) returned 1 [0040.778] RestoreDC (hdc=0x6c0109c0, nSavedDC=-1) returned 1 [0040.779] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6c0109c0) returned 0x0 [0040.779] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd800dbd) returned 0x0 [0040.779] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0040.779] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.779] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.779] GetSystemMetrics (nIndex=42) returned 0 [0040.779] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.779] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.779] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0040.779] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0040.779] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0040.779] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0040.779] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0040.779] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0040.779] GetCurrentObject (hdc=0x6c0109c0, type=0x1) returned 0x1b00017 [0040.779] GetCurrentObject (hdc=0x6c0109c0, type=0x2) returned 0x1900010 [0040.779] GetCurrentObject (hdc=0x6c0109c0, type=0x7) returned 0x3b0509d2 [0040.779] GetCurrentObject (hdc=0x6c0109c0, type=0x6) returned 0x18a002e [0040.779] SaveDC (hdc=0x6c0109c0) returned 1 [0040.779] GetNearestColor (hdc=0x6c0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0040.779] RestoreDC (hdc=0x6c0109c0, nSavedDC=-1) returned 1 [0040.779] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6c0109c0) returned 0x0 [0040.780] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0040.780] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0040.780] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0040.780] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0040.780] GetCurrentObject (hdc=0x6c0109c0, type=0x1) returned 0x1b00017 [0040.780] GetCurrentObject (hdc=0x6c0109c0, type=0x2) returned 0x1900010 [0040.780] GetCurrentObject (hdc=0x6c0109c0, type=0x7) returned 0x3b0509d2 [0040.780] GetCurrentObject (hdc=0x6c0109c0, type=0x6) returned 0x18a002e [0040.780] SaveDC (hdc=0x6c0109c0) returned 1 [0040.780] GetTextAlign (hdc=0x6c0109c0) returned 0x0 [0040.780] GetTextColor (hdc=0x6c0109c0) returned 0x0 [0040.780] SetTextColor (hdc=0x6c0109c0, color=0xf0f0f0) returned 0x0 [0040.780] GetCurrentObject (hdc=0x6c0109c0, type=0x6) returned 0x18a002e [0040.780] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0040.780] SelectObject (hdc=0x6c0109c0, h=0x260a09ba) returned 0x18a002e [0040.780] GetBkMode (hdc=0x6c0109c0) returned 2 [0040.780] SetBkMode (hdc=0x6c0109c0, mode=1) returned 2 [0040.780] DrawTextExW (in: hdc=0x6c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27954f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0040.780] DrawTextExW (in: hdc=0x6c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27954f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0040.781] RestoreDC (hdc=0x6c0109c0, nSavedDC=-1) returned 1 [0040.781] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6c0109c0) returned 0x0 [0040.781] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0040.781] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x6c0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0040.781] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6c0109c0) returned 0x0 [0040.781] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0040.781] SelectObject (hdc=0x6c0109c0, h=0x185000f) returned 0x3b0509d2 [0040.781] DeleteDC (hdc=0x6c0109c0) returned 1 [0040.781] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0040.781] DeleteObject (ho=0x3b0509d2) returned 1 [0040.785] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0040.785] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.785] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.785] WaitMessage () returned 1 [0040.901] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.901] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.901] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.901] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.901] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.902] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0040.902] GetCurrentThreadId () returned 0xa28 [0040.902] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0040.902] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.902] IsWindowUnicode (hWnd=0x3015e) returned 1 [0040.902] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0040.902] TranslateMessage (lpMsg=0x26ee10) returned 0 [0040.902] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0040.902] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0040.902] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0040.902] CreateCompatibleDC (hdc=0x60109d6) returned 0x300109d7 [0040.902] GetObjectType (h=0x60109d6) returned 0x3 [0040.902] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x3c0509d2 [0040.902] GetDIBits (in: hdc=0x60109d6, hbm=0x3c0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.902] GetDIBits (in: hdc=0x60109d6, hbm=0x3c0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0040.902] DeleteObject (ho=0x3c0509d2) returned 1 [0040.902] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x6d0509c0 [0040.903] SelectObject (hdc=0x300109d7, h=0x6d0509c0) returned 0x185000f [0040.903] GdipCreateFromHDC (hdc=0x300109d7, graphics=0x26e408) returned 0x0 [0040.903] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0040.903] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0040.903] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0040.903] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0040.903] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0040.903] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4720 [0040.903] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4720) returned 0x0 [0040.903] LocalFree (hMem=0x1a7d4720) returned 0x0 [0040.903] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0040.903] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0040.903] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0040.903] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0040.903] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0040.903] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.903] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.903] GetSystemMetrics (nIndex=42) returned 0 [0040.903] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.903] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.904] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0040.904] IsAppThemed () returned 0x1 [0040.904] GetThemeAppProperties () returned 0x3 [0040.904] GetThemeAppProperties () returned 0x3 [0040.904] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0040.904] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0040.904] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0040.904] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0040.904] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0040.904] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4720 [0040.904] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4720) returned 0x0 [0040.904] LocalFree (hMem=0x1a7d4720) returned 0x0 [0040.904] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0040.904] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4720 [0040.904] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4720) returned 0x0 [0040.904] LocalFree (hMem=0x1a7d4720) returned 0x0 [0040.904] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0040.904] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0040.904] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0040.904] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0040.904] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0040.904] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0040.904] GetCurrentObject (hdc=0x300109d7, type=0x1) returned 0x1b00017 [0040.904] GetCurrentObject (hdc=0x300109d7, type=0x2) returned 0x1900010 [0040.904] GetCurrentObject (hdc=0x300109d7, type=0x7) returned 0x6d0509c0 [0040.904] GetCurrentObject (hdc=0x300109d7, type=0x6) returned 0x18a002e [0040.904] SaveDC (hdc=0x300109d7) returned 1 [0040.904] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x470409f1 [0040.904] GetClipRgn (hdc=0x300109d7, hrgn=0x470409f1) returned 0 [0040.905] SelectClipRgn (hdc=0x300109d7, hrgn=0x6e0409ff) returned 2 [0040.905] DeleteObject (ho=0x470409f1) returned 1 [0040.905] DeleteObject (ho=0x6e0409ff) returned 1 [0040.905] OffsetViewportOrgEx (in: hdc=0x300109d7, x=0, y=0, lppt=0x27970d0 | out: lppt=0x27970d0) returned 1 [0040.905] OffsetViewportOrgEx (in: hdc=0x300109d7, x=-417, y=-278, lppt=0x27970e8 | out: lppt=0x27970e8) returned 1 [0040.905] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0040.905] GetCurrentObject (hdc=0x300109d7, type=0x1) returned 0x1b00017 [0040.905] GetCurrentObject (hdc=0x300109d7, type=0x2) returned 0x1900010 [0040.905] GetCurrentObject (hdc=0x300109d7, type=0x7) returned 0x6d0509c0 [0040.905] GetCurrentObject (hdc=0x300109d7, type=0x6) returned 0x18a002e [0040.905] SaveDC (hdc=0x300109d7) returned 2 [0040.905] GetNearestColor (hdc=0x300109d7, color=0x6c4607) returned 0x6c4607 [0040.905] CreateSolidBrush (color=0x6c4607) returned 0x5c100276 [0040.905] FillRect (hDC=0x300109d7, lprc=0x26de08, hbr=0x5c100276) returned 1 [0040.911] DeleteObject (ho=0x5c100276) returned 1 [0040.911] RestoreDC (hdc=0x300109d7, nSavedDC=-1) returned 1 [0040.911] RestoreDC (hdc=0x300109d7, nSavedDC=-1) returned 1 [0040.911] GdipReleaseDC (graphics=0x1b86d040, hdc=0x300109d7) returned 0x0 [0040.911] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd7e0dbd) returned 0x0 [0040.911] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0040.911] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0040.911] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0040.912] GetSystemMetrics (nIndex=42) returned 0 [0040.912] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0040.912] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0040.912] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1e) returned 0x0 [0040.913] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0040.913] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0040.913] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0040.913] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0040.913] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0040.913] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0040.913] GetCurrentObject (hdc=0x300109d7, type=0x1) returned 0x1b00017 [0040.913] GetCurrentObject (hdc=0x300109d7, type=0x2) returned 0x1900010 [0040.913] GetCurrentObject (hdc=0x300109d7, type=0x7) returned 0x6d0509c0 [0040.913] GetCurrentObject (hdc=0x300109d7, type=0x6) returned 0x18a002e [0040.913] SaveDC (hdc=0x300109d7) returned 1 [0040.913] GetNearestColor (hdc=0x300109d7, color=0xf0f0f0) returned 0xf0f0f0 [0040.913] RestoreDC (hdc=0x300109d7, nSavedDC=-1) returned 1 [0040.913] GdipReleaseDC (graphics=0x1b86d040, hdc=0x300109d7) returned 0x0 [0040.913] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0040.913] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0040.913] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0040.913] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0040.913] GetCurrentObject (hdc=0x300109d7, type=0x1) returned 0x1b00017 [0040.913] GetCurrentObject (hdc=0x300109d7, type=0x2) returned 0x1900010 [0040.913] GetCurrentObject (hdc=0x300109d7, type=0x7) returned 0x6d0509c0 [0040.914] GetCurrentObject (hdc=0x300109d7, type=0x6) returned 0x18a002e [0040.914] SaveDC (hdc=0x300109d7) returned 1 [0040.914] GetTextAlign (hdc=0x300109d7) returned 0x0 [0040.914] GetTextColor (hdc=0x300109d7) returned 0x0 [0040.914] SetTextColor (hdc=0x300109d7, color=0xf0f0f0) returned 0x0 [0040.914] GetCurrentObject (hdc=0x300109d7, type=0x6) returned 0x18a002e [0040.914] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0040.914] SelectObject (hdc=0x300109d7, h=0x260a09ba) returned 0x18a002e [0040.914] GetBkMode (hdc=0x300109d7) returned 2 [0040.914] SetBkMode (hdc=0x300109d7, mode=1) returned 2 [0040.914] DrawTextExW (in: hdc=0x300109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2797ff0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0040.914] DrawTextExW (in: hdc=0x300109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2797ff0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0040.915] RestoreDC (hdc=0x300109d7, nSavedDC=-1) returned 1 [0040.915] GdipReleaseDC (graphics=0x1b86d040, hdc=0x300109d7) returned 0x0 [0040.915] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0040.915] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x300109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0040.915] GdipReleaseDC (graphics=0x1b86d040, hdc=0x300109d7) returned 0x0 [0040.915] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0040.915] SelectObject (hdc=0x300109d7, h=0x185000f) returned 0x6d0509c0 [0040.915] DeleteDC (hdc=0x300109d7) returned 1 [0040.915] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0040.915] DeleteObject (ho=0x6d0509c0) returned 1 [0040.918] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0040.918] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.919] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0040.919] WaitMessage () returned 1 [0041.042] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.042] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.042] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.042] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.042] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.042] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0041.042] GetCurrentThreadId () returned 0xa28 [0041.042] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0041.042] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.042] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.042] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.042] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.042] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.042] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0041.042] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0041.042] CreateCompatibleDC (hdc=0x60109d6) returned 0x3e0109d2 [0041.042] GetObjectType (h=0x60109d6) returned 0x3 [0041.042] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x6e0509c0 [0041.042] GetDIBits (in: hdc=0x60109d6, hbm=0x6e0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.043] GetDIBits (in: hdc=0x60109d6, hbm=0x6e0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.043] DeleteObject (ho=0x6e0509c0) returned 1 [0041.043] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x310509d7 [0041.043] SelectObject (hdc=0x3e0109d2, h=0x310509d7) returned 0x185000f [0041.043] GdipCreateFromHDC (hdc=0x3e0109d2, graphics=0x26e408) returned 0x0 [0041.043] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0041.043] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0041.043] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0041.043] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0041.043] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0041.043] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d47a0 [0041.043] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d47a0) returned 0x0 [0041.043] LocalFree (hMem=0x1a7d47a0) returned 0x0 [0041.043] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0041.043] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0041.043] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0041.043] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0041.044] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0041.044] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.044] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.044] GetSystemMetrics (nIndex=42) returned 0 [0041.044] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.044] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.044] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0041.044] IsAppThemed () returned 0x1 [0041.044] GetThemeAppProperties () returned 0x3 [0041.044] GetThemeAppProperties () returned 0x3 [0041.044] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0041.044] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0041.044] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0041.044] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0041.044] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0041.044] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d47a0 [0041.044] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d47a0) returned 0x0 [0041.044] LocalFree (hMem=0x1a7d47a0) returned 0x0 [0041.044] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0041.044] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d47a0 [0041.044] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d47a0) returned 0x0 [0041.044] LocalFree (hMem=0x1a7d47a0) returned 0x0 [0041.044] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0041.044] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0041.044] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0041.044] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0041.044] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0041.044] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0041.044] GetCurrentObject (hdc=0x3e0109d2, type=0x1) returned 0x1b00017 [0041.044] GetCurrentObject (hdc=0x3e0109d2, type=0x2) returned 0x1900010 [0041.044] GetCurrentObject (hdc=0x3e0109d2, type=0x7) returned 0x310509d7 [0041.045] GetCurrentObject (hdc=0x3e0109d2, type=0x6) returned 0x18a002e [0041.045] SaveDC (hdc=0x3e0109d2) returned 1 [0041.045] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6f0409ff [0041.045] GetClipRgn (hdc=0x3e0109d2, hrgn=0x6f0409ff) returned 0 [0041.045] SelectClipRgn (hdc=0x3e0109d2, hrgn=0x4a0409f1) returned 2 [0041.045] DeleteObject (ho=0x6f0409ff) returned 1 [0041.045] DeleteObject (ho=0x4a0409f1) returned 1 [0041.045] OffsetViewportOrgEx (in: hdc=0x3e0109d2, x=0, y=0, lppt=0x2799bd0 | out: lppt=0x2799bd0) returned 1 [0041.045] OffsetViewportOrgEx (in: hdc=0x3e0109d2, x=-417, y=-278, lppt=0x2799be8 | out: lppt=0x2799be8) returned 1 [0041.045] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0041.045] GetCurrentObject (hdc=0x3e0109d2, type=0x1) returned 0x1b00017 [0041.045] GetCurrentObject (hdc=0x3e0109d2, type=0x2) returned 0x1900010 [0041.045] GetCurrentObject (hdc=0x3e0109d2, type=0x7) returned 0x310509d7 [0041.045] GetCurrentObject (hdc=0x3e0109d2, type=0x6) returned 0x18a002e [0041.045] SaveDC (hdc=0x3e0109d2) returned 2 [0041.045] GetNearestColor (hdc=0x3e0109d2, color=0x6c4607) returned 0x6c4607 [0041.045] CreateSolidBrush (color=0x6c4607) returned 0x5d100276 [0041.045] FillRect (hDC=0x3e0109d2, lprc=0x26de08, hbr=0x5d100276) returned 1 [0041.051] DeleteObject (ho=0x5d100276) returned 1 [0041.051] RestoreDC (hdc=0x3e0109d2, nSavedDC=-1) returned 1 [0041.051] RestoreDC (hdc=0x3e0109d2, nSavedDC=-1) returned 1 [0041.051] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3e0109d2) returned 0x0 [0041.051] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd7c0dbd) returned 0x0 [0041.051] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0041.051] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.051] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.051] GetSystemMetrics (nIndex=42) returned 0 [0041.051] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.051] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.052] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0041.052] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0041.052] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0041.052] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0041.052] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0041.052] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0041.052] GetCurrentObject (hdc=0x3e0109d2, type=0x1) returned 0x1b00017 [0041.052] GetCurrentObject (hdc=0x3e0109d2, type=0x2) returned 0x1900010 [0041.052] GetCurrentObject (hdc=0x3e0109d2, type=0x7) returned 0x310509d7 [0041.052] GetCurrentObject (hdc=0x3e0109d2, type=0x6) returned 0x18a002e [0041.052] SaveDC (hdc=0x3e0109d2) returned 1 [0041.052] GetNearestColor (hdc=0x3e0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0041.052] RestoreDC (hdc=0x3e0109d2, nSavedDC=-1) returned 1 [0041.052] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3e0109d2) returned 0x0 [0041.052] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0041.052] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0041.052] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0041.052] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0041.052] GetCurrentObject (hdc=0x3e0109d2, type=0x1) returned 0x1b00017 [0041.052] GetCurrentObject (hdc=0x3e0109d2, type=0x2) returned 0x1900010 [0041.052] GetCurrentObject (hdc=0x3e0109d2, type=0x7) returned 0x310509d7 [0041.052] GetCurrentObject (hdc=0x3e0109d2, type=0x6) returned 0x18a002e [0041.053] SaveDC (hdc=0x3e0109d2) returned 1 [0041.053] GetTextAlign (hdc=0x3e0109d2) returned 0x0 [0041.053] GetTextColor (hdc=0x3e0109d2) returned 0x0 [0041.053] SetTextColor (hdc=0x3e0109d2, color=0xf0f0f0) returned 0x0 [0041.053] GetCurrentObject (hdc=0x3e0109d2, type=0x6) returned 0x18a002e [0041.053] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0041.053] SelectObject (hdc=0x3e0109d2, h=0x260a09ba) returned 0x18a002e [0041.053] GetBkMode (hdc=0x3e0109d2) returned 2 [0041.053] SetBkMode (hdc=0x3e0109d2, mode=1) returned 2 [0041.053] DrawTextExW (in: hdc=0x3e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x279a898 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0041.053] DrawTextExW (in: hdc=0x3e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x279a898 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0041.054] RestoreDC (hdc=0x3e0109d2, nSavedDC=-1) returned 1 [0041.054] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3e0109d2) returned 0x0 [0041.054] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0041.054] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x3e0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0041.054] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3e0109d2) returned 0x0 [0041.054] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0041.054] SelectObject (hdc=0x3e0109d2, h=0x185000f) returned 0x310509d7 [0041.054] DeleteDC (hdc=0x3e0109d2) returned 1 [0041.054] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0041.054] DeleteObject (ho=0x310509d7) returned 1 [0041.061] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0041.061] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.061] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.061] WaitMessage () returned 1 [0041.182] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.182] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.182] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.182] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.182] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.183] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0041.183] GetCurrentThreadId () returned 0xa28 [0041.183] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0041.183] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.183] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.183] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.183] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.183] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.183] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0041.183] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0041.183] CreateCompatibleDC (hdc=0x60109d6) returned 0x700109c0 [0041.184] GetObjectType (h=0x60109d6) returned 0x3 [0041.184] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x320509d7 [0041.184] GetDIBits (in: hdc=0x60109d6, hbm=0x320509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.184] GetDIBits (in: hdc=0x60109d6, hbm=0x320509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.184] DeleteObject (ho=0x320509d7) returned 1 [0041.184] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x3f0509d2 [0041.184] SelectObject (hdc=0x700109c0, h=0x3f0509d2) returned 0x185000f [0041.184] GdipCreateFromHDC (hdc=0x700109c0, graphics=0x26e408) returned 0x0 [0041.185] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0041.185] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0041.185] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0041.185] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0041.185] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0041.185] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d47a0 [0041.185] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d47a0) returned 0x0 [0041.185] LocalFree (hMem=0x1a7d47a0) returned 0x0 [0041.185] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0041.185] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0041.185] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0041.185] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0041.185] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0041.185] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.185] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.185] GetSystemMetrics (nIndex=42) returned 0 [0041.185] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.185] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.185] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0041.185] IsAppThemed () returned 0x1 [0041.185] GetThemeAppProperties () returned 0x3 [0041.185] GetThemeAppProperties () returned 0x3 [0041.185] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0041.185] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0041.185] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0041.185] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0041.185] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0041.185] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d47a0 [0041.186] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d47a0) returned 0x0 [0041.186] LocalFree (hMem=0x1a7d47a0) returned 0x0 [0041.186] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0041.186] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d47a0 [0041.186] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d47a0) returned 0x0 [0041.186] LocalFree (hMem=0x1a7d47a0) returned 0x0 [0041.186] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0041.186] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0041.186] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0041.186] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0041.186] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0041.186] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0041.186] GetCurrentObject (hdc=0x700109c0, type=0x1) returned 0x1b00017 [0041.186] GetCurrentObject (hdc=0x700109c0, type=0x2) returned 0x1900010 [0041.186] GetCurrentObject (hdc=0x700109c0, type=0x7) returned 0x3f0509d2 [0041.186] GetCurrentObject (hdc=0x700109c0, type=0x6) returned 0x18a002e [0041.186] SaveDC (hdc=0x700109c0) returned 1 [0041.186] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4b0409f1 [0041.186] GetClipRgn (hdc=0x700109c0, hrgn=0x4b0409f1) returned 0 [0041.186] SelectClipRgn (hdc=0x700109c0, hrgn=0x720409ff) returned 2 [0041.186] DeleteObject (ho=0x4b0409f1) returned 1 [0041.186] DeleteObject (ho=0x720409ff) returned 1 [0041.186] OffsetViewportOrgEx (in: hdc=0x700109c0, x=0, y=0, lppt=0x279c478 | out: lppt=0x279c478) returned 1 [0041.186] OffsetViewportOrgEx (in: hdc=0x700109c0, x=-417, y=-278, lppt=0x279c490 | out: lppt=0x279c490) returned 1 [0041.186] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0041.186] GetCurrentObject (hdc=0x700109c0, type=0x1) returned 0x1b00017 [0041.186] GetCurrentObject (hdc=0x700109c0, type=0x2) returned 0x1900010 [0041.186] GetCurrentObject (hdc=0x700109c0, type=0x7) returned 0x3f0509d2 [0041.187] GetCurrentObject (hdc=0x700109c0, type=0x6) returned 0x18a002e [0041.187] SaveDC (hdc=0x700109c0) returned 2 [0041.187] GetNearestColor (hdc=0x700109c0, color=0x6c4607) returned 0x6c4607 [0041.187] CreateSolidBrush (color=0x6c4607) returned 0x5e100276 [0041.187] FillRect (hDC=0x700109c0, lprc=0x26de08, hbr=0x5e100276) returned 1 [0041.193] DeleteObject (ho=0x5e100276) returned 1 [0041.193] RestoreDC (hdc=0x700109c0, nSavedDC=-1) returned 1 [0041.193] RestoreDC (hdc=0x700109c0, nSavedDC=-1) returned 1 [0041.193] GdipReleaseDC (graphics=0x1b86d040, hdc=0x700109c0) returned 0x0 [0041.193] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd7a0dbd) returned 0x0 [0041.193] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0041.193] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.193] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.193] GetSystemMetrics (nIndex=42) returned 0 [0041.193] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.193] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.193] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x20) returned 0x0 [0041.194] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0041.194] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0041.194] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0041.194] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0041.194] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0041.194] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0041.194] GetCurrentObject (hdc=0x700109c0, type=0x1) returned 0x1b00017 [0041.194] GetCurrentObject (hdc=0x700109c0, type=0x2) returned 0x1900010 [0041.194] GetCurrentObject (hdc=0x700109c0, type=0x7) returned 0x3f0509d2 [0041.194] GetCurrentObject (hdc=0x700109c0, type=0x6) returned 0x18a002e [0041.194] SaveDC (hdc=0x700109c0) returned 1 [0041.194] GetNearestColor (hdc=0x700109c0, color=0xf0f0f0) returned 0xf0f0f0 [0041.194] RestoreDC (hdc=0x700109c0, nSavedDC=-1) returned 1 [0041.195] GdipReleaseDC (graphics=0x1b86d040, hdc=0x700109c0) returned 0x0 [0041.195] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0041.195] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0041.195] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0041.195] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0041.195] GetCurrentObject (hdc=0x700109c0, type=0x1) returned 0x1b00017 [0041.195] GetCurrentObject (hdc=0x700109c0, type=0x2) returned 0x1900010 [0041.195] GetCurrentObject (hdc=0x700109c0, type=0x7) returned 0x3f0509d2 [0041.195] GetCurrentObject (hdc=0x700109c0, type=0x6) returned 0x18a002e [0041.195] SaveDC (hdc=0x700109c0) returned 1 [0041.195] GetTextAlign (hdc=0x700109c0) returned 0x0 [0041.195] GetTextColor (hdc=0x700109c0) returned 0x0 [0041.195] SetTextColor (hdc=0x700109c0, color=0xf0f0f0) returned 0x0 [0041.195] GetCurrentObject (hdc=0x700109c0, type=0x6) returned 0x18a002e [0041.195] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0041.195] SelectObject (hdc=0x700109c0, h=0x260a09ba) returned 0x18a002e [0041.195] GetBkMode (hdc=0x700109c0) returned 2 [0041.195] SetBkMode (hdc=0x700109c0, mode=1) returned 2 [0041.195] DrawTextExW (in: hdc=0x700109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x279d388 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0041.196] DrawTextExW (in: hdc=0x700109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x279d388 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0041.196] RestoreDC (hdc=0x700109c0, nSavedDC=-1) returned 1 [0041.197] GdipReleaseDC (graphics=0x1b86d040, hdc=0x700109c0) returned 0x0 [0041.197] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0041.197] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x700109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0041.204] GdipReleaseDC (graphics=0x1b86d040, hdc=0x700109c0) returned 0x0 [0041.204] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0041.204] SelectObject (hdc=0x700109c0, h=0x185000f) returned 0x3f0509d2 [0041.204] DeleteDC (hdc=0x700109c0) returned 1 [0041.204] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0041.204] DeleteObject (ho=0x3f0509d2) returned 1 [0041.207] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0041.207] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.207] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.207] WaitMessage () returned 1 [0041.323] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.323] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.323] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.323] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.323] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.323] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0041.323] GetCurrentThreadId () returned 0xa28 [0041.323] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0041.323] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.323] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.323] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.323] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.323] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.323] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0041.323] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0041.323] CreateCompatibleDC (hdc=0x60109d6) returned 0x340109d7 [0041.323] GetObjectType (h=0x60109d6) returned 0x3 [0041.323] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x400509d2 [0041.323] GetDIBits (in: hdc=0x60109d6, hbm=0x400509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.323] GetDIBits (in: hdc=0x60109d6, hbm=0x400509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.324] DeleteObject (ho=0x400509d2) returned 1 [0041.324] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x710509c0 [0041.324] SelectObject (hdc=0x340109d7, h=0x710509c0) returned 0x185000f [0041.324] GdipCreateFromHDC (hdc=0x340109d7, graphics=0x26e408) returned 0x0 [0041.324] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0041.324] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0041.324] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0041.324] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0041.324] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0041.324] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4820 [0041.324] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4820) returned 0x0 [0041.324] LocalFree (hMem=0x1a7d4820) returned 0x0 [0041.324] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0041.324] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0041.324] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0041.324] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0041.324] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0041.324] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.325] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.325] GetSystemMetrics (nIndex=42) returned 0 [0041.325] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.325] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.325] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0041.325] IsAppThemed () returned 0x1 [0041.325] GetThemeAppProperties () returned 0x3 [0041.325] GetThemeAppProperties () returned 0x3 [0041.325] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0041.325] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0041.325] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0041.325] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0041.325] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0041.325] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4820 [0041.325] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4820) returned 0x0 [0041.325] LocalFree (hMem=0x1a7d4820) returned 0x0 [0041.325] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0041.325] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4820 [0041.325] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4820) returned 0x0 [0041.325] LocalFree (hMem=0x1a7d4820) returned 0x0 [0041.325] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0041.325] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0041.325] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0041.325] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0041.325] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0041.325] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0041.325] GetCurrentObject (hdc=0x340109d7, type=0x1) returned 0x1b00017 [0041.325] GetCurrentObject (hdc=0x340109d7, type=0x2) returned 0x1900010 [0041.325] GetCurrentObject (hdc=0x340109d7, type=0x7) returned 0x710509c0 [0041.325] GetCurrentObject (hdc=0x340109d7, type=0x6) returned 0x18a002e [0041.326] SaveDC (hdc=0x340109d7) returned 1 [0041.326] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x730409ff [0041.326] GetClipRgn (hdc=0x340109d7, hrgn=0x730409ff) returned 0 [0041.326] SelectClipRgn (hdc=0x340109d7, hrgn=0x4e0409f1) returned 2 [0041.326] DeleteObject (ho=0x730409ff) returned 1 [0041.326] DeleteObject (ho=0x4e0409f1) returned 1 [0041.326] OffsetViewportOrgEx (in: hdc=0x340109d7, x=0, y=0, lppt=0x279ef68 | out: lppt=0x279ef68) returned 1 [0041.326] OffsetViewportOrgEx (in: hdc=0x340109d7, x=-417, y=-278, lppt=0x279ef80 | out: lppt=0x279ef80) returned 1 [0041.326] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0041.326] GetCurrentObject (hdc=0x340109d7, type=0x1) returned 0x1b00017 [0041.326] GetCurrentObject (hdc=0x340109d7, type=0x2) returned 0x1900010 [0041.326] GetCurrentObject (hdc=0x340109d7, type=0x7) returned 0x710509c0 [0041.326] GetCurrentObject (hdc=0x340109d7, type=0x6) returned 0x18a002e [0041.326] SaveDC (hdc=0x340109d7) returned 2 [0041.326] GetNearestColor (hdc=0x340109d7, color=0x6c4607) returned 0x6c4607 [0041.326] CreateSolidBrush (color=0x6c4607) returned 0x5f100276 [0041.326] FillRect (hDC=0x340109d7, lprc=0x26de08, hbr=0x5f100276) returned 1 [0041.332] DeleteObject (ho=0x5f100276) returned 1 [0041.332] RestoreDC (hdc=0x340109d7, nSavedDC=-1) returned 1 [0041.332] RestoreDC (hdc=0x340109d7, nSavedDC=-1) returned 1 [0041.332] GdipReleaseDC (graphics=0x1b86d040, hdc=0x340109d7) returned 0x0 [0041.333] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd780dbd) returned 0x0 [0041.333] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0041.333] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.333] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.333] GetSystemMetrics (nIndex=42) returned 0 [0041.333] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.333] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.333] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0041.333] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0041.333] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0041.333] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0041.333] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0041.333] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0041.333] GetCurrentObject (hdc=0x340109d7, type=0x1) returned 0x1b00017 [0041.333] GetCurrentObject (hdc=0x340109d7, type=0x2) returned 0x1900010 [0041.333] GetCurrentObject (hdc=0x340109d7, type=0x7) returned 0x710509c0 [0041.333] GetCurrentObject (hdc=0x340109d7, type=0x6) returned 0x18a002e [0041.333] SaveDC (hdc=0x340109d7) returned 1 [0041.333] GetNearestColor (hdc=0x340109d7, color=0xf0f0f0) returned 0xf0f0f0 [0041.333] RestoreDC (hdc=0x340109d7, nSavedDC=-1) returned 1 [0041.333] GdipReleaseDC (graphics=0x1b86d040, hdc=0x340109d7) returned 0x0 [0041.334] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0041.334] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0041.334] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0041.334] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0041.334] GetCurrentObject (hdc=0x340109d7, type=0x1) returned 0x1b00017 [0041.334] GetCurrentObject (hdc=0x340109d7, type=0x2) returned 0x1900010 [0041.334] GetCurrentObject (hdc=0x340109d7, type=0x7) returned 0x710509c0 [0041.334] GetCurrentObject (hdc=0x340109d7, type=0x6) returned 0x18a002e [0041.334] SaveDC (hdc=0x340109d7) returned 1 [0041.334] GetTextAlign (hdc=0x340109d7) returned 0x0 [0041.334] GetTextColor (hdc=0x340109d7) returned 0x0 [0041.334] SetTextColor (hdc=0x340109d7, color=0xf0f0f0) returned 0x0 [0041.334] GetCurrentObject (hdc=0x340109d7, type=0x6) returned 0x18a002e [0041.334] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0041.334] SelectObject (hdc=0x340109d7, h=0x260a09ba) returned 0x18a002e [0041.334] GetBkMode (hdc=0x340109d7) returned 2 [0041.334] SetBkMode (hdc=0x340109d7, mode=1) returned 2 [0041.334] DrawTextExW (in: hdc=0x340109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x279fc30 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0041.334] DrawTextExW (in: hdc=0x340109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x279fc30 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0041.335] RestoreDC (hdc=0x340109d7, nSavedDC=-1) returned 1 [0041.335] GdipReleaseDC (graphics=0x1b86d040, hdc=0x340109d7) returned 0x0 [0041.335] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0041.335] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x340109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0041.335] GdipReleaseDC (graphics=0x1b86d040, hdc=0x340109d7) returned 0x0 [0041.335] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0041.335] SelectObject (hdc=0x340109d7, h=0x185000f) returned 0x710509c0 [0041.335] DeleteDC (hdc=0x340109d7) returned 1 [0041.335] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0041.335] DeleteObject (ho=0x710509c0) returned 1 [0041.339] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0041.339] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.339] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.339] WaitMessage () returned 1 [0041.467] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.467] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.467] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.467] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.467] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.467] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0041.467] GetCurrentThreadId () returned 0xa28 [0041.467] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0041.467] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.467] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.467] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.467] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.467] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.467] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0041.467] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0041.467] CreateCompatibleDC (hdc=0x60109d6) returned 0x420109d2 [0041.468] GetObjectType (h=0x60109d6) returned 0x3 [0041.468] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x720509c0 [0041.468] GetDIBits (in: hdc=0x60109d6, hbm=0x720509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.468] GetDIBits (in: hdc=0x60109d6, hbm=0x720509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.468] DeleteObject (ho=0x720509c0) returned 1 [0041.468] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x350509d7 [0041.468] SelectObject (hdc=0x420109d2, h=0x350509d7) returned 0x185000f [0041.468] GdipCreateFromHDC (hdc=0x420109d2, graphics=0x26e408) returned 0x0 [0041.469] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0041.469] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0041.469] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0041.469] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0041.469] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0041.469] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4820 [0041.469] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4820) returned 0x0 [0041.469] LocalFree (hMem=0x1a7d4820) returned 0x0 [0041.469] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0041.469] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0041.469] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0041.469] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0041.469] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0041.469] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.469] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.469] GetSystemMetrics (nIndex=42) returned 0 [0041.469] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.469] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.469] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0041.469] IsAppThemed () returned 0x1 [0041.469] GetThemeAppProperties () returned 0x3 [0041.469] GetThemeAppProperties () returned 0x3 [0041.469] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0041.469] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0041.470] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0041.470] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0041.470] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0041.470] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4820 [0041.470] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4820) returned 0x0 [0041.470] LocalFree (hMem=0x1a7d4820) returned 0x0 [0041.470] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0041.470] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4820 [0041.470] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4820) returned 0x0 [0041.470] LocalFree (hMem=0x1a7d4820) returned 0x0 [0041.470] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0041.470] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0041.470] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0041.470] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0041.470] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0041.470] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0041.470] GetCurrentObject (hdc=0x420109d2, type=0x1) returned 0x1b00017 [0041.470] GetCurrentObject (hdc=0x420109d2, type=0x2) returned 0x1900010 [0041.470] GetCurrentObject (hdc=0x420109d2, type=0x7) returned 0x350509d7 [0041.470] GetCurrentObject (hdc=0x420109d2, type=0x6) returned 0x18a002e [0041.470] SaveDC (hdc=0x420109d2) returned 1 [0041.470] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4f0409f1 [0041.470] GetClipRgn (hdc=0x420109d2, hrgn=0x4f0409f1) returned 0 [0041.470] SelectClipRgn (hdc=0x420109d2, hrgn=0x760409ff) returned 2 [0041.470] DeleteObject (ho=0x4f0409f1) returned 1 [0041.470] DeleteObject (ho=0x760409ff) returned 1 [0041.470] OffsetViewportOrgEx (in: hdc=0x420109d2, x=0, y=0, lppt=0x27a1810 | out: lppt=0x27a1810) returned 1 [0041.471] OffsetViewportOrgEx (in: hdc=0x420109d2, x=-417, y=-278, lppt=0x27a1828 | out: lppt=0x27a1828) returned 1 [0041.471] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0041.471] GetCurrentObject (hdc=0x420109d2, type=0x1) returned 0x1b00017 [0041.471] GetCurrentObject (hdc=0x420109d2, type=0x2) returned 0x1900010 [0041.471] GetCurrentObject (hdc=0x420109d2, type=0x7) returned 0x350509d7 [0041.471] GetCurrentObject (hdc=0x420109d2, type=0x6) returned 0x18a002e [0041.471] SaveDC (hdc=0x420109d2) returned 2 [0041.471] GetNearestColor (hdc=0x420109d2, color=0x6c4607) returned 0x6c4607 [0041.471] CreateSolidBrush (color=0x6c4607) returned 0x60100276 [0041.471] FillRect (hDC=0x420109d2, lprc=0x26de08, hbr=0x60100276) returned 1 [0041.477] DeleteObject (ho=0x60100276) returned 1 [0041.477] RestoreDC (hdc=0x420109d2, nSavedDC=-1) returned 1 [0041.477] RestoreDC (hdc=0x420109d2, nSavedDC=-1) returned 1 [0041.477] GdipReleaseDC (graphics=0x1b86d040, hdc=0x420109d2) returned 0x0 [0041.477] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd760dbd) returned 0x0 [0041.477] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0041.477] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.477] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.477] GetSystemMetrics (nIndex=42) returned 0 [0041.477] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.477] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.478] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x22) returned 0x0 [0041.479] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0041.479] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0041.479] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0041.479] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0041.479] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0041.479] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0041.479] GetCurrentObject (hdc=0x420109d2, type=0x1) returned 0x1b00017 [0041.479] GetCurrentObject (hdc=0x420109d2, type=0x2) returned 0x1900010 [0041.479] GetCurrentObject (hdc=0x420109d2, type=0x7) returned 0x350509d7 [0041.479] GetCurrentObject (hdc=0x420109d2, type=0x6) returned 0x18a002e [0041.479] SaveDC (hdc=0x420109d2) returned 1 [0041.479] GetNearestColor (hdc=0x420109d2, color=0xf0f0f0) returned 0xf0f0f0 [0041.479] RestoreDC (hdc=0x420109d2, nSavedDC=-1) returned 1 [0041.480] GdipReleaseDC (graphics=0x1b86d040, hdc=0x420109d2) returned 0x0 [0041.480] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0041.480] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0041.480] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0041.480] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0041.480] GetCurrentObject (hdc=0x420109d2, type=0x1) returned 0x1b00017 [0041.480] GetCurrentObject (hdc=0x420109d2, type=0x2) returned 0x1900010 [0041.480] GetCurrentObject (hdc=0x420109d2, type=0x7) returned 0x350509d7 [0041.480] GetCurrentObject (hdc=0x420109d2, type=0x6) returned 0x18a002e [0041.480] SaveDC (hdc=0x420109d2) returned 1 [0041.480] GetTextAlign (hdc=0x420109d2) returned 0x0 [0041.480] GetTextColor (hdc=0x420109d2) returned 0x0 [0041.480] SetTextColor (hdc=0x420109d2, color=0xf0f0f0) returned 0x0 [0041.480] GetCurrentObject (hdc=0x420109d2, type=0x6) returned 0x18a002e [0041.480] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0041.480] SelectObject (hdc=0x420109d2, h=0x260a09ba) returned 0x18a002e [0041.480] GetBkMode (hdc=0x420109d2) returned 2 [0041.480] SetBkMode (hdc=0x420109d2, mode=1) returned 2 [0041.480] DrawTextExW (in: hdc=0x420109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27a2720 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0041.480] DrawTextExW (in: hdc=0x420109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27a2720 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0041.481] RestoreDC (hdc=0x420109d2, nSavedDC=-1) returned 1 [0041.481] GdipReleaseDC (graphics=0x1b86d040, hdc=0x420109d2) returned 0x0 [0041.481] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0041.481] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x420109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0041.481] GdipReleaseDC (graphics=0x1b86d040, hdc=0x420109d2) returned 0x0 [0041.481] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0041.481] SelectObject (hdc=0x420109d2, h=0x185000f) returned 0x350509d7 [0041.481] DeleteDC (hdc=0x420109d2) returned 1 [0041.481] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0041.481] DeleteObject (ho=0x350509d7) returned 1 [0041.485] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0041.485] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.485] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.485] WaitMessage () returned 1 [0041.603] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.603] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.603] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.603] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.603] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.603] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0041.603] GetCurrentThreadId () returned 0xa28 [0041.603] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0041.604] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.604] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.604] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.604] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.604] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.604] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0041.604] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0041.604] CreateCompatibleDC (hdc=0x60109d6) returned 0x740109c0 [0041.604] GetObjectType (h=0x60109d6) returned 0x3 [0041.604] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x360509d7 [0041.604] GetDIBits (in: hdc=0x60109d6, hbm=0x360509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.604] GetDIBits (in: hdc=0x60109d6, hbm=0x360509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.604] DeleteObject (ho=0x360509d7) returned 1 [0041.604] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x430509d2 [0041.604] SelectObject (hdc=0x740109c0, h=0x430509d2) returned 0x185000f [0041.604] GdipCreateFromHDC (hdc=0x740109c0, graphics=0x26e408) returned 0x0 [0041.605] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0041.605] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0041.605] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0041.605] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0041.605] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0041.605] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d48a0 [0041.605] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d48a0) returned 0x0 [0041.605] LocalFree (hMem=0x1a7d48a0) returned 0x0 [0041.605] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0041.605] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0041.605] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0041.605] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0041.605] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0041.605] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.605] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.605] GetSystemMetrics (nIndex=42) returned 0 [0041.605] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.605] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.605] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0041.605] IsAppThemed () returned 0x1 [0041.605] GetThemeAppProperties () returned 0x3 [0041.605] GetThemeAppProperties () returned 0x3 [0041.605] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0041.605] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0041.606] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0041.606] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0041.606] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0041.606] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d48a0 [0041.606] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d48a0) returned 0x0 [0041.606] LocalFree (hMem=0x1a7d48a0) returned 0x0 [0041.606] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0041.606] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d48a0 [0041.606] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d48a0) returned 0x0 [0041.606] LocalFree (hMem=0x1a7d48a0) returned 0x0 [0041.606] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0041.606] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0041.606] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0041.606] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0041.606] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0041.606] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0041.606] GetCurrentObject (hdc=0x740109c0, type=0x1) returned 0x1b00017 [0041.606] GetCurrentObject (hdc=0x740109c0, type=0x2) returned 0x1900010 [0041.606] GetCurrentObject (hdc=0x740109c0, type=0x7) returned 0x430509d2 [0041.606] GetCurrentObject (hdc=0x740109c0, type=0x6) returned 0x18a002e [0041.606] SaveDC (hdc=0x740109c0) returned 1 [0041.606] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x770409ff [0041.606] GetClipRgn (hdc=0x740109c0, hrgn=0x770409ff) returned 0 [0041.606] SelectClipRgn (hdc=0x740109c0, hrgn=0x520409f1) returned 2 [0041.606] DeleteObject (ho=0x770409ff) returned 1 [0041.607] DeleteObject (ho=0x520409f1) returned 1 [0041.607] OffsetViewportOrgEx (in: hdc=0x740109c0, x=0, y=0, lppt=0x27a4300 | out: lppt=0x27a4300) returned 1 [0041.607] OffsetViewportOrgEx (in: hdc=0x740109c0, x=-417, y=-278, lppt=0x27a4318 | out: lppt=0x27a4318) returned 1 [0041.607] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0041.607] GetCurrentObject (hdc=0x740109c0, type=0x1) returned 0x1b00017 [0041.607] GetCurrentObject (hdc=0x740109c0, type=0x2) returned 0x1900010 [0041.607] GetCurrentObject (hdc=0x740109c0, type=0x7) returned 0x430509d2 [0041.607] GetCurrentObject (hdc=0x740109c0, type=0x6) returned 0x18a002e [0041.607] SaveDC (hdc=0x740109c0) returned 2 [0041.607] GetNearestColor (hdc=0x740109c0, color=0x6c4607) returned 0x6c4607 [0041.607] CreateSolidBrush (color=0x6c4607) returned 0x61100276 [0041.607] FillRect (hDC=0x740109c0, lprc=0x26de08, hbr=0x61100276) returned 1 [0041.613] DeleteObject (ho=0x61100276) returned 1 [0041.613] RestoreDC (hdc=0x740109c0, nSavedDC=-1) returned 1 [0041.613] RestoreDC (hdc=0x740109c0, nSavedDC=-1) returned 1 [0041.613] GdipReleaseDC (graphics=0x1b86d040, hdc=0x740109c0) returned 0x0 [0041.613] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd740dbd) returned 0x0 [0041.613] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0041.613] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.613] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.613] GetSystemMetrics (nIndex=42) returned 0 [0041.613] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.613] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.614] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0041.614] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0041.614] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0041.614] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0041.614] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0041.614] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0041.614] GetCurrentObject (hdc=0x740109c0, type=0x1) returned 0x1b00017 [0041.614] GetCurrentObject (hdc=0x740109c0, type=0x2) returned 0x1900010 [0041.614] GetCurrentObject (hdc=0x740109c0, type=0x7) returned 0x430509d2 [0041.614] GetCurrentObject (hdc=0x740109c0, type=0x6) returned 0x18a002e [0041.614] SaveDC (hdc=0x740109c0) returned 1 [0041.614] GetNearestColor (hdc=0x740109c0, color=0xf0f0f0) returned 0xf0f0f0 [0041.614] RestoreDC (hdc=0x740109c0, nSavedDC=-1) returned 1 [0041.614] GdipReleaseDC (graphics=0x1b86d040, hdc=0x740109c0) returned 0x0 [0041.614] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0041.614] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0041.614] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0041.614] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0041.614] GetCurrentObject (hdc=0x740109c0, type=0x1) returned 0x1b00017 [0041.614] GetCurrentObject (hdc=0x740109c0, type=0x2) returned 0x1900010 [0041.614] GetCurrentObject (hdc=0x740109c0, type=0x7) returned 0x430509d2 [0041.614] GetCurrentObject (hdc=0x740109c0, type=0x6) returned 0x18a002e [0041.615] SaveDC (hdc=0x740109c0) returned 1 [0041.615] GetTextAlign (hdc=0x740109c0) returned 0x0 [0041.615] GetTextColor (hdc=0x740109c0) returned 0x0 [0041.615] SetTextColor (hdc=0x740109c0, color=0xf0f0f0) returned 0x0 [0041.615] GetCurrentObject (hdc=0x740109c0, type=0x6) returned 0x18a002e [0041.615] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0041.615] SelectObject (hdc=0x740109c0, h=0x260a09ba) returned 0x18a002e [0041.615] GetBkMode (hdc=0x740109c0) returned 2 [0041.615] SetBkMode (hdc=0x740109c0, mode=1) returned 2 [0041.615] DrawTextExW (in: hdc=0x740109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27a4fc8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0041.615] DrawTextExW (in: hdc=0x740109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27a4fc8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0041.616] RestoreDC (hdc=0x740109c0, nSavedDC=-1) returned 1 [0041.616] GdipReleaseDC (graphics=0x1b86d040, hdc=0x740109c0) returned 0x0 [0041.616] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0041.616] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x740109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0041.616] GdipReleaseDC (graphics=0x1b86d040, hdc=0x740109c0) returned 0x0 [0041.616] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0041.616] SelectObject (hdc=0x740109c0, h=0x185000f) returned 0x430509d2 [0041.616] DeleteDC (hdc=0x740109c0) returned 1 [0041.616] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0041.616] DeleteObject (ho=0x430509d2) returned 1 [0041.620] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0041.620] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.620] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.620] WaitMessage () returned 1 [0041.744] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.744] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.744] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.744] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.744] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.744] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0041.744] GetCurrentThreadId () returned 0xa28 [0041.744] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0041.744] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.744] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.744] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.744] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.744] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.744] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0041.744] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0041.744] CreateCompatibleDC (hdc=0x60109d6) returned 0x380109d7 [0041.744] GetObjectType (h=0x60109d6) returned 0x3 [0041.744] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x440509d2 [0041.745] GetDIBits (in: hdc=0x60109d6, hbm=0x440509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.745] GetDIBits (in: hdc=0x60109d6, hbm=0x440509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.745] DeleteObject (ho=0x440509d2) returned 1 [0041.745] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x750509c0 [0041.745] SelectObject (hdc=0x380109d7, h=0x750509c0) returned 0x185000f [0041.745] GdipCreateFromHDC (hdc=0x380109d7, graphics=0x26e408) returned 0x0 [0041.745] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0041.745] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0041.745] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0041.745] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0041.745] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0041.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d48a0 [0041.745] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d48a0) returned 0x0 [0041.745] LocalFree (hMem=0x1a7d48a0) returned 0x0 [0041.745] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0041.745] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0041.746] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0041.746] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0041.746] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0041.746] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.746] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.746] GetSystemMetrics (nIndex=42) returned 0 [0041.746] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.746] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.746] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0041.746] IsAppThemed () returned 0x1 [0041.746] GetThemeAppProperties () returned 0x3 [0041.746] GetThemeAppProperties () returned 0x3 [0041.746] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0041.746] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0041.746] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0041.746] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0041.746] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0041.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d48a0 [0041.746] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d48a0) returned 0x0 [0041.746] LocalFree (hMem=0x1a7d48a0) returned 0x0 [0041.746] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0041.746] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d48a0 [0041.746] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d48a0) returned 0x0 [0041.746] LocalFree (hMem=0x1a7d48a0) returned 0x0 [0041.746] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0041.746] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0041.746] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0041.746] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0041.746] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0041.746] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0041.747] GetCurrentObject (hdc=0x380109d7, type=0x1) returned 0x1b00017 [0041.747] GetCurrentObject (hdc=0x380109d7, type=0x2) returned 0x1900010 [0041.747] GetCurrentObject (hdc=0x380109d7, type=0x7) returned 0x750509c0 [0041.747] GetCurrentObject (hdc=0x380109d7, type=0x6) returned 0x18a002e [0041.747] SaveDC (hdc=0x380109d7) returned 1 [0041.747] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x530409f1 [0041.747] GetClipRgn (hdc=0x380109d7, hrgn=0x530409f1) returned 0 [0041.747] SelectClipRgn (hdc=0x380109d7, hrgn=0x7a0409ff) returned 2 [0041.747] DeleteObject (ho=0x530409f1) returned 1 [0041.747] DeleteObject (ho=0x7a0409ff) returned 1 [0041.747] OffsetViewportOrgEx (in: hdc=0x380109d7, x=0, y=0, lppt=0x27a6ba8 | out: lppt=0x27a6ba8) returned 1 [0041.747] OffsetViewportOrgEx (in: hdc=0x380109d7, x=-417, y=-278, lppt=0x27a6bc0 | out: lppt=0x27a6bc0) returned 1 [0041.747] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0041.747] GetCurrentObject (hdc=0x380109d7, type=0x1) returned 0x1b00017 [0041.747] GetCurrentObject (hdc=0x380109d7, type=0x2) returned 0x1900010 [0041.747] GetCurrentObject (hdc=0x380109d7, type=0x7) returned 0x750509c0 [0041.747] GetCurrentObject (hdc=0x380109d7, type=0x6) returned 0x18a002e [0041.747] SaveDC (hdc=0x380109d7) returned 2 [0041.747] GetNearestColor (hdc=0x380109d7, color=0x6c4607) returned 0x6c4607 [0041.747] CreateSolidBrush (color=0x6c4607) returned 0x62100276 [0041.747] FillRect (hDC=0x380109d7, lprc=0x26de08, hbr=0x62100276) returned 1 [0041.753] DeleteObject (ho=0x62100276) returned 1 [0041.753] RestoreDC (hdc=0x380109d7, nSavedDC=-1) returned 1 [0041.753] RestoreDC (hdc=0x380109d7, nSavedDC=-1) returned 1 [0041.753] GdipReleaseDC (graphics=0x1b86d040, hdc=0x380109d7) returned 0x0 [0041.753] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd720dbd) returned 0x0 [0041.753] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0041.754] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.754] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.754] GetSystemMetrics (nIndex=42) returned 0 [0041.754] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.754] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.754] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x24) returned 0x0 [0041.755] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0041.755] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0041.755] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0041.755] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0041.755] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0041.755] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0041.755] GetCurrentObject (hdc=0x380109d7, type=0x1) returned 0x1b00017 [0041.755] GetCurrentObject (hdc=0x380109d7, type=0x2) returned 0x1900010 [0041.755] GetCurrentObject (hdc=0x380109d7, type=0x7) returned 0x750509c0 [0041.755] GetCurrentObject (hdc=0x380109d7, type=0x6) returned 0x18a002e [0041.755] SaveDC (hdc=0x380109d7) returned 1 [0041.755] GetNearestColor (hdc=0x380109d7, color=0xf0f0f0) returned 0xf0f0f0 [0041.755] RestoreDC (hdc=0x380109d7, nSavedDC=-1) returned 1 [0041.755] GdipReleaseDC (graphics=0x1b86d040, hdc=0x380109d7) returned 0x0 [0041.755] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0041.755] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0041.755] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0041.755] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0041.755] GetCurrentObject (hdc=0x380109d7, type=0x1) returned 0x1b00017 [0041.755] GetCurrentObject (hdc=0x380109d7, type=0x2) returned 0x1900010 [0041.756] GetCurrentObject (hdc=0x380109d7, type=0x7) returned 0x750509c0 [0041.756] GetCurrentObject (hdc=0x380109d7, type=0x6) returned 0x18a002e [0041.756] SaveDC (hdc=0x380109d7) returned 1 [0041.756] GetTextAlign (hdc=0x380109d7) returned 0x0 [0041.756] GetTextColor (hdc=0x380109d7) returned 0x0 [0041.756] SetTextColor (hdc=0x380109d7, color=0xf0f0f0) returned 0x0 [0041.756] GetCurrentObject (hdc=0x380109d7, type=0x6) returned 0x18a002e [0041.756] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0041.756] SelectObject (hdc=0x380109d7, h=0x260a09ba) returned 0x18a002e [0041.756] GetBkMode (hdc=0x380109d7) returned 2 [0041.756] SetBkMode (hdc=0x380109d7, mode=1) returned 2 [0041.756] DrawTextExW (in: hdc=0x380109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27a7ab8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0041.756] DrawTextExW (in: hdc=0x380109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27a7ab8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0041.757] RestoreDC (hdc=0x380109d7, nSavedDC=-1) returned 1 [0041.757] GdipReleaseDC (graphics=0x1b86d040, hdc=0x380109d7) returned 0x0 [0041.757] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0041.757] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x380109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0041.757] GdipReleaseDC (graphics=0x1b86d040, hdc=0x380109d7) returned 0x0 [0041.757] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0041.757] SelectObject (hdc=0x380109d7, h=0x185000f) returned 0x750509c0 [0041.757] DeleteDC (hdc=0x380109d7) returned 1 [0041.757] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0041.757] DeleteObject (ho=0x750509c0) returned 1 [0041.767] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0041.767] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.767] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.767] WaitMessage () returned 1 [0041.884] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.884] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.884] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.884] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.884] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.884] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0041.884] GetCurrentThreadId () returned 0xa28 [0041.884] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0041.884] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.884] IsWindowUnicode (hWnd=0x3015e) returned 1 [0041.884] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0041.884] TranslateMessage (lpMsg=0x26ee10) returned 0 [0041.884] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0041.884] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0041.885] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0041.885] CreateCompatibleDC (hdc=0x60109d6) returned 0x460109d2 [0041.885] GetObjectType (h=0x60109d6) returned 0x3 [0041.885] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x760509c0 [0041.885] GetDIBits (in: hdc=0x60109d6, hbm=0x760509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.885] GetDIBits (in: hdc=0x60109d6, hbm=0x760509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0041.885] DeleteObject (ho=0x760509c0) returned 1 [0041.885] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x390509d7 [0041.885] SelectObject (hdc=0x460109d2, h=0x390509d7) returned 0x185000f [0041.885] GdipCreateFromHDC (hdc=0x460109d2, graphics=0x26e408) returned 0x0 [0041.885] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0041.885] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0041.885] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0041.885] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0041.886] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0041.886] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4920 [0041.886] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4920) returned 0x0 [0041.886] LocalFree (hMem=0x1a7d4920) returned 0x0 [0041.886] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0041.886] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0041.886] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0041.886] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0041.886] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0041.886] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.886] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.886] GetSystemMetrics (nIndex=42) returned 0 [0041.886] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.886] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.886] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0041.886] IsAppThemed () returned 0x1 [0041.886] GetThemeAppProperties () returned 0x3 [0041.886] GetThemeAppProperties () returned 0x3 [0041.886] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0041.886] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0041.886] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0041.886] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0041.886] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0041.886] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4920 [0041.886] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4920) returned 0x0 [0041.886] LocalFree (hMem=0x1a7d4920) returned 0x0 [0041.886] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0041.886] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4920 [0041.886] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4920) returned 0x0 [0041.887] LocalFree (hMem=0x1a7d4920) returned 0x0 [0041.887] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0041.887] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0041.887] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0041.887] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0041.887] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0041.887] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0041.887] GetCurrentObject (hdc=0x460109d2, type=0x1) returned 0x1b00017 [0041.887] GetCurrentObject (hdc=0x460109d2, type=0x2) returned 0x1900010 [0041.887] GetCurrentObject (hdc=0x460109d2, type=0x7) returned 0x390509d7 [0041.887] GetCurrentObject (hdc=0x460109d2, type=0x6) returned 0x18a002e [0041.887] SaveDC (hdc=0x460109d2) returned 1 [0041.887] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7b0409ff [0041.887] GetClipRgn (hdc=0x460109d2, hrgn=0x7b0409ff) returned 0 [0041.887] SelectClipRgn (hdc=0x460109d2, hrgn=0x560409f1) returned 2 [0041.887] DeleteObject (ho=0x7b0409ff) returned 1 [0041.887] DeleteObject (ho=0x560409f1) returned 1 [0041.887] OffsetViewportOrgEx (in: hdc=0x460109d2, x=0, y=0, lppt=0x27a9698 | out: lppt=0x27a9698) returned 1 [0041.887] OffsetViewportOrgEx (in: hdc=0x460109d2, x=-417, y=-278, lppt=0x27a96b0 | out: lppt=0x27a96b0) returned 1 [0041.887] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0041.887] GetCurrentObject (hdc=0x460109d2, type=0x1) returned 0x1b00017 [0041.887] GetCurrentObject (hdc=0x460109d2, type=0x2) returned 0x1900010 [0041.887] GetCurrentObject (hdc=0x460109d2, type=0x7) returned 0x390509d7 [0041.887] GetCurrentObject (hdc=0x460109d2, type=0x6) returned 0x18a002e [0041.887] SaveDC (hdc=0x460109d2) returned 2 [0041.887] GetNearestColor (hdc=0x460109d2, color=0x6c4607) returned 0x6c4607 [0041.887] CreateSolidBrush (color=0x6c4607) returned 0x63100276 [0041.888] FillRect (hDC=0x460109d2, lprc=0x26de08, hbr=0x63100276) returned 1 [0041.893] DeleteObject (ho=0x63100276) returned 1 [0041.893] RestoreDC (hdc=0x460109d2, nSavedDC=-1) returned 1 [0041.894] RestoreDC (hdc=0x460109d2, nSavedDC=-1) returned 1 [0041.894] GdipReleaseDC (graphics=0x1b86d040, hdc=0x460109d2) returned 0x0 [0041.894] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd700dbd) returned 0x0 [0041.894] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0041.894] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0041.894] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0041.894] GetSystemMetrics (nIndex=42) returned 0 [0041.894] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0041.894] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0041.894] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0041.894] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0041.894] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0041.894] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0041.894] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0041.894] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0041.894] GetCurrentObject (hdc=0x460109d2, type=0x1) returned 0x1b00017 [0041.894] GetCurrentObject (hdc=0x460109d2, type=0x2) returned 0x1900010 [0041.894] GetCurrentObject (hdc=0x460109d2, type=0x7) returned 0x390509d7 [0041.894] GetCurrentObject (hdc=0x460109d2, type=0x6) returned 0x18a002e [0041.894] SaveDC (hdc=0x460109d2) returned 1 [0041.894] GetNearestColor (hdc=0x460109d2, color=0xf0f0f0) returned 0xf0f0f0 [0041.894] RestoreDC (hdc=0x460109d2, nSavedDC=-1) returned 1 [0041.894] GdipReleaseDC (graphics=0x1b86d040, hdc=0x460109d2) returned 0x0 [0041.895] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0041.895] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0041.895] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0041.895] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0041.895] GetCurrentObject (hdc=0x460109d2, type=0x1) returned 0x1b00017 [0041.895] GetCurrentObject (hdc=0x460109d2, type=0x2) returned 0x1900010 [0041.895] GetCurrentObject (hdc=0x460109d2, type=0x7) returned 0x390509d7 [0041.895] GetCurrentObject (hdc=0x460109d2, type=0x6) returned 0x18a002e [0041.895] SaveDC (hdc=0x460109d2) returned 1 [0041.895] GetTextAlign (hdc=0x460109d2) returned 0x0 [0041.895] GetTextColor (hdc=0x460109d2) returned 0x0 [0041.895] SetTextColor (hdc=0x460109d2, color=0xf0f0f0) returned 0x0 [0041.895] GetCurrentObject (hdc=0x460109d2, type=0x6) returned 0x18a002e [0041.895] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0041.895] SelectObject (hdc=0x460109d2, h=0x260a09ba) returned 0x18a002e [0041.895] GetBkMode (hdc=0x460109d2) returned 2 [0041.895] SetBkMode (hdc=0x460109d2, mode=1) returned 2 [0041.895] DrawTextExW (in: hdc=0x460109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27aa360 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0041.895] DrawTextExW (in: hdc=0x460109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27aa360 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0041.896] RestoreDC (hdc=0x460109d2, nSavedDC=-1) returned 1 [0041.896] GdipReleaseDC (graphics=0x1b86d040, hdc=0x460109d2) returned 0x0 [0041.896] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0041.896] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x460109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0041.896] GdipReleaseDC (graphics=0x1b86d040, hdc=0x460109d2) returned 0x0 [0041.896] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0041.896] SelectObject (hdc=0x460109d2, h=0x185000f) returned 0x390509d7 [0041.896] DeleteDC (hdc=0x460109d2) returned 1 [0041.896] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0041.896] DeleteObject (ho=0x390509d7) returned 1 [0041.900] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0041.900] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.900] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0041.900] WaitMessage () returned 1 [0042.025] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.025] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.025] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.025] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.025] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.025] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0042.025] GetCurrentThreadId () returned 0xa28 [0042.025] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0042.025] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.025] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.025] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.025] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.025] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.025] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0042.025] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0042.025] CreateCompatibleDC (hdc=0x60109d6) returned 0x780109c0 [0042.025] GetObjectType (h=0x60109d6) returned 0x3 [0042.025] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x3a0509d7 [0042.025] GetDIBits (in: hdc=0x60109d6, hbm=0x3a0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.025] GetDIBits (in: hdc=0x60109d6, hbm=0x3a0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.025] DeleteObject (ho=0x3a0509d7) returned 1 [0042.026] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x470509d2 [0042.026] SelectObject (hdc=0x780109c0, h=0x470509d2) returned 0x185000f [0042.026] GdipCreateFromHDC (hdc=0x780109c0, graphics=0x26e408) returned 0x0 [0042.026] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0042.026] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0042.026] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0042.026] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0042.026] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0042.026] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4920 [0042.026] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4920) returned 0x0 [0042.026] LocalFree (hMem=0x1a7d4920) returned 0x0 [0042.026] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0042.026] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0042.026] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0042.026] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0042.026] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0042.026] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.026] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.027] GetSystemMetrics (nIndex=42) returned 0 [0042.027] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.027] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.027] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0042.027] IsAppThemed () returned 0x1 [0042.027] GetThemeAppProperties () returned 0x3 [0042.027] GetThemeAppProperties () returned 0x3 [0042.027] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0042.027] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0042.027] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0042.027] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0042.027] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0042.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4920 [0042.027] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4920) returned 0x0 [0042.027] LocalFree (hMem=0x1a7d4920) returned 0x0 [0042.027] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0042.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4920 [0042.027] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4920) returned 0x0 [0042.027] LocalFree (hMem=0x1a7d4920) returned 0x0 [0042.027] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0042.027] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0042.027] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0042.027] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0042.027] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0042.027] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0042.027] GetCurrentObject (hdc=0x780109c0, type=0x1) returned 0x1b00017 [0042.027] GetCurrentObject (hdc=0x780109c0, type=0x2) returned 0x1900010 [0042.027] GetCurrentObject (hdc=0x780109c0, type=0x7) returned 0x470509d2 [0042.028] GetCurrentObject (hdc=0x780109c0, type=0x6) returned 0x18a002e [0042.028] SaveDC (hdc=0x780109c0) returned 1 [0042.028] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x570409f1 [0042.028] GetClipRgn (hdc=0x780109c0, hrgn=0x570409f1) returned 0 [0042.028] SelectClipRgn (hdc=0x780109c0, hrgn=0x7e0409ff) returned 2 [0042.028] DeleteObject (ho=0x570409f1) returned 1 [0042.028] DeleteObject (ho=0x7e0409ff) returned 1 [0042.028] OffsetViewportOrgEx (in: hdc=0x780109c0, x=0, y=0, lppt=0x27abf40 | out: lppt=0x27abf40) returned 1 [0042.028] OffsetViewportOrgEx (in: hdc=0x780109c0, x=-417, y=-278, lppt=0x27abf58 | out: lppt=0x27abf58) returned 1 [0042.028] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0042.028] GetCurrentObject (hdc=0x780109c0, type=0x1) returned 0x1b00017 [0042.028] GetCurrentObject (hdc=0x780109c0, type=0x2) returned 0x1900010 [0042.028] GetCurrentObject (hdc=0x780109c0, type=0x7) returned 0x470509d2 [0042.028] GetCurrentObject (hdc=0x780109c0, type=0x6) returned 0x18a002e [0042.028] SaveDC (hdc=0x780109c0) returned 2 [0042.028] GetNearestColor (hdc=0x780109c0, color=0x6c4607) returned 0x6c4607 [0042.028] CreateSolidBrush (color=0x6c4607) returned 0x64100276 [0042.028] FillRect (hDC=0x780109c0, lprc=0x26de08, hbr=0x64100276) returned 1 [0042.034] DeleteObject (ho=0x64100276) returned 1 [0042.034] RestoreDC (hdc=0x780109c0, nSavedDC=-1) returned 1 [0042.035] RestoreDC (hdc=0x780109c0, nSavedDC=-1) returned 1 [0042.035] GdipReleaseDC (graphics=0x1b86d040, hdc=0x780109c0) returned 0x0 [0042.035] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd6e0dbd) returned 0x0 [0042.035] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0042.035] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.035] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.035] GetSystemMetrics (nIndex=42) returned 0 [0042.035] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.035] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.035] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x26) returned 0x0 [0042.036] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0042.036] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0042.036] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0042.036] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0042.036] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0042.036] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0042.036] GetCurrentObject (hdc=0x780109c0, type=0x1) returned 0x1b00017 [0042.036] GetCurrentObject (hdc=0x780109c0, type=0x2) returned 0x1900010 [0042.036] GetCurrentObject (hdc=0x780109c0, type=0x7) returned 0x470509d2 [0042.036] GetCurrentObject (hdc=0x780109c0, type=0x6) returned 0x18a002e [0042.036] SaveDC (hdc=0x780109c0) returned 1 [0042.036] GetNearestColor (hdc=0x780109c0, color=0xf0f0f0) returned 0xf0f0f0 [0042.036] RestoreDC (hdc=0x780109c0, nSavedDC=-1) returned 1 [0042.036] GdipReleaseDC (graphics=0x1b86d040, hdc=0x780109c0) returned 0x0 [0042.037] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0042.037] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0042.037] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0042.037] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0042.037] GetCurrentObject (hdc=0x780109c0, type=0x1) returned 0x1b00017 [0042.037] GetCurrentObject (hdc=0x780109c0, type=0x2) returned 0x1900010 [0042.037] GetCurrentObject (hdc=0x780109c0, type=0x7) returned 0x470509d2 [0042.037] GetCurrentObject (hdc=0x780109c0, type=0x6) returned 0x18a002e [0042.037] SaveDC (hdc=0x780109c0) returned 1 [0042.037] GetTextAlign (hdc=0x780109c0) returned 0x0 [0042.037] GetTextColor (hdc=0x780109c0) returned 0x0 [0042.037] SetTextColor (hdc=0x780109c0, color=0xf0f0f0) returned 0x0 [0042.037] GetCurrentObject (hdc=0x780109c0, type=0x6) returned 0x18a002e [0042.037] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0042.037] SelectObject (hdc=0x780109c0, h=0x260a09ba) returned 0x18a002e [0042.037] GetBkMode (hdc=0x780109c0) returned 2 [0042.037] SetBkMode (hdc=0x780109c0, mode=1) returned 2 [0042.037] DrawTextExW (in: hdc=0x780109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27ace58 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0042.037] DrawTextExW (in: hdc=0x780109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27ace58 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0042.038] RestoreDC (hdc=0x780109c0, nSavedDC=-1) returned 1 [0042.038] GdipReleaseDC (graphics=0x1b86d040, hdc=0x780109c0) returned 0x0 [0042.038] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0042.038] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x780109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0042.038] GdipReleaseDC (graphics=0x1b86d040, hdc=0x780109c0) returned 0x0 [0042.038] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0042.038] SelectObject (hdc=0x780109c0, h=0x185000f) returned 0x470509d2 [0042.038] DeleteDC (hdc=0x780109c0) returned 1 [0042.038] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0042.038] DeleteObject (ho=0x470509d2) returned 1 [0042.041] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0042.042] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.042] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.042] WaitMessage () returned 1 [0042.165] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.165] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.165] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.165] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.165] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.165] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0042.165] GetCurrentThreadId () returned 0xa28 [0042.165] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0042.165] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.165] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.165] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.165] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.165] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.165] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0042.165] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0042.166] CreateCompatibleDC (hdc=0x60109d6) returned 0x3c0109d7 [0042.166] GetObjectType (h=0x60109d6) returned 0x3 [0042.166] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x480509d2 [0042.166] GetDIBits (in: hdc=0x60109d6, hbm=0x480509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.166] GetDIBits (in: hdc=0x60109d6, hbm=0x480509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.166] DeleteObject (ho=0x480509d2) returned 1 [0042.166] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x790509c0 [0042.166] SelectObject (hdc=0x3c0109d7, h=0x790509c0) returned 0x185000f [0042.166] GdipCreateFromHDC (hdc=0x3c0109d7, graphics=0x26e408) returned 0x0 [0042.166] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0042.167] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0042.167] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0042.167] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0042.167] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0042.167] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d49a0 [0042.167] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d49a0) returned 0x0 [0042.167] LocalFree (hMem=0x1a7d49a0) returned 0x0 [0042.167] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0042.167] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0042.167] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0042.167] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0042.167] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0042.167] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.167] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.167] GetSystemMetrics (nIndex=42) returned 0 [0042.167] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.167] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.167] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0042.167] IsAppThemed () returned 0x1 [0042.167] GetThemeAppProperties () returned 0x3 [0042.167] GetThemeAppProperties () returned 0x3 [0042.167] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0042.167] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0042.167] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0042.167] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0042.167] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0042.167] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d49a0 [0042.167] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d49a0) returned 0x0 [0042.167] LocalFree (hMem=0x1a7d49a0) returned 0x0 [0042.167] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0042.168] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d49a0 [0042.168] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d49a0) returned 0x0 [0042.168] LocalFree (hMem=0x1a7d49a0) returned 0x0 [0042.168] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0042.168] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0042.168] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0042.168] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0042.168] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0042.168] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0042.168] GetCurrentObject (hdc=0x3c0109d7, type=0x1) returned 0x1b00017 [0042.168] GetCurrentObject (hdc=0x3c0109d7, type=0x2) returned 0x1900010 [0042.168] GetCurrentObject (hdc=0x3c0109d7, type=0x7) returned 0x790509c0 [0042.168] GetCurrentObject (hdc=0x3c0109d7, type=0x6) returned 0x18a002e [0042.168] SaveDC (hdc=0x3c0109d7) returned 1 [0042.168] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7f0409ff [0042.169] GetClipRgn (hdc=0x3c0109d7, hrgn=0x7f0409ff) returned 0 [0042.169] SelectClipRgn (hdc=0x3c0109d7, hrgn=0x5a0409f1) returned 2 [0042.169] DeleteObject (ho=0x7f0409ff) returned 1 [0042.169] DeleteObject (ho=0x5a0409f1) returned 1 [0042.169] OffsetViewportOrgEx (in: hdc=0x3c0109d7, x=0, y=0, lppt=0x27aea38 | out: lppt=0x27aea38) returned 1 [0042.169] OffsetViewportOrgEx (in: hdc=0x3c0109d7, x=-417, y=-278, lppt=0x27aea50 | out: lppt=0x27aea50) returned 1 [0042.169] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0042.169] GetCurrentObject (hdc=0x3c0109d7, type=0x1) returned 0x1b00017 [0042.169] GetCurrentObject (hdc=0x3c0109d7, type=0x2) returned 0x1900010 [0042.169] GetCurrentObject (hdc=0x3c0109d7, type=0x7) returned 0x790509c0 [0042.169] GetCurrentObject (hdc=0x3c0109d7, type=0x6) returned 0x18a002e [0042.169] SaveDC (hdc=0x3c0109d7) returned 2 [0042.169] GetNearestColor (hdc=0x3c0109d7, color=0x6c4607) returned 0x6c4607 [0042.169] CreateSolidBrush (color=0x6c4607) returned 0x65100276 [0042.169] FillRect (hDC=0x3c0109d7, lprc=0x26de08, hbr=0x65100276) returned 1 [0042.175] DeleteObject (ho=0x65100276) returned 1 [0042.175] RestoreDC (hdc=0x3c0109d7, nSavedDC=-1) returned 1 [0042.175] RestoreDC (hdc=0x3c0109d7, nSavedDC=-1) returned 1 [0042.175] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3c0109d7) returned 0x0 [0042.175] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd6c0dbd) returned 0x0 [0042.175] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0042.175] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.175] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.175] GetSystemMetrics (nIndex=42) returned 0 [0042.175] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.175] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.175] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0042.176] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0042.176] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0042.176] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0042.176] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0042.176] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0042.176] GetCurrentObject (hdc=0x3c0109d7, type=0x1) returned 0x1b00017 [0042.176] GetCurrentObject (hdc=0x3c0109d7, type=0x2) returned 0x1900010 [0042.176] GetCurrentObject (hdc=0x3c0109d7, type=0x7) returned 0x790509c0 [0042.176] GetCurrentObject (hdc=0x3c0109d7, type=0x6) returned 0x18a002e [0042.176] SaveDC (hdc=0x3c0109d7) returned 1 [0042.176] GetNearestColor (hdc=0x3c0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0042.176] RestoreDC (hdc=0x3c0109d7, nSavedDC=-1) returned 1 [0042.176] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3c0109d7) returned 0x0 [0042.176] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0042.176] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0042.176] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0042.176] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0042.176] GetCurrentObject (hdc=0x3c0109d7, type=0x1) returned 0x1b00017 [0042.176] GetCurrentObject (hdc=0x3c0109d7, type=0x2) returned 0x1900010 [0042.176] GetCurrentObject (hdc=0x3c0109d7, type=0x7) returned 0x790509c0 [0042.176] GetCurrentObject (hdc=0x3c0109d7, type=0x6) returned 0x18a002e [0042.176] SaveDC (hdc=0x3c0109d7) returned 1 [0042.176] GetTextAlign (hdc=0x3c0109d7) returned 0x0 [0042.177] GetTextColor (hdc=0x3c0109d7) returned 0x0 [0042.177] SetTextColor (hdc=0x3c0109d7, color=0xf0f0f0) returned 0x0 [0042.177] GetCurrentObject (hdc=0x3c0109d7, type=0x6) returned 0x18a002e [0042.177] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0042.177] SelectObject (hdc=0x3c0109d7, h=0x260a09ba) returned 0x18a002e [0042.177] GetBkMode (hdc=0x3c0109d7) returned 2 [0042.177] SetBkMode (hdc=0x3c0109d7, mode=1) returned 2 [0042.177] DrawTextExW (in: hdc=0x3c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27af700 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0042.177] DrawTextExW (in: hdc=0x3c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27af700 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0042.177] RestoreDC (hdc=0x3c0109d7, nSavedDC=-1) returned 1 [0042.177] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3c0109d7) returned 0x0 [0042.177] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0042.178] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x3c0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0042.178] GdipReleaseDC (graphics=0x1b86d040, hdc=0x3c0109d7) returned 0x0 [0042.178] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0042.178] SelectObject (hdc=0x3c0109d7, h=0x185000f) returned 0x790509c0 [0042.178] DeleteDC (hdc=0x3c0109d7) returned 1 [0042.178] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0042.178] DeleteObject (ho=0x790509c0) returned 1 [0042.181] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0042.181] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.182] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.182] WaitMessage () returned 1 [0042.305] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.306] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.306] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.306] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.306] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.306] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0042.306] GetCurrentThreadId () returned 0xa28 [0042.306] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0042.306] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.306] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.306] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.306] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.306] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.306] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0042.306] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0042.306] CreateCompatibleDC (hdc=0x60109d6) returned 0x4a0109d2 [0042.306] GetObjectType (h=0x60109d6) returned 0x3 [0042.306] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x7a0509c0 [0042.306] GetDIBits (in: hdc=0x60109d6, hbm=0x7a0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.306] GetDIBits (in: hdc=0x60109d6, hbm=0x7a0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.307] DeleteObject (ho=0x7a0509c0) returned 1 [0042.307] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x3d0509d7 [0042.307] SelectObject (hdc=0x4a0109d2, h=0x3d0509d7) returned 0x185000f [0042.307] GdipCreateFromHDC (hdc=0x4a0109d2, graphics=0x26e408) returned 0x0 [0042.307] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0042.307] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0042.307] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0042.307] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0042.307] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0042.307] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d49a0 [0042.307] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d49a0) returned 0x0 [0042.307] LocalFree (hMem=0x1a7d49a0) returned 0x0 [0042.307] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0042.307] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0042.307] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0042.307] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0042.308] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0042.308] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.308] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.308] GetSystemMetrics (nIndex=42) returned 0 [0042.308] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.308] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.308] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0042.308] IsAppThemed () returned 0x1 [0042.308] GetThemeAppProperties () returned 0x3 [0042.308] GetThemeAppProperties () returned 0x3 [0042.308] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0042.308] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0042.308] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0042.308] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0042.308] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0042.308] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d49a0 [0042.308] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d49a0) returned 0x0 [0042.308] LocalFree (hMem=0x1a7d49a0) returned 0x0 [0042.308] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0042.308] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d49a0 [0042.308] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d49a0) returned 0x0 [0042.308] LocalFree (hMem=0x1a7d49a0) returned 0x0 [0042.308] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0042.308] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0042.308] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0042.308] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0042.308] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0042.308] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0042.308] GetCurrentObject (hdc=0x4a0109d2, type=0x1) returned 0x1b00017 [0042.308] GetCurrentObject (hdc=0x4a0109d2, type=0x2) returned 0x1900010 [0042.309] GetCurrentObject (hdc=0x4a0109d2, type=0x7) returned 0x3d0509d7 [0042.309] GetCurrentObject (hdc=0x4a0109d2, type=0x6) returned 0x18a002e [0042.309] SaveDC (hdc=0x4a0109d2) returned 1 [0042.309] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5b0409f1 [0042.309] GetClipRgn (hdc=0x4a0109d2, hrgn=0x5b0409f1) returned 0 [0042.309] SelectClipRgn (hdc=0x4a0109d2, hrgn=0xffffffff820409ff) returned 2 [0042.309] DeleteObject (ho=0x5b0409f1) returned 1 [0042.309] DeleteObject (ho=0xffffffff820409ff) returned 1 [0042.309] OffsetViewportOrgEx (in: hdc=0x4a0109d2, x=0, y=0, lppt=0x27b12e0 | out: lppt=0x27b12e0) returned 1 [0042.309] OffsetViewportOrgEx (in: hdc=0x4a0109d2, x=-417, y=-278, lppt=0x27b12f8 | out: lppt=0x27b12f8) returned 1 [0042.309] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0042.309] GetCurrentObject (hdc=0x4a0109d2, type=0x1) returned 0x1b00017 [0042.309] GetCurrentObject (hdc=0x4a0109d2, type=0x2) returned 0x1900010 [0042.309] GetCurrentObject (hdc=0x4a0109d2, type=0x7) returned 0x3d0509d7 [0042.309] GetCurrentObject (hdc=0x4a0109d2, type=0x6) returned 0x18a002e [0042.309] SaveDC (hdc=0x4a0109d2) returned 2 [0042.309] GetNearestColor (hdc=0x4a0109d2, color=0x6c4607) returned 0x6c4607 [0042.309] CreateSolidBrush (color=0x6c4607) returned 0x66100276 [0042.309] FillRect (hDC=0x4a0109d2, lprc=0x26de08, hbr=0x66100276) returned 1 [0042.316] DeleteObject (ho=0x66100276) returned 1 [0042.316] RestoreDC (hdc=0x4a0109d2, nSavedDC=-1) returned 1 [0042.316] RestoreDC (hdc=0x4a0109d2, nSavedDC=-1) returned 1 [0042.316] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4a0109d2) returned 0x0 [0042.316] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd6a0dbd) returned 0x0 [0042.316] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0042.316] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.316] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.316] GetSystemMetrics (nIndex=42) returned 0 [0042.316] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.316] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.316] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x28) returned 0x0 [0042.318] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0042.318] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0042.318] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0042.318] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0042.318] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0042.318] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0042.318] GetCurrentObject (hdc=0x4a0109d2, type=0x1) returned 0x1b00017 [0042.318] GetCurrentObject (hdc=0x4a0109d2, type=0x2) returned 0x1900010 [0042.318] GetCurrentObject (hdc=0x4a0109d2, type=0x7) returned 0x3d0509d7 [0042.318] GetCurrentObject (hdc=0x4a0109d2, type=0x6) returned 0x18a002e [0042.318] SaveDC (hdc=0x4a0109d2) returned 1 [0042.318] GetNearestColor (hdc=0x4a0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0042.318] RestoreDC (hdc=0x4a0109d2, nSavedDC=-1) returned 1 [0042.318] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4a0109d2) returned 0x0 [0042.318] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0042.318] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0042.318] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0042.318] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0042.318] GetCurrentObject (hdc=0x4a0109d2, type=0x1) returned 0x1b00017 [0042.318] GetCurrentObject (hdc=0x4a0109d2, type=0x2) returned 0x1900010 [0042.318] GetCurrentObject (hdc=0x4a0109d2, type=0x7) returned 0x3d0509d7 [0042.318] GetCurrentObject (hdc=0x4a0109d2, type=0x6) returned 0x18a002e [0042.318] SaveDC (hdc=0x4a0109d2) returned 1 [0042.319] GetTextAlign (hdc=0x4a0109d2) returned 0x0 [0042.319] GetTextColor (hdc=0x4a0109d2) returned 0x0 [0042.319] SetTextColor (hdc=0x4a0109d2, color=0xf0f0f0) returned 0x0 [0042.319] GetCurrentObject (hdc=0x4a0109d2, type=0x6) returned 0x18a002e [0042.319] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0042.319] SelectObject (hdc=0x4a0109d2, h=0x260a09ba) returned 0x18a002e [0042.319] GetBkMode (hdc=0x4a0109d2) returned 2 [0042.319] SetBkMode (hdc=0x4a0109d2, mode=1) returned 2 [0042.319] DrawTextExW (in: hdc=0x4a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27b21f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0042.319] DrawTextExW (in: hdc=0x4a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27b21f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0042.320] RestoreDC (hdc=0x4a0109d2, nSavedDC=-1) returned 1 [0042.320] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4a0109d2) returned 0x0 [0042.320] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0042.320] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x4a0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0042.320] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4a0109d2) returned 0x0 [0042.320] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0042.320] SelectObject (hdc=0x4a0109d2, h=0x185000f) returned 0x3d0509d7 [0042.320] DeleteDC (hdc=0x4a0109d2) returned 1 [0042.320] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0042.320] DeleteObject (ho=0x3d0509d7) returned 1 [0042.324] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0042.324] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.324] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.324] WaitMessage () returned 1 [0042.446] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.446] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.446] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.446] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.446] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.446] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0042.446] GetCurrentThreadId () returned 0xa28 [0042.446] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0042.446] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.446] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.446] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.446] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.446] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.446] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0042.446] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0042.446] CreateCompatibleDC (hdc=0x60109d6) returned 0x7c0109c0 [0042.446] GetObjectType (h=0x60109d6) returned 0x3 [0042.446] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x3e0509d7 [0042.446] GetDIBits (in: hdc=0x60109d6, hbm=0x3e0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.447] GetDIBits (in: hdc=0x60109d6, hbm=0x3e0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.447] DeleteObject (ho=0x3e0509d7) returned 1 [0042.447] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4b0509d2 [0042.447] SelectObject (hdc=0x7c0109c0, h=0x4b0509d2) returned 0x185000f [0042.447] GdipCreateFromHDC (hdc=0x7c0109c0, graphics=0x26e408) returned 0x0 [0042.447] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0042.447] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0042.447] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0042.447] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0042.447] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0042.447] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4a20 [0042.447] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4a20) returned 0x0 [0042.447] LocalFree (hMem=0x1a7d4a20) returned 0x0 [0042.447] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0042.447] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0042.447] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0042.448] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0042.448] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0042.448] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.448] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.448] GetSystemMetrics (nIndex=42) returned 0 [0042.448] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.448] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.448] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0042.448] IsAppThemed () returned 0x1 [0042.448] GetThemeAppProperties () returned 0x3 [0042.448] GetThemeAppProperties () returned 0x3 [0042.448] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0042.448] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0042.448] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0042.448] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0042.448] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0042.448] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4a20 [0042.448] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4a20) returned 0x0 [0042.448] LocalFree (hMem=0x1a7d4a20) returned 0x0 [0042.448] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0042.448] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4a20 [0042.448] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4a20) returned 0x0 [0042.448] LocalFree (hMem=0x1a7d4a20) returned 0x0 [0042.448] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0042.448] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0042.448] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0042.448] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0042.448] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0042.448] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0042.448] GetCurrentObject (hdc=0x7c0109c0, type=0x1) returned 0x1b00017 [0042.449] GetCurrentObject (hdc=0x7c0109c0, type=0x2) returned 0x1900010 [0042.449] GetCurrentObject (hdc=0x7c0109c0, type=0x7) returned 0x4b0509d2 [0042.449] GetCurrentObject (hdc=0x7c0109c0, type=0x6) returned 0x18a002e [0042.449] SaveDC (hdc=0x7c0109c0) returned 1 [0042.449] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff830409ff [0042.449] GetClipRgn (hdc=0x7c0109c0, hrgn=0xffffffff830409ff) returned 0 [0042.449] SelectClipRgn (hdc=0x7c0109c0, hrgn=0x5e0409f1) returned 2 [0042.449] DeleteObject (ho=0xffffffff830409ff) returned 1 [0042.449] DeleteObject (ho=0x5e0409f1) returned 1 [0042.449] OffsetViewportOrgEx (in: hdc=0x7c0109c0, x=0, y=0, lppt=0x27b3dd8 | out: lppt=0x27b3dd8) returned 1 [0042.449] OffsetViewportOrgEx (in: hdc=0x7c0109c0, x=-417, y=-278, lppt=0x27b3df0 | out: lppt=0x27b3df0) returned 1 [0042.449] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0042.449] GetCurrentObject (hdc=0x7c0109c0, type=0x1) returned 0x1b00017 [0042.449] GetCurrentObject (hdc=0x7c0109c0, type=0x2) returned 0x1900010 [0042.449] GetCurrentObject (hdc=0x7c0109c0, type=0x7) returned 0x4b0509d2 [0042.449] GetCurrentObject (hdc=0x7c0109c0, type=0x6) returned 0x18a002e [0042.449] SaveDC (hdc=0x7c0109c0) returned 2 [0042.449] GetNearestColor (hdc=0x7c0109c0, color=0x6c4607) returned 0x6c4607 [0042.449] CreateSolidBrush (color=0x6c4607) returned 0x67100276 [0042.449] FillRect (hDC=0x7c0109c0, lprc=0x26de08, hbr=0x67100276) returned 1 [0042.456] DeleteObject (ho=0x67100276) returned 1 [0042.456] RestoreDC (hdc=0x7c0109c0, nSavedDC=-1) returned 1 [0042.456] RestoreDC (hdc=0x7c0109c0, nSavedDC=-1) returned 1 [0042.456] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7c0109c0) returned 0x0 [0042.456] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd680dbd) returned 0x0 [0042.456] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0042.456] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.456] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.456] GetSystemMetrics (nIndex=42) returned 0 [0042.456] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.456] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.456] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0042.456] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0042.456] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0042.456] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0042.456] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0042.456] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0042.456] GetCurrentObject (hdc=0x7c0109c0, type=0x1) returned 0x1b00017 [0042.456] GetCurrentObject (hdc=0x7c0109c0, type=0x2) returned 0x1900010 [0042.456] GetCurrentObject (hdc=0x7c0109c0, type=0x7) returned 0x4b0509d2 [0042.456] GetCurrentObject (hdc=0x7c0109c0, type=0x6) returned 0x18a002e [0042.456] SaveDC (hdc=0x7c0109c0) returned 1 [0042.456] GetNearestColor (hdc=0x7c0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0042.456] RestoreDC (hdc=0x7c0109c0, nSavedDC=-1) returned 1 [0042.456] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7c0109c0) returned 0x0 [0042.457] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0042.457] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0042.457] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0042.457] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0042.457] GetCurrentObject (hdc=0x7c0109c0, type=0x1) returned 0x1b00017 [0042.457] GetCurrentObject (hdc=0x7c0109c0, type=0x2) returned 0x1900010 [0042.457] GetCurrentObject (hdc=0x7c0109c0, type=0x7) returned 0x4b0509d2 [0042.457] GetCurrentObject (hdc=0x7c0109c0, type=0x6) returned 0x18a002e [0042.457] SaveDC (hdc=0x7c0109c0) returned 1 [0042.457] GetTextAlign (hdc=0x7c0109c0) returned 0x0 [0042.457] GetTextColor (hdc=0x7c0109c0) returned 0x0 [0042.457] SetTextColor (hdc=0x7c0109c0, color=0xf0f0f0) returned 0x0 [0042.457] GetCurrentObject (hdc=0x7c0109c0, type=0x6) returned 0x18a002e [0042.457] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0042.457] SelectObject (hdc=0x7c0109c0, h=0x260a09ba) returned 0x18a002e [0042.457] GetBkMode (hdc=0x7c0109c0) returned 2 [0042.457] SetBkMode (hdc=0x7c0109c0, mode=1) returned 2 [0042.457] DrawTextExW (in: hdc=0x7c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27b4aa0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0042.458] DrawTextExW (in: hdc=0x7c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27b4aa0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0042.458] RestoreDC (hdc=0x7c0109c0, nSavedDC=-1) returned 1 [0042.458] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7c0109c0) returned 0x0 [0042.458] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0042.458] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x7c0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0042.458] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7c0109c0) returned 0x0 [0042.458] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0042.458] SelectObject (hdc=0x7c0109c0, h=0x185000f) returned 0x4b0509d2 [0042.458] DeleteDC (hdc=0x7c0109c0) returned 1 [0042.459] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0042.459] DeleteObject (ho=0x4b0509d2) returned 1 [0042.462] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0042.462] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.462] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.462] WaitMessage () returned 1 [0042.587] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.587] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.587] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.587] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.587] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.587] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0042.587] GetCurrentThreadId () returned 0xa28 [0042.587] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0042.587] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.587] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.587] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.587] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.587] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.587] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0042.587] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0042.587] CreateCompatibleDC (hdc=0x60109d6) returned 0x400109d7 [0042.587] GetObjectType (h=0x60109d6) returned 0x3 [0042.587] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x4c0509d2 [0042.587] GetDIBits (in: hdc=0x60109d6, hbm=0x4c0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.587] GetDIBits (in: hdc=0x60109d6, hbm=0x4c0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.587] DeleteObject (ho=0x4c0509d2) returned 1 [0042.588] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x7d0509c0 [0042.588] SelectObject (hdc=0x400109d7, h=0x7d0509c0) returned 0x185000f [0042.588] GdipCreateFromHDC (hdc=0x400109d7, graphics=0x26e408) returned 0x0 [0042.588] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0042.588] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0042.588] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0042.588] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0042.588] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0042.588] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4a20 [0042.588] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4a20) returned 0x0 [0042.588] LocalFree (hMem=0x1a7d4a20) returned 0x0 [0042.588] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0042.588] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0042.588] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0042.588] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0042.588] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0042.588] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.589] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.589] GetSystemMetrics (nIndex=42) returned 0 [0042.589] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.589] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.589] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0042.589] IsAppThemed () returned 0x1 [0042.589] GetThemeAppProperties () returned 0x3 [0042.589] GetThemeAppProperties () returned 0x3 [0042.589] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0042.589] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0042.589] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0042.589] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0042.589] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0042.589] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4a20 [0042.589] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4a20) returned 0x0 [0042.589] LocalFree (hMem=0x1a7d4a20) returned 0x0 [0042.589] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0042.589] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4a20 [0042.589] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4a20) returned 0x0 [0042.589] LocalFree (hMem=0x1a7d4a20) returned 0x0 [0042.589] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0042.589] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0042.589] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0042.589] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0042.589] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0042.589] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0042.589] GetCurrentObject (hdc=0x400109d7, type=0x1) returned 0x1b00017 [0042.590] GetCurrentObject (hdc=0x400109d7, type=0x2) returned 0x1900010 [0042.590] GetCurrentObject (hdc=0x400109d7, type=0x7) returned 0x7d0509c0 [0042.590] GetCurrentObject (hdc=0x400109d7, type=0x6) returned 0x18a002e [0042.590] SaveDC (hdc=0x400109d7) returned 1 [0042.590] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5f0409f1 [0042.590] GetClipRgn (hdc=0x400109d7, hrgn=0x5f0409f1) returned 0 [0042.590] SelectClipRgn (hdc=0x400109d7, hrgn=0xffffffff860409ff) returned 2 [0042.590] DeleteObject (ho=0x5f0409f1) returned 1 [0042.590] DeleteObject (ho=0xffffffff860409ff) returned 1 [0042.590] OffsetViewportOrgEx (in: hdc=0x400109d7, x=0, y=0, lppt=0x27b6680 | out: lppt=0x27b6680) returned 1 [0042.590] OffsetViewportOrgEx (in: hdc=0x400109d7, x=-417, y=-278, lppt=0x27b6698 | out: lppt=0x27b6698) returned 1 [0042.590] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0042.590] GetCurrentObject (hdc=0x400109d7, type=0x1) returned 0x1b00017 [0042.590] GetCurrentObject (hdc=0x400109d7, type=0x2) returned 0x1900010 [0042.590] GetCurrentObject (hdc=0x400109d7, type=0x7) returned 0x7d0509c0 [0042.590] GetCurrentObject (hdc=0x400109d7, type=0x6) returned 0x18a002e [0042.590] SaveDC (hdc=0x400109d7) returned 2 [0042.590] GetNearestColor (hdc=0x400109d7, color=0x6c4607) returned 0x6c4607 [0042.590] CreateSolidBrush (color=0x6c4607) returned 0x68100276 [0042.590] FillRect (hDC=0x400109d7, lprc=0x26de08, hbr=0x68100276) returned 1 [0042.596] DeleteObject (ho=0x68100276) returned 1 [0042.596] RestoreDC (hdc=0x400109d7, nSavedDC=-1) returned 1 [0042.596] RestoreDC (hdc=0x400109d7, nSavedDC=-1) returned 1 [0042.596] GdipReleaseDC (graphics=0x1b86d040, hdc=0x400109d7) returned 0x0 [0042.596] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd660dbd) returned 0x0 [0042.596] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0042.596] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.596] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.596] GetSystemMetrics (nIndex=42) returned 0 [0042.596] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.596] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.596] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2a) returned 0x0 [0042.597] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0042.597] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0042.597] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0042.597] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0042.597] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0042.597] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0042.597] GetCurrentObject (hdc=0x400109d7, type=0x1) returned 0x1b00017 [0042.598] GetCurrentObject (hdc=0x400109d7, type=0x2) returned 0x1900010 [0042.598] GetCurrentObject (hdc=0x400109d7, type=0x7) returned 0x7d0509c0 [0042.598] GetCurrentObject (hdc=0x400109d7, type=0x6) returned 0x18a002e [0042.598] SaveDC (hdc=0x400109d7) returned 1 [0042.598] GetNearestColor (hdc=0x400109d7, color=0xf0f0f0) returned 0xf0f0f0 [0042.598] RestoreDC (hdc=0x400109d7, nSavedDC=-1) returned 1 [0042.598] GdipReleaseDC (graphics=0x1b86d040, hdc=0x400109d7) returned 0x0 [0042.598] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0042.598] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0042.598] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0042.598] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0042.598] GetCurrentObject (hdc=0x400109d7, type=0x1) returned 0x1b00017 [0042.598] GetCurrentObject (hdc=0x400109d7, type=0x2) returned 0x1900010 [0042.598] GetCurrentObject (hdc=0x400109d7, type=0x7) returned 0x7d0509c0 [0042.598] GetCurrentObject (hdc=0x400109d7, type=0x6) returned 0x18a002e [0042.598] SaveDC (hdc=0x400109d7) returned 1 [0042.598] GetTextAlign (hdc=0x400109d7) returned 0x0 [0042.598] GetTextColor (hdc=0x400109d7) returned 0x0 [0042.598] SetTextColor (hdc=0x400109d7, color=0xf0f0f0) returned 0x0 [0042.598] GetCurrentObject (hdc=0x400109d7, type=0x6) returned 0x18a002e [0042.598] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0042.599] SelectObject (hdc=0x400109d7, h=0x260a09ba) returned 0x18a002e [0042.599] GetBkMode (hdc=0x400109d7) returned 2 [0042.599] SetBkMode (hdc=0x400109d7, mode=1) returned 2 [0042.599] DrawTextExW (in: hdc=0x400109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27b7598 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0042.599] DrawTextExW (in: hdc=0x400109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27b7598 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0042.599] RestoreDC (hdc=0x400109d7, nSavedDC=-1) returned 1 [0042.599] GdipReleaseDC (graphics=0x1b86d040, hdc=0x400109d7) returned 0x0 [0042.599] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0042.599] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x400109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0042.599] GdipReleaseDC (graphics=0x1b86d040, hdc=0x400109d7) returned 0x0 [0042.600] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0042.600] SelectObject (hdc=0x400109d7, h=0x185000f) returned 0x7d0509c0 [0042.600] DeleteDC (hdc=0x400109d7) returned 1 [0042.600] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0042.600] DeleteObject (ho=0x7d0509c0) returned 1 [0042.603] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0042.603] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.603] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.603] WaitMessage () returned 1 [0042.742] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.742] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.742] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.742] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.742] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.742] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0042.742] GetCurrentThreadId () returned 0xa28 [0042.742] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0042.742] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.742] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.742] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.742] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.742] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.743] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0042.743] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0042.743] CreateCompatibleDC (hdc=0x60109d6) returned 0x4e0109d2 [0042.743] GetObjectType (h=0x60109d6) returned 0x3 [0042.743] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x7e0509c0 [0042.743] GetDIBits (in: hdc=0x60109d6, hbm=0x7e0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.743] GetDIBits (in: hdc=0x60109d6, hbm=0x7e0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.743] DeleteObject (ho=0x7e0509c0) returned 1 [0042.743] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x410509d7 [0042.743] SelectObject (hdc=0x4e0109d2, h=0x410509d7) returned 0x185000f [0042.743] GdipCreateFromHDC (hdc=0x4e0109d2, graphics=0x26e408) returned 0x0 [0042.744] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0042.744] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0042.744] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0042.744] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0042.744] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0042.744] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4aa0 [0042.744] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4aa0) returned 0x0 [0042.744] LocalFree (hMem=0x1a7d4aa0) returned 0x0 [0042.744] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0042.744] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0042.744] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0042.744] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0042.744] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0042.744] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.744] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.744] GetSystemMetrics (nIndex=42) returned 0 [0042.744] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.744] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.744] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0042.744] IsAppThemed () returned 0x1 [0042.744] GetThemeAppProperties () returned 0x3 [0042.744] GetThemeAppProperties () returned 0x3 [0042.744] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0042.744] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0042.744] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0042.745] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0042.745] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0042.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4aa0 [0042.745] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4aa0) returned 0x0 [0042.745] LocalFree (hMem=0x1a7d4aa0) returned 0x0 [0042.745] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0042.745] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4aa0 [0042.745] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4aa0) returned 0x0 [0042.745] LocalFree (hMem=0x1a7d4aa0) returned 0x0 [0042.745] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0042.745] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0042.745] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0042.745] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0042.745] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0042.745] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0042.745] GetCurrentObject (hdc=0x4e0109d2, type=0x1) returned 0x1b00017 [0042.745] GetCurrentObject (hdc=0x4e0109d2, type=0x2) returned 0x1900010 [0042.745] GetCurrentObject (hdc=0x4e0109d2, type=0x7) returned 0x410509d7 [0042.745] GetCurrentObject (hdc=0x4e0109d2, type=0x6) returned 0x18a002e [0042.745] SaveDC (hdc=0x4e0109d2) returned 1 [0042.745] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff870409ff [0042.745] GetClipRgn (hdc=0x4e0109d2, hrgn=0xffffffff870409ff) returned 0 [0042.745] SelectClipRgn (hdc=0x4e0109d2, hrgn=0x620409f1) returned 2 [0042.745] DeleteObject (ho=0xffffffff870409ff) returned 1 [0042.745] DeleteObject (ho=0x620409f1) returned 1 [0042.745] OffsetViewportOrgEx (in: hdc=0x4e0109d2, x=0, y=0, lppt=0x27b9178 | out: lppt=0x27b9178) returned 1 [0042.745] OffsetViewportOrgEx (in: hdc=0x4e0109d2, x=-417, y=-278, lppt=0x27b9190 | out: lppt=0x27b9190) returned 1 [0042.745] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0042.746] GetCurrentObject (hdc=0x4e0109d2, type=0x1) returned 0x1b00017 [0042.746] GetCurrentObject (hdc=0x4e0109d2, type=0x2) returned 0x1900010 [0042.746] GetCurrentObject (hdc=0x4e0109d2, type=0x7) returned 0x410509d7 [0042.746] GetCurrentObject (hdc=0x4e0109d2, type=0x6) returned 0x18a002e [0042.746] SaveDC (hdc=0x4e0109d2) returned 2 [0042.746] GetNearestColor (hdc=0x4e0109d2, color=0x6c4607) returned 0x6c4607 [0042.746] CreateSolidBrush (color=0x6c4607) returned 0x69100276 [0042.746] FillRect (hDC=0x4e0109d2, lprc=0x26de08, hbr=0x69100276) returned 1 [0042.750] DeleteObject (ho=0x69100276) returned 1 [0042.750] RestoreDC (hdc=0x4e0109d2, nSavedDC=-1) returned 1 [0042.750] RestoreDC (hdc=0x4e0109d2, nSavedDC=-1) returned 1 [0042.750] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4e0109d2) returned 0x0 [0042.750] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd640dbd) returned 0x0 [0042.750] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0042.750] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.750] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.750] GetSystemMetrics (nIndex=42) returned 0 [0042.750] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.750] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.750] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0042.750] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0042.750] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0042.750] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0042.750] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0042.750] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0042.750] GetCurrentObject (hdc=0x4e0109d2, type=0x1) returned 0x1b00017 [0042.750] GetCurrentObject (hdc=0x4e0109d2, type=0x2) returned 0x1900010 [0042.750] GetCurrentObject (hdc=0x4e0109d2, type=0x7) returned 0x410509d7 [0042.750] GetCurrentObject (hdc=0x4e0109d2, type=0x6) returned 0x18a002e [0042.750] SaveDC (hdc=0x4e0109d2) returned 1 [0042.750] GetNearestColor (hdc=0x4e0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0042.750] RestoreDC (hdc=0x4e0109d2, nSavedDC=-1) returned 1 [0042.750] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4e0109d2) returned 0x0 [0042.751] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0042.751] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0042.751] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0042.751] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0042.751] GetCurrentObject (hdc=0x4e0109d2, type=0x1) returned 0x1b00017 [0042.751] GetCurrentObject (hdc=0x4e0109d2, type=0x2) returned 0x1900010 [0042.751] GetCurrentObject (hdc=0x4e0109d2, type=0x7) returned 0x410509d7 [0042.751] GetCurrentObject (hdc=0x4e0109d2, type=0x6) returned 0x18a002e [0042.751] SaveDC (hdc=0x4e0109d2) returned 1 [0042.751] GetTextAlign (hdc=0x4e0109d2) returned 0x0 [0042.751] GetTextColor (hdc=0x4e0109d2) returned 0x0 [0042.751] SetTextColor (hdc=0x4e0109d2, color=0xf0f0f0) returned 0x0 [0042.751] GetCurrentObject (hdc=0x4e0109d2, type=0x6) returned 0x18a002e [0042.751] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0042.751] SelectObject (hdc=0x4e0109d2, h=0x260a09ba) returned 0x18a002e [0042.751] GetBkMode (hdc=0x4e0109d2) returned 2 [0042.751] SetBkMode (hdc=0x4e0109d2, mode=1) returned 2 [0042.751] DrawTextExW (in: hdc=0x4e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27b9e40 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0042.752] DrawTextExW (in: hdc=0x4e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27b9e40 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0042.752] RestoreDC (hdc=0x4e0109d2, nSavedDC=-1) returned 1 [0042.752] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4e0109d2) returned 0x0 [0042.752] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0042.752] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x4e0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0042.752] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4e0109d2) returned 0x0 [0042.752] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0042.752] SelectObject (hdc=0x4e0109d2, h=0x185000f) returned 0x410509d7 [0042.752] DeleteDC (hdc=0x4e0109d2) returned 1 [0042.753] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0042.753] DeleteObject (ho=0x410509d7) returned 1 [0042.756] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0042.756] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.756] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.756] WaitMessage () returned 1 [0042.867] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.867] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.867] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.867] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.867] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.867] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0042.867] GetCurrentThreadId () returned 0xa28 [0042.867] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0042.867] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.867] IsWindowUnicode (hWnd=0x3015e) returned 1 [0042.867] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0042.867] TranslateMessage (lpMsg=0x26ee10) returned 0 [0042.867] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0042.868] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0042.868] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0042.868] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff800109c0 [0042.868] GetObjectType (h=0x60109d6) returned 0x3 [0042.868] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x420509d7 [0042.868] GetDIBits (in: hdc=0x60109d6, hbm=0x420509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.868] GetDIBits (in: hdc=0x60109d6, hbm=0x420509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0042.868] DeleteObject (ho=0x420509d7) returned 1 [0042.868] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4f0509d2 [0042.868] SelectObject (hdc=0xffffffff800109c0, h=0x4f0509d2) returned 0x185000f [0042.868] GdipCreateFromHDC (hdc=0xffffffff800109c0, graphics=0x26e408) returned 0x0 [0042.868] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0042.868] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0042.868] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0042.868] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0042.869] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0042.869] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4aa0 [0042.869] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4aa0) returned 0x0 [0042.869] LocalFree (hMem=0x1a7d4aa0) returned 0x0 [0042.869] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0042.869] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0042.869] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0042.869] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0042.869] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0042.869] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.869] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.869] GetSystemMetrics (nIndex=42) returned 0 [0042.869] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.869] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.869] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0042.869] IsAppThemed () returned 0x1 [0042.869] GetThemeAppProperties () returned 0x3 [0042.869] GetThemeAppProperties () returned 0x3 [0042.869] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0042.869] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0042.869] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0042.869] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0042.869] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0042.869] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4aa0 [0042.869] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4aa0) returned 0x0 [0042.869] LocalFree (hMem=0x1a7d4aa0) returned 0x0 [0042.869] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0042.869] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4aa0 [0042.869] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4aa0) returned 0x0 [0042.870] LocalFree (hMem=0x1a7d4aa0) returned 0x0 [0042.870] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0042.870] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0042.870] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0042.870] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0042.870] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0042.870] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0042.870] GetCurrentObject (hdc=0xffffffff800109c0, type=0x1) returned 0x1b00017 [0042.870] GetCurrentObject (hdc=0xffffffff800109c0, type=0x2) returned 0x1900010 [0042.870] GetCurrentObject (hdc=0xffffffff800109c0, type=0x7) returned 0x4f0509d2 [0042.870] GetCurrentObject (hdc=0xffffffff800109c0, type=0x6) returned 0x18a002e [0042.870] SaveDC (hdc=0xffffffff800109c0) returned 1 [0042.870] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x630409f1 [0042.870] GetClipRgn (hdc=0xffffffff800109c0, hrgn=0x630409f1) returned 0 [0042.870] SelectClipRgn (hdc=0xffffffff800109c0, hrgn=0xffffffff8a0409ff) returned 2 [0042.870] DeleteObject (ho=0x630409f1) returned 1 [0042.870] DeleteObject (ho=0xffffffff8a0409ff) returned 1 [0042.870] OffsetViewportOrgEx (in: hdc=0xffffffff800109c0, x=0, y=0, lppt=0x27bba20 | out: lppt=0x27bba20) returned 1 [0042.870] OffsetViewportOrgEx (in: hdc=0xffffffff800109c0, x=-417, y=-278, lppt=0x27bba38 | out: lppt=0x27bba38) returned 1 [0042.870] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0042.870] GetCurrentObject (hdc=0xffffffff800109c0, type=0x1) returned 0x1b00017 [0042.870] GetCurrentObject (hdc=0xffffffff800109c0, type=0x2) returned 0x1900010 [0042.870] GetCurrentObject (hdc=0xffffffff800109c0, type=0x7) returned 0x4f0509d2 [0042.870] GetCurrentObject (hdc=0xffffffff800109c0, type=0x6) returned 0x18a002e [0042.870] SaveDC (hdc=0xffffffff800109c0) returned 2 [0042.870] GetNearestColor (hdc=0xffffffff800109c0, color=0x6c4607) returned 0x6c4607 [0042.870] CreateSolidBrush (color=0x6c4607) returned 0x6a100276 [0042.871] FillRect (hDC=0xffffffff800109c0, lprc=0x26de08, hbr=0x6a100276) returned 1 [0042.874] DeleteObject (ho=0x6a100276) returned 1 [0042.874] RestoreDC (hdc=0xffffffff800109c0, nSavedDC=-1) returned 1 [0042.874] RestoreDC (hdc=0xffffffff800109c0, nSavedDC=-1) returned 1 [0042.874] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff800109c0) returned 0x0 [0042.874] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd620dbd) returned 0x0 [0042.874] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0042.874] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0042.874] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0042.874] GetSystemMetrics (nIndex=42) returned 0 [0042.874] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0042.874] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0042.874] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2c) returned 0x0 [0042.875] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0042.875] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0042.875] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0042.875] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0042.876] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0042.876] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0042.876] GetCurrentObject (hdc=0xffffffff800109c0, type=0x1) returned 0x1b00017 [0042.876] GetCurrentObject (hdc=0xffffffff800109c0, type=0x2) returned 0x1900010 [0042.876] GetCurrentObject (hdc=0xffffffff800109c0, type=0x7) returned 0x4f0509d2 [0042.876] GetCurrentObject (hdc=0xffffffff800109c0, type=0x6) returned 0x18a002e [0042.876] SaveDC (hdc=0xffffffff800109c0) returned 1 [0042.876] GetNearestColor (hdc=0xffffffff800109c0, color=0xf0f0f0) returned 0xf0f0f0 [0042.876] RestoreDC (hdc=0xffffffff800109c0, nSavedDC=-1) returned 1 [0042.876] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff800109c0) returned 0x0 [0042.876] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0042.876] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0042.876] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0042.876] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0042.876] GetCurrentObject (hdc=0xffffffff800109c0, type=0x1) returned 0x1b00017 [0042.876] GetCurrentObject (hdc=0xffffffff800109c0, type=0x2) returned 0x1900010 [0042.876] GetCurrentObject (hdc=0xffffffff800109c0, type=0x7) returned 0x4f0509d2 [0042.876] GetCurrentObject (hdc=0xffffffff800109c0, type=0x6) returned 0x18a002e [0042.876] SaveDC (hdc=0xffffffff800109c0) returned 1 [0042.876] GetTextAlign (hdc=0xffffffff800109c0) returned 0x0 [0042.877] GetTextColor (hdc=0xffffffff800109c0) returned 0x0 [0042.877] SetTextColor (hdc=0xffffffff800109c0, color=0xf0f0f0) returned 0x0 [0042.877] GetCurrentObject (hdc=0xffffffff800109c0, type=0x6) returned 0x18a002e [0042.877] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0042.877] SelectObject (hdc=0xffffffff800109c0, h=0x260a09ba) returned 0x18a002e [0042.877] GetBkMode (hdc=0xffffffff800109c0) returned 2 [0042.877] SetBkMode (hdc=0xffffffff800109c0, mode=1) returned 2 [0042.877] DrawTextExW (in: hdc=0xffffffff800109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27bc948 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0042.877] DrawTextExW (in: hdc=0xffffffff800109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27bc948 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0042.877] RestoreDC (hdc=0xffffffff800109c0, nSavedDC=-1) returned 1 [0042.877] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff800109c0) returned 0x0 [0042.877] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0042.878] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff800109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0042.878] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff800109c0) returned 0x0 [0042.878] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0042.878] SelectObject (hdc=0xffffffff800109c0, h=0x185000f) returned 0x4f0509d2 [0042.878] DeleteDC (hdc=0xffffffff800109c0) returned 1 [0042.878] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0042.878] DeleteObject (ho=0x4f0509d2) returned 1 [0042.881] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0042.881] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.881] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0042.881] WaitMessage () returned 1 [0043.000] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.000] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.000] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.000] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.000] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.000] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0043.000] GetCurrentThreadId () returned 0xa28 [0043.000] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0043.000] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.001] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.001] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.001] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.001] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.001] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0043.001] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0043.001] CreateCompatibleDC (hdc=0x60109d6) returned 0x440109d7 [0043.001] GetObjectType (h=0x60109d6) returned 0x3 [0043.001] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x500509d2 [0043.001] GetDIBits (in: hdc=0x60109d6, hbm=0x500509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.001] GetDIBits (in: hdc=0x60109d6, hbm=0x500509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.001] DeleteObject (ho=0x500509d2) returned 1 [0043.001] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff810509c0 [0043.001] SelectObject (hdc=0x440109d7, h=0xffffffff810509c0) returned 0x185000f [0043.001] GdipCreateFromHDC (hdc=0x440109d7, graphics=0x26e408) returned 0x0 [0043.002] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0043.002] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0043.002] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0043.002] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0043.002] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0043.002] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4b20 [0043.002] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4b20) returned 0x0 [0043.002] LocalFree (hMem=0x1a7d4b20) returned 0x0 [0043.002] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0043.002] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0043.002] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0043.002] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0043.002] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0043.002] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.002] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.002] GetSystemMetrics (nIndex=42) returned 0 [0043.002] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.002] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.002] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0043.002] IsAppThemed () returned 0x1 [0043.002] GetThemeAppProperties () returned 0x3 [0043.002] GetThemeAppProperties () returned 0x3 [0043.002] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0043.002] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0043.002] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0043.003] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0043.003] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0043.003] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4b20 [0043.003] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4b20) returned 0x0 [0043.003] LocalFree (hMem=0x1a7d4b20) returned 0x0 [0043.003] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0043.003] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4b20 [0043.003] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4b20) returned 0x0 [0043.003] LocalFree (hMem=0x1a7d4b20) returned 0x0 [0043.003] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0043.003] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0043.003] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0043.003] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0043.003] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0043.003] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0043.003] GetCurrentObject (hdc=0x440109d7, type=0x1) returned 0x1b00017 [0043.003] GetCurrentObject (hdc=0x440109d7, type=0x2) returned 0x1900010 [0043.003] GetCurrentObject (hdc=0x440109d7, type=0x7) returned 0xffffffff810509c0 [0043.003] GetCurrentObject (hdc=0x440109d7, type=0x6) returned 0x18a002e [0043.003] SaveDC (hdc=0x440109d7) returned 1 [0043.003] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff8b0409ff [0043.003] GetClipRgn (hdc=0x440109d7, hrgn=0xffffffff8b0409ff) returned 0 [0043.003] SelectClipRgn (hdc=0x440109d7, hrgn=0x660409f1) returned 2 [0043.003] DeleteObject (ho=0xffffffff8b0409ff) returned 1 [0043.003] DeleteObject (ho=0x660409f1) returned 1 [0043.003] OffsetViewportOrgEx (in: hdc=0x440109d7, x=0, y=0, lppt=0x27be528 | out: lppt=0x27be528) returned 1 [0043.003] OffsetViewportOrgEx (in: hdc=0x440109d7, x=-417, y=-278, lppt=0x27be540 | out: lppt=0x27be540) returned 1 [0043.003] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0043.003] GetCurrentObject (hdc=0x440109d7, type=0x1) returned 0x1b00017 [0043.004] GetCurrentObject (hdc=0x440109d7, type=0x2) returned 0x1900010 [0043.004] GetCurrentObject (hdc=0x440109d7, type=0x7) returned 0xffffffff810509c0 [0043.004] GetCurrentObject (hdc=0x440109d7, type=0x6) returned 0x18a002e [0043.004] SaveDC (hdc=0x440109d7) returned 2 [0043.004] GetNearestColor (hdc=0x440109d7, color=0x6c4607) returned 0x6c4607 [0043.004] CreateSolidBrush (color=0x6c4607) returned 0x6b100276 [0043.004] FillRect (hDC=0x440109d7, lprc=0x26de08, hbr=0x6b100276) returned 1 [0043.007] DeleteObject (ho=0x6b100276) returned 1 [0043.007] RestoreDC (hdc=0x440109d7, nSavedDC=-1) returned 1 [0043.007] RestoreDC (hdc=0x440109d7, nSavedDC=-1) returned 1 [0043.007] GdipReleaseDC (graphics=0x1b86d040, hdc=0x440109d7) returned 0x0 [0043.008] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd600dbd) returned 0x0 [0043.008] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0043.008] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.008] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.008] GetSystemMetrics (nIndex=42) returned 0 [0043.008] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.008] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.008] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0043.008] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0043.008] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0043.008] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0043.008] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0043.008] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0043.008] GetCurrentObject (hdc=0x440109d7, type=0x1) returned 0x1b00017 [0043.008] GetCurrentObject (hdc=0x440109d7, type=0x2) returned 0x1900010 [0043.008] GetCurrentObject (hdc=0x440109d7, type=0x7) returned 0xffffffff810509c0 [0043.008] GetCurrentObject (hdc=0x440109d7, type=0x6) returned 0x18a002e [0043.008] SaveDC (hdc=0x440109d7) returned 1 [0043.008] GetNearestColor (hdc=0x440109d7, color=0xf0f0f0) returned 0xf0f0f0 [0043.008] RestoreDC (hdc=0x440109d7, nSavedDC=-1) returned 1 [0043.008] GdipReleaseDC (graphics=0x1b86d040, hdc=0x440109d7) returned 0x0 [0043.009] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0043.009] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0043.009] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0043.009] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0043.009] GetCurrentObject (hdc=0x440109d7, type=0x1) returned 0x1b00017 [0043.009] GetCurrentObject (hdc=0x440109d7, type=0x2) returned 0x1900010 [0043.009] GetCurrentObject (hdc=0x440109d7, type=0x7) returned 0xffffffff810509c0 [0043.009] GetCurrentObject (hdc=0x440109d7, type=0x6) returned 0x18a002e [0043.009] SaveDC (hdc=0x440109d7) returned 1 [0043.009] GetTextAlign (hdc=0x440109d7) returned 0x0 [0043.009] GetTextColor (hdc=0x440109d7) returned 0x0 [0043.009] SetTextColor (hdc=0x440109d7, color=0xf0f0f0) returned 0x0 [0043.009] GetCurrentObject (hdc=0x440109d7, type=0x6) returned 0x18a002e [0043.009] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0043.009] SelectObject (hdc=0x440109d7, h=0x260a09ba) returned 0x18a002e [0043.009] GetBkMode (hdc=0x440109d7) returned 2 [0043.009] SetBkMode (hdc=0x440109d7, mode=1) returned 2 [0043.009] DrawTextExW (in: hdc=0x440109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27bf1f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0043.009] DrawTextExW (in: hdc=0x440109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27bf1f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0043.010] RestoreDC (hdc=0x440109d7, nSavedDC=-1) returned 1 [0043.010] GdipReleaseDC (graphics=0x1b86d040, hdc=0x440109d7) returned 0x0 [0043.010] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0043.010] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x440109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0043.010] GdipReleaseDC (graphics=0x1b86d040, hdc=0x440109d7) returned 0x0 [0043.010] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0043.010] SelectObject (hdc=0x440109d7, h=0x185000f) returned 0xffffffff810509c0 [0043.010] DeleteDC (hdc=0x440109d7) returned 1 [0043.010] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0043.010] DeleteObject (ho=0xffffffff810509c0) returned 1 [0043.013] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0043.013] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.013] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.013] WaitMessage () returned 1 [0043.132] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.132] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.132] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.132] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.132] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.132] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0043.132] GetCurrentThreadId () returned 0xa28 [0043.132] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0043.132] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.132] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.132] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.132] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.132] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.132] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0043.133] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0043.133] CreateCompatibleDC (hdc=0x60109d6) returned 0x520109d2 [0043.133] GetObjectType (h=0x60109d6) returned 0x3 [0043.133] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff820509c0 [0043.133] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff820509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.133] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff820509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.133] DeleteObject (ho=0xffffffff820509c0) returned 1 [0043.133] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x450509d7 [0043.133] SelectObject (hdc=0x520109d2, h=0x450509d7) returned 0x185000f [0043.133] GdipCreateFromHDC (hdc=0x520109d2, graphics=0x26e408) returned 0x0 [0043.133] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0043.133] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0043.134] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0043.134] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0043.134] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0043.134] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4b20 [0043.134] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4b20) returned 0x0 [0043.134] LocalFree (hMem=0x1a7d4b20) returned 0x0 [0043.134] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0043.134] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0043.134] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0043.134] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0043.134] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0043.134] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.134] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.134] GetSystemMetrics (nIndex=42) returned 0 [0043.134] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.134] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.134] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0043.134] IsAppThemed () returned 0x1 [0043.134] GetThemeAppProperties () returned 0x3 [0043.134] GetThemeAppProperties () returned 0x3 [0043.134] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0043.134] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0043.134] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0043.134] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0043.134] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0043.134] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4b20 [0043.134] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4b20) returned 0x0 [0043.134] LocalFree (hMem=0x1a7d4b20) returned 0x0 [0043.135] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0043.135] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4b20 [0043.135] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4b20) returned 0x0 [0043.135] LocalFree (hMem=0x1a7d4b20) returned 0x0 [0043.135] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0043.135] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0043.135] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0043.135] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0043.135] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0043.135] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0043.135] GetCurrentObject (hdc=0x520109d2, type=0x1) returned 0x1b00017 [0043.135] GetCurrentObject (hdc=0x520109d2, type=0x2) returned 0x1900010 [0043.135] GetCurrentObject (hdc=0x520109d2, type=0x7) returned 0x450509d7 [0043.135] GetCurrentObject (hdc=0x520109d2, type=0x6) returned 0x18a002e [0043.135] SaveDC (hdc=0x520109d2) returned 1 [0043.135] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x670409f1 [0043.135] GetClipRgn (hdc=0x520109d2, hrgn=0x670409f1) returned 0 [0043.135] SelectClipRgn (hdc=0x520109d2, hrgn=0xffffffff8e0409ff) returned 2 [0043.135] DeleteObject (ho=0x670409f1) returned 1 [0043.135] DeleteObject (ho=0xffffffff8e0409ff) returned 1 [0043.135] OffsetViewportOrgEx (in: hdc=0x520109d2, x=0, y=0, lppt=0x27c0dd0 | out: lppt=0x27c0dd0) returned 1 [0043.135] OffsetViewportOrgEx (in: hdc=0x520109d2, x=-417, y=-278, lppt=0x27c0de8 | out: lppt=0x27c0de8) returned 1 [0043.135] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0043.135] GetCurrentObject (hdc=0x520109d2, type=0x1) returned 0x1b00017 [0043.135] GetCurrentObject (hdc=0x520109d2, type=0x2) returned 0x1900010 [0043.135] GetCurrentObject (hdc=0x520109d2, type=0x7) returned 0x450509d7 [0043.135] GetCurrentObject (hdc=0x520109d2, type=0x6) returned 0x18a002e [0043.135] SaveDC (hdc=0x520109d2) returned 2 [0043.136] GetNearestColor (hdc=0x520109d2, color=0x6c4607) returned 0x6c4607 [0043.136] CreateSolidBrush (color=0x6c4607) returned 0x6c100276 [0043.136] FillRect (hDC=0x520109d2, lprc=0x26de08, hbr=0x6c100276) returned 1 [0043.139] DeleteObject (ho=0x6c100276) returned 1 [0043.139] RestoreDC (hdc=0x520109d2, nSavedDC=-1) returned 1 [0043.139] RestoreDC (hdc=0x520109d2, nSavedDC=-1) returned 1 [0043.139] GdipReleaseDC (graphics=0x1b86d040, hdc=0x520109d2) returned 0x0 [0043.139] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd5e0dbd) returned 0x0 [0043.139] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0043.139] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.139] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.139] GetSystemMetrics (nIndex=42) returned 0 [0043.139] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.139] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.139] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2e) returned 0x0 [0043.140] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0043.140] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0043.140] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0043.140] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0043.141] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0043.141] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0043.141] GetCurrentObject (hdc=0x520109d2, type=0x1) returned 0x1b00017 [0043.141] GetCurrentObject (hdc=0x520109d2, type=0x2) returned 0x1900010 [0043.141] GetCurrentObject (hdc=0x520109d2, type=0x7) returned 0x450509d7 [0043.141] GetCurrentObject (hdc=0x520109d2, type=0x6) returned 0x18a002e [0043.141] SaveDC (hdc=0x520109d2) returned 1 [0043.141] GetNearestColor (hdc=0x520109d2, color=0xf0f0f0) returned 0xf0f0f0 [0043.141] RestoreDC (hdc=0x520109d2, nSavedDC=-1) returned 1 [0043.141] GdipReleaseDC (graphics=0x1b86d040, hdc=0x520109d2) returned 0x0 [0043.141] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0043.141] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0043.141] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0043.141] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0043.141] GetCurrentObject (hdc=0x520109d2, type=0x1) returned 0x1b00017 [0043.141] GetCurrentObject (hdc=0x520109d2, type=0x2) returned 0x1900010 [0043.141] GetCurrentObject (hdc=0x520109d2, type=0x7) returned 0x450509d7 [0043.141] GetCurrentObject (hdc=0x520109d2, type=0x6) returned 0x18a002e [0043.141] SaveDC (hdc=0x520109d2) returned 1 [0043.141] GetTextAlign (hdc=0x520109d2) returned 0x0 [0043.141] GetTextColor (hdc=0x520109d2) returned 0x0 [0043.142] SetTextColor (hdc=0x520109d2, color=0xf0f0f0) returned 0x0 [0043.142] GetCurrentObject (hdc=0x520109d2, type=0x6) returned 0x18a002e [0043.142] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0043.142] SelectObject (hdc=0x520109d2, h=0x260a09ba) returned 0x18a002e [0043.142] GetBkMode (hdc=0x520109d2) returned 2 [0043.142] SetBkMode (hdc=0x520109d2, mode=1) returned 2 [0043.142] DrawTextExW (in: hdc=0x520109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27c1ce8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0043.142] DrawTextExW (in: hdc=0x520109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27c1ce8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0043.142] RestoreDC (hdc=0x520109d2, nSavedDC=-1) returned 1 [0043.142] GdipReleaseDC (graphics=0x1b86d040, hdc=0x520109d2) returned 0x0 [0043.143] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0043.143] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x520109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0043.143] GdipReleaseDC (graphics=0x1b86d040, hdc=0x520109d2) returned 0x0 [0043.143] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0043.143] SelectObject (hdc=0x520109d2, h=0x185000f) returned 0x450509d7 [0043.143] DeleteDC (hdc=0x520109d2) returned 1 [0043.143] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0043.143] DeleteObject (ho=0x450509d7) returned 1 [0043.146] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0043.146] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.146] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.146] WaitMessage () returned 1 [0043.257] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.257] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.257] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.257] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.257] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.257] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0043.257] GetCurrentThreadId () returned 0xa28 [0043.257] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0043.257] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.257] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.257] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.257] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.258] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.258] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0043.258] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0043.258] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff840109c0 [0043.258] GetObjectType (h=0x60109d6) returned 0x3 [0043.258] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x460509d7 [0043.258] GetDIBits (in: hdc=0x60109d6, hbm=0x460509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.259] GetDIBits (in: hdc=0x60109d6, hbm=0x460509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.259] DeleteObject (ho=0x460509d7) returned 1 [0043.259] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x530509d2 [0043.259] SelectObject (hdc=0xffffffff840109c0, h=0x530509d2) returned 0x185000f [0043.259] GdipCreateFromHDC (hdc=0xffffffff840109c0, graphics=0x26e408) returned 0x0 [0043.259] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0043.259] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0043.259] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0043.259] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0043.259] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0043.259] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ba0 [0043.259] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4ba0) returned 0x0 [0043.259] LocalFree (hMem=0x1a7d4ba0) returned 0x0 [0043.259] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0043.259] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0043.259] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0043.259] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0043.259] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0043.259] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.259] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.260] GetSystemMetrics (nIndex=42) returned 0 [0043.260] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.260] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.260] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0043.260] IsAppThemed () returned 0x1 [0043.260] GetThemeAppProperties () returned 0x3 [0043.260] GetThemeAppProperties () returned 0x3 [0043.260] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0043.260] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0043.260] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0043.260] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0043.260] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0043.260] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ba0 [0043.260] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ba0) returned 0x0 [0043.260] LocalFree (hMem=0x1a7d4ba0) returned 0x0 [0043.260] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0043.260] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ba0 [0043.260] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ba0) returned 0x0 [0043.260] LocalFree (hMem=0x1a7d4ba0) returned 0x0 [0043.260] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0043.260] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0043.260] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0043.260] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0043.260] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0043.260] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0043.260] GetCurrentObject (hdc=0xffffffff840109c0, type=0x1) returned 0x1b00017 [0043.260] GetCurrentObject (hdc=0xffffffff840109c0, type=0x2) returned 0x1900010 [0043.260] GetCurrentObject (hdc=0xffffffff840109c0, type=0x7) returned 0x530509d2 [0043.260] GetCurrentObject (hdc=0xffffffff840109c0, type=0x6) returned 0x18a002e [0043.260] SaveDC (hdc=0xffffffff840109c0) returned 1 [0043.261] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff8f0409ff [0043.261] GetClipRgn (hdc=0xffffffff840109c0, hrgn=0xffffffff8f0409ff) returned 0 [0043.261] SelectClipRgn (hdc=0xffffffff840109c0, hrgn=0x6a0409f1) returned 2 [0043.261] DeleteObject (ho=0xffffffff8f0409ff) returned 1 [0043.261] DeleteObject (ho=0x6a0409f1) returned 1 [0043.261] OffsetViewportOrgEx (in: hdc=0xffffffff840109c0, x=0, y=0, lppt=0x27c38c8 | out: lppt=0x27c38c8) returned 1 [0043.261] OffsetViewportOrgEx (in: hdc=0xffffffff840109c0, x=-417, y=-278, lppt=0x27c38e0 | out: lppt=0x27c38e0) returned 1 [0043.261] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0043.261] GetCurrentObject (hdc=0xffffffff840109c0, type=0x1) returned 0x1b00017 [0043.261] GetCurrentObject (hdc=0xffffffff840109c0, type=0x2) returned 0x1900010 [0043.261] GetCurrentObject (hdc=0xffffffff840109c0, type=0x7) returned 0x530509d2 [0043.261] GetCurrentObject (hdc=0xffffffff840109c0, type=0x6) returned 0x18a002e [0043.261] SaveDC (hdc=0xffffffff840109c0) returned 2 [0043.261] GetNearestColor (hdc=0xffffffff840109c0, color=0x6c4607) returned 0x6c4607 [0043.261] CreateSolidBrush (color=0x6c4607) returned 0x6d100276 [0043.261] FillRect (hDC=0xffffffff840109c0, lprc=0x26de08, hbr=0x6d100276) returned 1 [0043.265] DeleteObject (ho=0x6d100276) returned 1 [0043.265] RestoreDC (hdc=0xffffffff840109c0, nSavedDC=-1) returned 1 [0043.265] RestoreDC (hdc=0xffffffff840109c0, nSavedDC=-1) returned 1 [0043.265] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff840109c0) returned 0x0 [0043.265] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd5c0dbd) returned 0x0 [0043.265] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0043.265] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.265] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.265] GetSystemMetrics (nIndex=42) returned 0 [0043.265] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.265] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.265] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0043.265] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0043.265] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0043.265] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0043.265] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0043.265] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0043.265] GetCurrentObject (hdc=0xffffffff840109c0, type=0x1) returned 0x1b00017 [0043.265] GetCurrentObject (hdc=0xffffffff840109c0, type=0x2) returned 0x1900010 [0043.265] GetCurrentObject (hdc=0xffffffff840109c0, type=0x7) returned 0x530509d2 [0043.265] GetCurrentObject (hdc=0xffffffff840109c0, type=0x6) returned 0x18a002e [0043.265] SaveDC (hdc=0xffffffff840109c0) returned 1 [0043.265] GetNearestColor (hdc=0xffffffff840109c0, color=0xf0f0f0) returned 0xf0f0f0 [0043.265] RestoreDC (hdc=0xffffffff840109c0, nSavedDC=-1) returned 1 [0043.266] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff840109c0) returned 0x0 [0043.266] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0043.266] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0043.266] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0043.266] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0043.266] GetCurrentObject (hdc=0xffffffff840109c0, type=0x1) returned 0x1b00017 [0043.266] GetCurrentObject (hdc=0xffffffff840109c0, type=0x2) returned 0x1900010 [0043.266] GetCurrentObject (hdc=0xffffffff840109c0, type=0x7) returned 0x530509d2 [0043.266] GetCurrentObject (hdc=0xffffffff840109c0, type=0x6) returned 0x18a002e [0043.266] SaveDC (hdc=0xffffffff840109c0) returned 1 [0043.266] GetTextAlign (hdc=0xffffffff840109c0) returned 0x0 [0043.266] GetTextColor (hdc=0xffffffff840109c0) returned 0x0 [0043.266] SetTextColor (hdc=0xffffffff840109c0, color=0xf0f0f0) returned 0x0 [0043.266] GetCurrentObject (hdc=0xffffffff840109c0, type=0x6) returned 0x18a002e [0043.266] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0043.266] SelectObject (hdc=0xffffffff840109c0, h=0x260a09ba) returned 0x18a002e [0043.266] GetBkMode (hdc=0xffffffff840109c0) returned 2 [0043.266] SetBkMode (hdc=0xffffffff840109c0, mode=1) returned 2 [0043.266] DrawTextExW (in: hdc=0xffffffff840109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27c4590 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0043.267] DrawTextExW (in: hdc=0xffffffff840109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27c4590 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0043.267] RestoreDC (hdc=0xffffffff840109c0, nSavedDC=-1) returned 1 [0043.267] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff840109c0) returned 0x0 [0043.267] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0043.267] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff840109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0043.267] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff840109c0) returned 0x0 [0043.267] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0043.267] SelectObject (hdc=0xffffffff840109c0, h=0x185000f) returned 0x530509d2 [0043.267] DeleteDC (hdc=0xffffffff840109c0) returned 1 [0043.268] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0043.268] DeleteObject (ho=0x530509d2) returned 1 [0043.271] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0043.271] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.271] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.271] WaitMessage () returned 1 [0043.382] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.382] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.382] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.382] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.382] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.382] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0043.382] GetCurrentThreadId () returned 0xa28 [0043.382] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0043.382] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.382] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.382] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.382] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.382] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.382] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0043.382] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0043.382] CreateCompatibleDC (hdc=0x60109d6) returned 0x480109d7 [0043.382] GetObjectType (h=0x60109d6) returned 0x3 [0043.382] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x540509d2 [0043.382] GetDIBits (in: hdc=0x60109d6, hbm=0x540509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.383] GetDIBits (in: hdc=0x60109d6, hbm=0x540509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.383] DeleteObject (ho=0x540509d2) returned 1 [0043.383] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff850509c0 [0043.383] SelectObject (hdc=0x480109d7, h=0xffffffff850509c0) returned 0x185000f [0043.383] GdipCreateFromHDC (hdc=0x480109d7, graphics=0x26e408) returned 0x0 [0043.383] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0043.383] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0043.383] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0043.383] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0043.383] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0043.383] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ba0 [0043.383] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4ba0) returned 0x0 [0043.383] LocalFree (hMem=0x1a7d4ba0) returned 0x0 [0043.383] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0043.383] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0043.383] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0043.383] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0043.383] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0043.383] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.384] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.384] GetSystemMetrics (nIndex=42) returned 0 [0043.384] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.384] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.384] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0043.384] IsAppThemed () returned 0x1 [0043.384] GetThemeAppProperties () returned 0x3 [0043.384] GetThemeAppProperties () returned 0x3 [0043.384] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0043.384] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0043.384] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0043.384] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0043.384] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0043.384] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ba0 [0043.384] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ba0) returned 0x0 [0043.384] LocalFree (hMem=0x1a7d4ba0) returned 0x0 [0043.384] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0043.384] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ba0 [0043.384] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ba0) returned 0x0 [0043.384] LocalFree (hMem=0x1a7d4ba0) returned 0x0 [0043.384] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0043.384] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0043.384] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0043.384] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0043.384] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0043.384] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0043.384] GetCurrentObject (hdc=0x480109d7, type=0x1) returned 0x1b00017 [0043.384] GetCurrentObject (hdc=0x480109d7, type=0x2) returned 0x1900010 [0043.384] GetCurrentObject (hdc=0x480109d7, type=0x7) returned 0xffffffff850509c0 [0043.384] GetCurrentObject (hdc=0x480109d7, type=0x6) returned 0x18a002e [0043.385] SaveDC (hdc=0x480109d7) returned 1 [0043.385] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6b0409f1 [0043.385] GetClipRgn (hdc=0x480109d7, hrgn=0x6b0409f1) returned 0 [0043.385] SelectClipRgn (hdc=0x480109d7, hrgn=0xffffffff920409ff) returned 2 [0043.385] DeleteObject (ho=0x6b0409f1) returned 1 [0043.385] DeleteObject (ho=0xffffffff920409ff) returned 1 [0043.385] OffsetViewportOrgEx (in: hdc=0x480109d7, x=0, y=0, lppt=0x27c6170 | out: lppt=0x27c6170) returned 1 [0043.385] OffsetViewportOrgEx (in: hdc=0x480109d7, x=-417, y=-278, lppt=0x27c6188 | out: lppt=0x27c6188) returned 1 [0043.385] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0043.385] GetCurrentObject (hdc=0x480109d7, type=0x1) returned 0x1b00017 [0043.385] GetCurrentObject (hdc=0x480109d7, type=0x2) returned 0x1900010 [0043.385] GetCurrentObject (hdc=0x480109d7, type=0x7) returned 0xffffffff850509c0 [0043.385] GetCurrentObject (hdc=0x480109d7, type=0x6) returned 0x18a002e [0043.385] SaveDC (hdc=0x480109d7) returned 2 [0043.385] GetNearestColor (hdc=0x480109d7, color=0x6c4607) returned 0x6c4607 [0043.385] CreateSolidBrush (color=0x6c4607) returned 0x6e100276 [0043.385] FillRect (hDC=0x480109d7, lprc=0x26de08, hbr=0x6e100276) returned 1 [0043.388] DeleteObject (ho=0x6e100276) returned 1 [0043.389] RestoreDC (hdc=0x480109d7, nSavedDC=-1) returned 1 [0043.389] RestoreDC (hdc=0x480109d7, nSavedDC=-1) returned 1 [0043.389] GdipReleaseDC (graphics=0x1b86d040, hdc=0x480109d7) returned 0x0 [0043.389] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd5a0dbd) returned 0x0 [0043.389] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0043.389] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.389] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.389] GetSystemMetrics (nIndex=42) returned 0 [0043.389] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.389] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.389] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x30) returned 0x0 [0043.390] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0043.390] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0043.390] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0043.390] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0043.390] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0043.390] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0043.390] GetCurrentObject (hdc=0x480109d7, type=0x1) returned 0x1b00017 [0043.390] GetCurrentObject (hdc=0x480109d7, type=0x2) returned 0x1900010 [0043.390] GetCurrentObject (hdc=0x480109d7, type=0x7) returned 0xffffffff850509c0 [0043.390] GetCurrentObject (hdc=0x480109d7, type=0x6) returned 0x18a002e [0043.390] SaveDC (hdc=0x480109d7) returned 1 [0043.390] GetNearestColor (hdc=0x480109d7, color=0xf0f0f0) returned 0xf0f0f0 [0043.390] RestoreDC (hdc=0x480109d7, nSavedDC=-1) returned 1 [0043.390] GdipReleaseDC (graphics=0x1b86d040, hdc=0x480109d7) returned 0x0 [0043.391] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0043.391] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0043.391] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0043.391] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0043.391] GetCurrentObject (hdc=0x480109d7, type=0x1) returned 0x1b00017 [0043.391] GetCurrentObject (hdc=0x480109d7, type=0x2) returned 0x1900010 [0043.391] GetCurrentObject (hdc=0x480109d7, type=0x7) returned 0xffffffff850509c0 [0043.391] GetCurrentObject (hdc=0x480109d7, type=0x6) returned 0x18a002e [0043.391] SaveDC (hdc=0x480109d7) returned 1 [0043.391] GetTextAlign (hdc=0x480109d7) returned 0x0 [0043.391] GetTextColor (hdc=0x480109d7) returned 0x0 [0043.391] SetTextColor (hdc=0x480109d7, color=0xf0f0f0) returned 0x0 [0043.391] GetCurrentObject (hdc=0x480109d7, type=0x6) returned 0x18a002e [0043.391] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0043.391] SelectObject (hdc=0x480109d7, h=0x260a09ba) returned 0x18a002e [0043.391] GetBkMode (hdc=0x480109d7) returned 2 [0043.391] SetBkMode (hdc=0x480109d7, mode=1) returned 2 [0043.391] DrawTextExW (in: hdc=0x480109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27c7088 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0043.391] DrawTextExW (in: hdc=0x480109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27c7088 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0043.392] RestoreDC (hdc=0x480109d7, nSavedDC=-1) returned 1 [0043.392] GdipReleaseDC (graphics=0x1b86d040, hdc=0x480109d7) returned 0x0 [0043.392] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0043.392] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x480109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0043.392] GdipReleaseDC (graphics=0x1b86d040, hdc=0x480109d7) returned 0x0 [0043.392] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0043.392] SelectObject (hdc=0x480109d7, h=0x185000f) returned 0xffffffff850509c0 [0043.392] DeleteDC (hdc=0x480109d7) returned 1 [0043.392] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0043.392] DeleteObject (ho=0xffffffff850509c0) returned 1 [0043.395] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0043.395] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.396] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.396] WaitMessage () returned 1 [0043.507] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.507] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.507] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.507] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.507] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.507] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0043.507] GetCurrentThreadId () returned 0xa28 [0043.507] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0043.507] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.507] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.507] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.507] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.507] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.508] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0043.508] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0043.508] CreateCompatibleDC (hdc=0x60109d6) returned 0x560109d2 [0043.508] GetObjectType (h=0x60109d6) returned 0x3 [0043.508] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff860509c0 [0043.508] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff860509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.508] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff860509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.508] DeleteObject (ho=0xffffffff860509c0) returned 1 [0043.508] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x490509d7 [0043.508] SelectObject (hdc=0x560109d2, h=0x490509d7) returned 0x185000f [0043.508] GdipCreateFromHDC (hdc=0x560109d2, graphics=0x26e408) returned 0x0 [0043.508] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0043.509] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0043.509] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0043.509] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0043.509] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0043.509] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4c20 [0043.509] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4c20) returned 0x0 [0043.509] LocalFree (hMem=0x1a7d4c20) returned 0x0 [0043.509] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0043.509] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0043.509] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0043.509] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0043.509] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0043.509] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.509] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.509] GetSystemMetrics (nIndex=42) returned 0 [0043.509] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.509] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.509] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0043.509] IsAppThemed () returned 0x1 [0043.509] GetThemeAppProperties () returned 0x3 [0043.509] GetThemeAppProperties () returned 0x3 [0043.509] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0043.509] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0043.509] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0043.509] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0043.509] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0043.509] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4c20 [0043.509] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4c20) returned 0x0 [0043.509] LocalFree (hMem=0x1a7d4c20) returned 0x0 [0043.510] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0043.510] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4c20 [0043.510] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4c20) returned 0x0 [0043.510] LocalFree (hMem=0x1a7d4c20) returned 0x0 [0043.510] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0043.510] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0043.510] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0043.510] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0043.510] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0043.510] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0043.510] GetCurrentObject (hdc=0x560109d2, type=0x1) returned 0x1b00017 [0043.510] GetCurrentObject (hdc=0x560109d2, type=0x2) returned 0x1900010 [0043.510] GetCurrentObject (hdc=0x560109d2, type=0x7) returned 0x490509d7 [0043.510] GetCurrentObject (hdc=0x560109d2, type=0x6) returned 0x18a002e [0043.510] SaveDC (hdc=0x560109d2) returned 1 [0043.510] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff930409ff [0043.510] GetClipRgn (hdc=0x560109d2, hrgn=0xffffffff930409ff) returned 0 [0043.510] SelectClipRgn (hdc=0x560109d2, hrgn=0x6e0409f1) returned 2 [0043.510] DeleteObject (ho=0xffffffff930409ff) returned 1 [0043.510] DeleteObject (ho=0x6e0409f1) returned 1 [0043.510] OffsetViewportOrgEx (in: hdc=0x560109d2, x=0, y=0, lppt=0x27c8c68 | out: lppt=0x27c8c68) returned 1 [0043.510] OffsetViewportOrgEx (in: hdc=0x560109d2, x=-417, y=-278, lppt=0x27c8c80 | out: lppt=0x27c8c80) returned 1 [0043.510] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0043.510] GetCurrentObject (hdc=0x560109d2, type=0x1) returned 0x1b00017 [0043.510] GetCurrentObject (hdc=0x560109d2, type=0x2) returned 0x1900010 [0043.510] GetCurrentObject (hdc=0x560109d2, type=0x7) returned 0x490509d7 [0043.510] GetCurrentObject (hdc=0x560109d2, type=0x6) returned 0x18a002e [0043.510] SaveDC (hdc=0x560109d2) returned 2 [0043.511] GetNearestColor (hdc=0x560109d2, color=0x6c4607) returned 0x6c4607 [0043.511] CreateSolidBrush (color=0x6c4607) returned 0x6f100276 [0043.511] FillRect (hDC=0x560109d2, lprc=0x26de08, hbr=0x6f100276) returned 1 [0043.514] DeleteObject (ho=0x6f100276) returned 1 [0043.514] RestoreDC (hdc=0x560109d2, nSavedDC=-1) returned 1 [0043.514] RestoreDC (hdc=0x560109d2, nSavedDC=-1) returned 1 [0043.514] GdipReleaseDC (graphics=0x1b86d040, hdc=0x560109d2) returned 0x0 [0043.514] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd580dbd) returned 0x0 [0043.514] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0043.514] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.514] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.514] GetSystemMetrics (nIndex=42) returned 0 [0043.514] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.514] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.514] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0043.515] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0043.515] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0043.515] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0043.515] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0043.515] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0043.515] GetCurrentObject (hdc=0x560109d2, type=0x1) returned 0x1b00017 [0043.515] GetCurrentObject (hdc=0x560109d2, type=0x2) returned 0x1900010 [0043.515] GetCurrentObject (hdc=0x560109d2, type=0x7) returned 0x490509d7 [0043.515] GetCurrentObject (hdc=0x560109d2, type=0x6) returned 0x18a002e [0043.515] SaveDC (hdc=0x560109d2) returned 1 [0043.515] GetNearestColor (hdc=0x560109d2, color=0xf0f0f0) returned 0xf0f0f0 [0043.515] RestoreDC (hdc=0x560109d2, nSavedDC=-1) returned 1 [0043.515] GdipReleaseDC (graphics=0x1b86d040, hdc=0x560109d2) returned 0x0 [0043.515] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0043.515] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0043.515] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0043.515] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0043.515] GetCurrentObject (hdc=0x560109d2, type=0x1) returned 0x1b00017 [0043.515] GetCurrentObject (hdc=0x560109d2, type=0x2) returned 0x1900010 [0043.515] GetCurrentObject (hdc=0x560109d2, type=0x7) returned 0x490509d7 [0043.515] GetCurrentObject (hdc=0x560109d2, type=0x6) returned 0x18a002e [0043.516] SaveDC (hdc=0x560109d2) returned 1 [0043.516] GetTextAlign (hdc=0x560109d2) returned 0x0 [0043.516] GetTextColor (hdc=0x560109d2) returned 0x0 [0043.516] SetTextColor (hdc=0x560109d2, color=0xf0f0f0) returned 0x0 [0043.516] GetCurrentObject (hdc=0x560109d2, type=0x6) returned 0x18a002e [0043.516] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0043.516] SelectObject (hdc=0x560109d2, h=0x260a09ba) returned 0x18a002e [0043.516] GetBkMode (hdc=0x560109d2) returned 2 [0043.516] SetBkMode (hdc=0x560109d2, mode=1) returned 2 [0043.516] DrawTextExW (in: hdc=0x560109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27c9930 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0043.516] DrawTextExW (in: hdc=0x560109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27c9930 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0043.517] RestoreDC (hdc=0x560109d2, nSavedDC=-1) returned 1 [0043.517] GdipReleaseDC (graphics=0x1b86d040, hdc=0x560109d2) returned 0x0 [0043.517] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0043.517] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x560109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0043.517] GdipReleaseDC (graphics=0x1b86d040, hdc=0x560109d2) returned 0x0 [0043.517] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0043.517] SelectObject (hdc=0x560109d2, h=0x185000f) returned 0x490509d7 [0043.517] DeleteDC (hdc=0x560109d2) returned 1 [0043.517] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0043.517] DeleteObject (ho=0x490509d7) returned 1 [0043.520] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0043.520] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.520] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.520] WaitMessage () returned 1 [0043.631] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.631] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.631] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.631] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.631] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.631] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0043.631] GetCurrentThreadId () returned 0xa28 [0043.631] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0043.631] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.632] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.632] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.632] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.632] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.632] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0043.632] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0043.632] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff880109c0 [0043.632] GetObjectType (h=0x60109d6) returned 0x3 [0043.632] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x4a0509d7 [0043.632] GetDIBits (in: hdc=0x60109d6, hbm=0x4a0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.632] GetDIBits (in: hdc=0x60109d6, hbm=0x4a0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.632] DeleteObject (ho=0x4a0509d7) returned 1 [0043.632] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x570509d2 [0043.632] SelectObject (hdc=0xffffffff880109c0, h=0x570509d2) returned 0x185000f [0043.632] GdipCreateFromHDC (hdc=0xffffffff880109c0, graphics=0x26e408) returned 0x0 [0043.633] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0043.633] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0043.633] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0043.633] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0043.633] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0043.633] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4c20 [0043.633] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4c20) returned 0x0 [0043.633] LocalFree (hMem=0x1a7d4c20) returned 0x0 [0043.633] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0043.633] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0043.633] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0043.633] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0043.633] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0043.633] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.633] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.633] GetSystemMetrics (nIndex=42) returned 0 [0043.633] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.633] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.633] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0043.633] IsAppThemed () returned 0x1 [0043.633] GetThemeAppProperties () returned 0x3 [0043.633] GetThemeAppProperties () returned 0x3 [0043.633] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0043.633] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0043.633] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0043.634] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0043.634] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0043.634] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4c20 [0043.634] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4c20) returned 0x0 [0043.634] LocalFree (hMem=0x1a7d4c20) returned 0x0 [0043.634] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0043.634] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4c20 [0043.634] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4c20) returned 0x0 [0043.634] LocalFree (hMem=0x1a7d4c20) returned 0x0 [0043.634] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0043.634] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0043.634] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0043.634] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0043.634] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0043.634] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0043.634] GetCurrentObject (hdc=0xffffffff880109c0, type=0x1) returned 0x1b00017 [0043.634] GetCurrentObject (hdc=0xffffffff880109c0, type=0x2) returned 0x1900010 [0043.634] GetCurrentObject (hdc=0xffffffff880109c0, type=0x7) returned 0x570509d2 [0043.634] GetCurrentObject (hdc=0xffffffff880109c0, type=0x6) returned 0x18a002e [0043.634] SaveDC (hdc=0xffffffff880109c0) returned 1 [0043.634] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6f0409f1 [0043.634] GetClipRgn (hdc=0xffffffff880109c0, hrgn=0x6f0409f1) returned 0 [0043.634] SelectClipRgn (hdc=0xffffffff880109c0, hrgn=0xffffffff960409ff) returned 2 [0043.634] DeleteObject (ho=0x6f0409f1) returned 1 [0043.634] DeleteObject (ho=0xffffffff960409ff) returned 1 [0043.634] OffsetViewportOrgEx (in: hdc=0xffffffff880109c0, x=0, y=0, lppt=0x27cb510 | out: lppt=0x27cb510) returned 1 [0043.634] OffsetViewportOrgEx (in: hdc=0xffffffff880109c0, x=-417, y=-278, lppt=0x27cb528 | out: lppt=0x27cb528) returned 1 [0043.635] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0043.635] GetCurrentObject (hdc=0xffffffff880109c0, type=0x1) returned 0x1b00017 [0043.635] GetCurrentObject (hdc=0xffffffff880109c0, type=0x2) returned 0x1900010 [0043.635] GetCurrentObject (hdc=0xffffffff880109c0, type=0x7) returned 0x570509d2 [0043.635] GetCurrentObject (hdc=0xffffffff880109c0, type=0x6) returned 0x18a002e [0043.635] SaveDC (hdc=0xffffffff880109c0) returned 2 [0043.635] GetNearestColor (hdc=0xffffffff880109c0, color=0x6c4607) returned 0x6c4607 [0043.635] CreateSolidBrush (color=0x6c4607) returned 0x70100276 [0043.635] FillRect (hDC=0xffffffff880109c0, lprc=0x26de08, hbr=0x70100276) returned 1 [0043.638] DeleteObject (ho=0x70100276) returned 1 [0043.638] RestoreDC (hdc=0xffffffff880109c0, nSavedDC=-1) returned 1 [0043.638] RestoreDC (hdc=0xffffffff880109c0, nSavedDC=-1) returned 1 [0043.638] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff880109c0) returned 0x0 [0043.638] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd560dbd) returned 0x0 [0043.639] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0043.639] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.639] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.639] GetSystemMetrics (nIndex=42) returned 0 [0043.639] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.639] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.639] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x32) returned 0x0 [0043.640] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0043.640] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0043.640] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0043.640] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0043.640] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0043.640] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0043.640] GetCurrentObject (hdc=0xffffffff880109c0, type=0x1) returned 0x1b00017 [0043.640] GetCurrentObject (hdc=0xffffffff880109c0, type=0x2) returned 0x1900010 [0043.640] GetCurrentObject (hdc=0xffffffff880109c0, type=0x7) returned 0x570509d2 [0043.640] GetCurrentObject (hdc=0xffffffff880109c0, type=0x6) returned 0x18a002e [0043.640] SaveDC (hdc=0xffffffff880109c0) returned 1 [0043.640] GetNearestColor (hdc=0xffffffff880109c0, color=0xf0f0f0) returned 0xf0f0f0 [0043.640] RestoreDC (hdc=0xffffffff880109c0, nSavedDC=-1) returned 1 [0043.640] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff880109c0) returned 0x0 [0043.641] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0043.641] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0043.641] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0043.641] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0043.641] GetCurrentObject (hdc=0xffffffff880109c0, type=0x1) returned 0x1b00017 [0043.641] GetCurrentObject (hdc=0xffffffff880109c0, type=0x2) returned 0x1900010 [0043.641] GetCurrentObject (hdc=0xffffffff880109c0, type=0x7) returned 0x570509d2 [0043.641] GetCurrentObject (hdc=0xffffffff880109c0, type=0x6) returned 0x18a002e [0043.641] SaveDC (hdc=0xffffffff880109c0) returned 1 [0043.641] GetTextAlign (hdc=0xffffffff880109c0) returned 0x0 [0043.641] GetTextColor (hdc=0xffffffff880109c0) returned 0x0 [0043.641] SetTextColor (hdc=0xffffffff880109c0, color=0xf0f0f0) returned 0x0 [0043.641] GetCurrentObject (hdc=0xffffffff880109c0, type=0x6) returned 0x18a002e [0043.641] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0043.641] SelectObject (hdc=0xffffffff880109c0, h=0x260a09ba) returned 0x18a002e [0043.641] GetBkMode (hdc=0xffffffff880109c0) returned 2 [0043.641] SetBkMode (hdc=0xffffffff880109c0, mode=1) returned 2 [0043.641] DrawTextExW (in: hdc=0xffffffff880109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27cc430 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0043.641] DrawTextExW (in: hdc=0xffffffff880109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27cc430 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0043.642] RestoreDC (hdc=0xffffffff880109c0, nSavedDC=-1) returned 1 [0043.642] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff880109c0) returned 0x0 [0043.642] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0043.642] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff880109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0043.642] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff880109c0) returned 0x0 [0043.642] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0043.642] SelectObject (hdc=0xffffffff880109c0, h=0x185000f) returned 0x570509d2 [0043.642] DeleteDC (hdc=0xffffffff880109c0) returned 1 [0043.642] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0043.642] DeleteObject (ho=0x570509d2) returned 1 [0043.646] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0043.646] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.646] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.646] WaitMessage () returned 1 [0043.763] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.763] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.763] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.763] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.763] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.763] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0043.763] GetCurrentThreadId () returned 0xa28 [0043.763] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0043.763] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.763] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.763] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.763] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.763] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.763] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0043.763] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0043.763] CreateCompatibleDC (hdc=0x60109d6) returned 0x4c0109d7 [0043.763] GetObjectType (h=0x60109d6) returned 0x3 [0043.763] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x580509d2 [0043.763] GetDIBits (in: hdc=0x60109d6, hbm=0x580509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.764] GetDIBits (in: hdc=0x60109d6, hbm=0x580509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.764] DeleteObject (ho=0x580509d2) returned 1 [0043.764] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff890509c0 [0043.764] SelectObject (hdc=0x4c0109d7, h=0xffffffff890509c0) returned 0x185000f [0043.764] GdipCreateFromHDC (hdc=0x4c0109d7, graphics=0x26e408) returned 0x0 [0043.764] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0043.764] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0043.764] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0043.764] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0043.764] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0043.764] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ca0 [0043.764] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4ca0) returned 0x0 [0043.764] LocalFree (hMem=0x1a7d4ca0) returned 0x0 [0043.764] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0043.764] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0043.764] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0043.764] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0043.764] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0043.764] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.764] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.765] GetSystemMetrics (nIndex=42) returned 0 [0043.765] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.765] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.765] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0043.765] IsAppThemed () returned 0x1 [0043.765] GetThemeAppProperties () returned 0x3 [0043.765] GetThemeAppProperties () returned 0x3 [0043.765] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0043.765] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0043.765] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0043.765] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0043.765] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0043.765] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ca0 [0043.765] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ca0) returned 0x0 [0043.765] LocalFree (hMem=0x1a7d4ca0) returned 0x0 [0043.765] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0043.765] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ca0 [0043.765] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ca0) returned 0x0 [0043.765] LocalFree (hMem=0x1a7d4ca0) returned 0x0 [0043.765] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0043.765] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0043.765] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0043.765] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0043.765] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0043.765] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0043.765] GetCurrentObject (hdc=0x4c0109d7, type=0x1) returned 0x1b00017 [0043.765] GetCurrentObject (hdc=0x4c0109d7, type=0x2) returned 0x1900010 [0043.766] GetCurrentObject (hdc=0x4c0109d7, type=0x7) returned 0xffffffff890509c0 [0043.766] GetCurrentObject (hdc=0x4c0109d7, type=0x6) returned 0x18a002e [0043.766] SaveDC (hdc=0x4c0109d7) returned 1 [0043.766] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff970409ff [0043.766] GetClipRgn (hdc=0x4c0109d7, hrgn=0xffffffff970409ff) returned 0 [0043.766] SelectClipRgn (hdc=0x4c0109d7, hrgn=0x720409f1) returned 2 [0043.766] DeleteObject (ho=0xffffffff970409ff) returned 1 [0043.766] DeleteObject (ho=0x720409f1) returned 1 [0043.766] OffsetViewportOrgEx (in: hdc=0x4c0109d7, x=0, y=0, lppt=0x27ce010 | out: lppt=0x27ce010) returned 1 [0043.766] OffsetViewportOrgEx (in: hdc=0x4c0109d7, x=-417, y=-278, lppt=0x27ce028 | out: lppt=0x27ce028) returned 1 [0043.766] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0043.766] GetCurrentObject (hdc=0x4c0109d7, type=0x1) returned 0x1b00017 [0043.766] GetCurrentObject (hdc=0x4c0109d7, type=0x2) returned 0x1900010 [0043.766] GetCurrentObject (hdc=0x4c0109d7, type=0x7) returned 0xffffffff890509c0 [0043.766] GetCurrentObject (hdc=0x4c0109d7, type=0x6) returned 0x18a002e [0043.766] SaveDC (hdc=0x4c0109d7) returned 2 [0043.766] GetNearestColor (hdc=0x4c0109d7, color=0x6c4607) returned 0x6c4607 [0043.766] CreateSolidBrush (color=0x6c4607) returned 0x71100276 [0043.766] FillRect (hDC=0x4c0109d7, lprc=0x26de08, hbr=0x71100276) returned 1 [0043.770] DeleteObject (ho=0x71100276) returned 1 [0043.770] RestoreDC (hdc=0x4c0109d7, nSavedDC=-1) returned 1 [0043.770] RestoreDC (hdc=0x4c0109d7, nSavedDC=-1) returned 1 [0043.770] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4c0109d7) returned 0x0 [0043.770] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd540dbd) returned 0x0 [0043.770] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0043.770] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.770] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.770] GetSystemMetrics (nIndex=42) returned 0 [0043.770] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.770] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.770] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0043.770] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0043.770] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0043.770] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0043.770] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0043.770] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0043.770] GetCurrentObject (hdc=0x4c0109d7, type=0x1) returned 0x1b00017 [0043.770] GetCurrentObject (hdc=0x4c0109d7, type=0x2) returned 0x1900010 [0043.770] GetCurrentObject (hdc=0x4c0109d7, type=0x7) returned 0xffffffff890509c0 [0043.770] GetCurrentObject (hdc=0x4c0109d7, type=0x6) returned 0x18a002e [0043.770] SaveDC (hdc=0x4c0109d7) returned 1 [0043.770] GetNearestColor (hdc=0x4c0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0043.771] RestoreDC (hdc=0x4c0109d7, nSavedDC=-1) returned 1 [0043.771] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4c0109d7) returned 0x0 [0043.771] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0043.771] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0043.771] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0043.771] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0043.771] GetCurrentObject (hdc=0x4c0109d7, type=0x1) returned 0x1b00017 [0043.771] GetCurrentObject (hdc=0x4c0109d7, type=0x2) returned 0x1900010 [0043.771] GetCurrentObject (hdc=0x4c0109d7, type=0x7) returned 0xffffffff890509c0 [0043.771] GetCurrentObject (hdc=0x4c0109d7, type=0x6) returned 0x18a002e [0043.771] SaveDC (hdc=0x4c0109d7) returned 1 [0043.771] GetTextAlign (hdc=0x4c0109d7) returned 0x0 [0043.771] GetTextColor (hdc=0x4c0109d7) returned 0x0 [0043.771] SetTextColor (hdc=0x4c0109d7, color=0xf0f0f0) returned 0x0 [0043.771] GetCurrentObject (hdc=0x4c0109d7, type=0x6) returned 0x18a002e [0043.771] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0043.772] SelectObject (hdc=0x4c0109d7, h=0x260a09ba) returned 0x18a002e [0043.772] GetBkMode (hdc=0x4c0109d7) returned 2 [0043.772] SetBkMode (hdc=0x4c0109d7, mode=1) returned 2 [0043.772] DrawTextExW (in: hdc=0x4c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27cecd8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0043.772] DrawTextExW (in: hdc=0x4c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27cecd8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0043.772] RestoreDC (hdc=0x4c0109d7, nSavedDC=-1) returned 1 [0043.772] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4c0109d7) returned 0x0 [0043.772] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0043.772] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x4c0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0043.772] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4c0109d7) returned 0x0 [0043.773] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0043.773] SelectObject (hdc=0x4c0109d7, h=0x185000f) returned 0xffffffff890509c0 [0043.773] DeleteDC (hdc=0x4c0109d7) returned 1 [0043.773] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0043.773] DeleteObject (ho=0xffffffff890509c0) returned 1 [0043.776] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0043.776] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.776] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.776] WaitMessage () returned 1 [0043.897] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.897] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.897] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.897] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.897] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.897] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0043.897] GetCurrentThreadId () returned 0xa28 [0043.897] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0043.897] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.897] IsWindowUnicode (hWnd=0x3015e) returned 1 [0043.897] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0043.897] TranslateMessage (lpMsg=0x26ee10) returned 0 [0043.897] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0043.897] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0043.897] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0043.898] CreateCompatibleDC (hdc=0x60109d6) returned 0x5a0109d2 [0043.898] GetObjectType (h=0x60109d6) returned 0x3 [0043.898] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff8a0509c0 [0043.898] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8a0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.898] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8a0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0043.898] DeleteObject (ho=0xffffffff8a0509c0) returned 1 [0043.898] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4d0509d7 [0043.898] SelectObject (hdc=0x5a0109d2, h=0x4d0509d7) returned 0x185000f [0043.898] GdipCreateFromHDC (hdc=0x5a0109d2, graphics=0x26e408) returned 0x0 [0043.899] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0043.899] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0043.899] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0043.899] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0043.899] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0043.899] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ca0 [0043.899] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4ca0) returned 0x0 [0043.899] LocalFree (hMem=0x1a7d4ca0) returned 0x0 [0043.899] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0043.899] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0043.899] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0043.899] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0043.899] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0043.899] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.899] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.899] GetSystemMetrics (nIndex=42) returned 0 [0043.899] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.899] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.899] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0043.900] IsAppThemed () returned 0x1 [0043.900] GetThemeAppProperties () returned 0x3 [0043.900] GetThemeAppProperties () returned 0x3 [0043.900] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0043.900] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0043.900] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0043.900] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0043.900] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0043.900] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ca0 [0043.900] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ca0) returned 0x0 [0043.900] LocalFree (hMem=0x1a7d4ca0) returned 0x0 [0043.900] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0043.900] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ca0 [0043.900] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ca0) returned 0x0 [0043.900] LocalFree (hMem=0x1a7d4ca0) returned 0x0 [0043.900] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0043.900] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0043.900] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0043.900] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0043.900] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0043.900] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0043.900] GetCurrentObject (hdc=0x5a0109d2, type=0x1) returned 0x1b00017 [0043.900] GetCurrentObject (hdc=0x5a0109d2, type=0x2) returned 0x1900010 [0043.901] GetCurrentObject (hdc=0x5a0109d2, type=0x7) returned 0x4d0509d7 [0043.901] GetCurrentObject (hdc=0x5a0109d2, type=0x6) returned 0x18a002e [0043.901] SaveDC (hdc=0x5a0109d2) returned 1 [0043.901] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x730409f1 [0043.901] GetClipRgn (hdc=0x5a0109d2, hrgn=0x730409f1) returned 0 [0043.901] SelectClipRgn (hdc=0x5a0109d2, hrgn=0xffffffff9a0409ff) returned 2 [0043.901] DeleteObject (ho=0x730409f1) returned 1 [0043.901] DeleteObject (ho=0xffffffff9a0409ff) returned 1 [0043.901] OffsetViewportOrgEx (in: hdc=0x5a0109d2, x=0, y=0, lppt=0x27d08b8 | out: lppt=0x27d08b8) returned 1 [0043.901] OffsetViewportOrgEx (in: hdc=0x5a0109d2, x=-417, y=-278, lppt=0x27d08d0 | out: lppt=0x27d08d0) returned 1 [0043.901] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0043.901] GetCurrentObject (hdc=0x5a0109d2, type=0x1) returned 0x1b00017 [0043.901] GetCurrentObject (hdc=0x5a0109d2, type=0x2) returned 0x1900010 [0043.901] GetCurrentObject (hdc=0x5a0109d2, type=0x7) returned 0x4d0509d7 [0043.901] GetCurrentObject (hdc=0x5a0109d2, type=0x6) returned 0x18a002e [0043.901] SaveDC (hdc=0x5a0109d2) returned 2 [0043.901] GetNearestColor (hdc=0x5a0109d2, color=0x6c4607) returned 0x6c4607 [0043.901] CreateSolidBrush (color=0x6c4607) returned 0x72100276 [0043.901] FillRect (hDC=0x5a0109d2, lprc=0x26de08, hbr=0x72100276) returned 1 [0043.906] DeleteObject (ho=0x72100276) returned 1 [0043.906] RestoreDC (hdc=0x5a0109d2, nSavedDC=-1) returned 1 [0043.906] RestoreDC (hdc=0x5a0109d2, nSavedDC=-1) returned 1 [0043.906] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5a0109d2) returned 0x0 [0043.906] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd520dbd) returned 0x0 [0043.906] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0043.906] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0043.906] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0043.906] GetSystemMetrics (nIndex=42) returned 0 [0043.907] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0043.907] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0043.907] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x34) returned 0x0 [0043.908] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0043.908] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0043.908] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0043.908] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0043.908] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0043.908] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0043.908] GetCurrentObject (hdc=0x5a0109d2, type=0x1) returned 0x1b00017 [0043.908] GetCurrentObject (hdc=0x5a0109d2, type=0x2) returned 0x1900010 [0043.908] GetCurrentObject (hdc=0x5a0109d2, type=0x7) returned 0x4d0509d7 [0043.908] GetCurrentObject (hdc=0x5a0109d2, type=0x6) returned 0x18a002e [0043.908] SaveDC (hdc=0x5a0109d2) returned 1 [0043.908] GetNearestColor (hdc=0x5a0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0043.909] RestoreDC (hdc=0x5a0109d2, nSavedDC=-1) returned 1 [0043.909] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5a0109d2) returned 0x0 [0043.909] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0043.909] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0043.909] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0043.909] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0043.909] GetCurrentObject (hdc=0x5a0109d2, type=0x1) returned 0x1b00017 [0043.909] GetCurrentObject (hdc=0x5a0109d2, type=0x2) returned 0x1900010 [0043.909] GetCurrentObject (hdc=0x5a0109d2, type=0x7) returned 0x4d0509d7 [0043.909] GetCurrentObject (hdc=0x5a0109d2, type=0x6) returned 0x18a002e [0043.909] SaveDC (hdc=0x5a0109d2) returned 1 [0043.909] GetTextAlign (hdc=0x5a0109d2) returned 0x0 [0043.909] GetTextColor (hdc=0x5a0109d2) returned 0x0 [0043.909] SetTextColor (hdc=0x5a0109d2, color=0xf0f0f0) returned 0x0 [0043.909] GetCurrentObject (hdc=0x5a0109d2, type=0x6) returned 0x18a002e [0043.910] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0043.910] SelectObject (hdc=0x5a0109d2, h=0x260a09ba) returned 0x18a002e [0043.910] GetBkMode (hdc=0x5a0109d2) returned 2 [0043.910] SetBkMode (hdc=0x5a0109d2, mode=1) returned 2 [0043.910] DrawTextExW (in: hdc=0x5a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27d17d8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0043.910] DrawTextExW (in: hdc=0x5a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27d17d8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0043.911] RestoreDC (hdc=0x5a0109d2, nSavedDC=-1) returned 1 [0043.911] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5a0109d2) returned 0x0 [0043.911] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0043.911] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x5a0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0043.911] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5a0109d2) returned 0x0 [0043.911] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0043.911] SelectObject (hdc=0x5a0109d2, h=0x185000f) returned 0x4d0509d7 [0043.911] DeleteDC (hdc=0x5a0109d2) returned 1 [0043.911] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0043.911] DeleteObject (ho=0x4d0509d7) returned 1 [0043.916] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0043.916] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.916] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0043.916] WaitMessage () returned 1 [0044.037] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.037] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.037] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.037] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.037] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.037] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0044.037] GetCurrentThreadId () returned 0xa28 [0044.037] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0044.038] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.038] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.038] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.038] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.038] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.038] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0044.038] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0044.038] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff8c0109c0 [0044.038] GetObjectType (h=0x60109d6) returned 0x3 [0044.038] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x4e0509d7 [0044.038] GetDIBits (in: hdc=0x60109d6, hbm=0x4e0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.039] GetDIBits (in: hdc=0x60109d6, hbm=0x4e0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.039] DeleteObject (ho=0x4e0509d7) returned 1 [0044.039] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x5b0509d2 [0044.039] SelectObject (hdc=0xffffffff8c0109c0, h=0x5b0509d2) returned 0x185000f [0044.039] GdipCreateFromHDC (hdc=0xffffffff8c0109c0, graphics=0x26e408) returned 0x0 [0044.039] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0044.039] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0044.039] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0044.039] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0044.039] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0044.039] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4d20 [0044.039] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4d20) returned 0x0 [0044.039] LocalFree (hMem=0x1a7d4d20) returned 0x0 [0044.039] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0044.039] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0044.039] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0044.039] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0044.039] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0044.040] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.040] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.040] GetSystemMetrics (nIndex=42) returned 0 [0044.040] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.040] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.040] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0044.040] IsAppThemed () returned 0x1 [0044.040] GetThemeAppProperties () returned 0x3 [0044.040] GetThemeAppProperties () returned 0x3 [0044.040] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0044.040] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0044.040] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0044.040] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0044.040] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0044.040] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4d20 [0044.040] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4d20) returned 0x0 [0044.040] LocalFree (hMem=0x1a7d4d20) returned 0x0 [0044.040] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0044.040] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4d20 [0044.040] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4d20) returned 0x0 [0044.040] LocalFree (hMem=0x1a7d4d20) returned 0x0 [0044.040] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0044.040] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0044.040] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0044.040] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0044.040] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0044.040] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0044.040] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x1) returned 0x1b00017 [0044.040] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x2) returned 0x1900010 [0044.040] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x7) returned 0x5b0509d2 [0044.041] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x6) returned 0x18a002e [0044.041] SaveDC (hdc=0xffffffff8c0109c0) returned 1 [0044.041] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff9b0409ff [0044.041] GetClipRgn (hdc=0xffffffff8c0109c0, hrgn=0xffffffff9b0409ff) returned 0 [0044.041] SelectClipRgn (hdc=0xffffffff8c0109c0, hrgn=0x760409f1) returned 2 [0044.041] DeleteObject (ho=0xffffffff9b0409ff) returned 1 [0044.041] DeleteObject (ho=0x760409f1) returned 1 [0044.041] OffsetViewportOrgEx (in: hdc=0xffffffff8c0109c0, x=0, y=0, lppt=0x27d33b8 | out: lppt=0x27d33b8) returned 1 [0044.041] OffsetViewportOrgEx (in: hdc=0xffffffff8c0109c0, x=-417, y=-278, lppt=0x27d33d0 | out: lppt=0x27d33d0) returned 1 [0044.041] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0044.041] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x1) returned 0x1b00017 [0044.041] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x2) returned 0x1900010 [0044.041] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x7) returned 0x5b0509d2 [0044.041] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x6) returned 0x18a002e [0044.041] SaveDC (hdc=0xffffffff8c0109c0) returned 2 [0044.041] GetNearestColor (hdc=0xffffffff8c0109c0, color=0x6c4607) returned 0x6c4607 [0044.041] CreateSolidBrush (color=0x6c4607) returned 0x73100276 [0044.041] FillRect (hDC=0xffffffff8c0109c0, lprc=0x26de08, hbr=0x73100276) returned 1 [0044.045] DeleteObject (ho=0x73100276) returned 1 [0044.045] RestoreDC (hdc=0xffffffff8c0109c0, nSavedDC=-1) returned 1 [0044.045] RestoreDC (hdc=0xffffffff8c0109c0, nSavedDC=-1) returned 1 [0044.045] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8c0109c0) returned 0x0 [0044.045] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd500dbd) returned 0x0 [0044.045] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0044.045] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.045] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.045] GetSystemMetrics (nIndex=42) returned 0 [0044.045] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.045] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.045] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0044.045] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0044.045] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0044.045] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0044.045] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0044.045] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0044.045] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x1) returned 0x1b00017 [0044.045] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x2) returned 0x1900010 [0044.045] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x7) returned 0x5b0509d2 [0044.045] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x6) returned 0x18a002e [0044.045] SaveDC (hdc=0xffffffff8c0109c0) returned 1 [0044.045] GetNearestColor (hdc=0xffffffff8c0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0044.045] RestoreDC (hdc=0xffffffff8c0109c0, nSavedDC=-1) returned 1 [0044.045] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8c0109c0) returned 0x0 [0044.046] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0044.046] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0044.046] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0044.046] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0044.046] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x1) returned 0x1b00017 [0044.046] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x2) returned 0x1900010 [0044.046] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x7) returned 0x5b0509d2 [0044.046] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x6) returned 0x18a002e [0044.046] SaveDC (hdc=0xffffffff8c0109c0) returned 1 [0044.046] GetTextAlign (hdc=0xffffffff8c0109c0) returned 0x0 [0044.046] GetTextColor (hdc=0xffffffff8c0109c0) returned 0x0 [0044.046] SetTextColor (hdc=0xffffffff8c0109c0, color=0xf0f0f0) returned 0x0 [0044.046] GetCurrentObject (hdc=0xffffffff8c0109c0, type=0x6) returned 0x18a002e [0044.046] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0044.046] SelectObject (hdc=0xffffffff8c0109c0, h=0x260a09ba) returned 0x18a002e [0044.046] GetBkMode (hdc=0xffffffff8c0109c0) returned 2 [0044.046] SetBkMode (hdc=0xffffffff8c0109c0, mode=1) returned 2 [0044.046] DrawTextExW (in: hdc=0xffffffff8c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27d4080 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0044.047] DrawTextExW (in: hdc=0xffffffff8c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27d4080 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0044.047] RestoreDC (hdc=0xffffffff8c0109c0, nSavedDC=-1) returned 1 [0044.047] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8c0109c0) returned 0x0 [0044.047] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0044.047] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff8c0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0044.047] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8c0109c0) returned 0x0 [0044.047] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0044.048] SelectObject (hdc=0xffffffff8c0109c0, h=0x185000f) returned 0x5b0509d2 [0044.048] DeleteDC (hdc=0xffffffff8c0109c0) returned 1 [0044.048] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0044.048] DeleteObject (ho=0x5b0509d2) returned 1 [0044.051] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0044.051] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.051] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.051] WaitMessage () returned 1 [0044.180] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.180] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.180] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.180] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.180] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.181] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0044.182] GetCurrentThreadId () returned 0xa28 [0044.182] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0044.182] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.182] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.182] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.182] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.182] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.182] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0044.182] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0044.183] CreateCompatibleDC (hdc=0x60109d6) returned 0x500109d7 [0044.183] GetObjectType (h=0x60109d6) returned 0x3 [0044.183] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x5c0509d2 [0044.183] GetDIBits (in: hdc=0x60109d6, hbm=0x5c0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.183] GetDIBits (in: hdc=0x60109d6, hbm=0x5c0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.183] DeleteObject (ho=0x5c0509d2) returned 1 [0044.183] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff8d0509c0 [0044.184] SelectObject (hdc=0x500109d7, h=0xffffffff8d0509c0) returned 0x185000f [0044.184] GdipCreateFromHDC (hdc=0x500109d7, graphics=0x26e408) returned 0x0 [0044.184] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0044.184] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0044.184] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0044.184] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0044.184] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0044.184] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4d20 [0044.184] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4d20) returned 0x0 [0044.185] LocalFree (hMem=0x1a7d4d20) returned 0x0 [0044.185] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0044.185] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0044.185] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0044.185] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0044.185] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0044.185] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.185] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.186] GetSystemMetrics (nIndex=42) returned 0 [0044.186] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.186] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.186] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0044.186] IsAppThemed () returned 0x1 [0044.186] GetThemeAppProperties () returned 0x3 [0044.186] GetThemeAppProperties () returned 0x3 [0044.187] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0044.187] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0044.187] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0044.187] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0044.187] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0044.187] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4d20 [0044.187] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4d20) returned 0x0 [0044.187] LocalFree (hMem=0x1a7d4d20) returned 0x0 [0044.187] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0044.187] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4d20 [0044.187] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4d20) returned 0x0 [0044.187] LocalFree (hMem=0x1a7d4d20) returned 0x0 [0044.187] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0044.187] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0044.187] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0044.187] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0044.187] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0044.187] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0044.187] GetCurrentObject (hdc=0x500109d7, type=0x1) returned 0x1b00017 [0044.187] GetCurrentObject (hdc=0x500109d7, type=0x2) returned 0x1900010 [0044.187] GetCurrentObject (hdc=0x500109d7, type=0x7) returned 0xffffffff8d0509c0 [0044.187] GetCurrentObject (hdc=0x500109d7, type=0x6) returned 0x18a002e [0044.188] SaveDC (hdc=0x500109d7) returned 1 [0044.188] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x770409f1 [0044.188] GetClipRgn (hdc=0x500109d7, hrgn=0x770409f1) returned 0 [0044.188] SelectClipRgn (hdc=0x500109d7, hrgn=0xffffffff9e0409ff) returned 2 [0044.188] DeleteObject (ho=0x770409f1) returned 1 [0044.188] DeleteObject (ho=0xffffffff9e0409ff) returned 1 [0044.188] OffsetViewportOrgEx (in: hdc=0x500109d7, x=0, y=0, lppt=0x27d5c60 | out: lppt=0x27d5c60) returned 1 [0044.188] OffsetViewportOrgEx (in: hdc=0x500109d7, x=-417, y=-278, lppt=0x27d5c78 | out: lppt=0x27d5c78) returned 1 [0044.188] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0044.188] GetCurrentObject (hdc=0x500109d7, type=0x1) returned 0x1b00017 [0044.188] GetCurrentObject (hdc=0x500109d7, type=0x2) returned 0x1900010 [0044.188] GetCurrentObject (hdc=0x500109d7, type=0x7) returned 0xffffffff8d0509c0 [0044.188] GetCurrentObject (hdc=0x500109d7, type=0x6) returned 0x18a002e [0044.188] SaveDC (hdc=0x500109d7) returned 2 [0044.188] GetNearestColor (hdc=0x500109d7, color=0x6c4607) returned 0x6c4607 [0044.188] CreateSolidBrush (color=0x6c4607) returned 0x74100276 [0044.188] FillRect (hDC=0x500109d7, lprc=0x26de08, hbr=0x74100276) returned 1 [0044.192] DeleteObject (ho=0x74100276) returned 1 [0044.192] RestoreDC (hdc=0x500109d7, nSavedDC=-1) returned 1 [0044.192] RestoreDC (hdc=0x500109d7, nSavedDC=-1) returned 1 [0044.192] GdipReleaseDC (graphics=0x1b86d040, hdc=0x500109d7) returned 0x0 [0044.192] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd4e0dbd) returned 0x0 [0044.192] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0044.192] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.192] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.192] GetSystemMetrics (nIndex=42) returned 0 [0044.192] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.192] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.192] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x36) returned 0x0 [0044.194] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0044.194] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0044.194] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0044.195] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0044.195] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0044.195] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0044.195] GetCurrentObject (hdc=0x500109d7, type=0x1) returned 0x1b00017 [0044.195] GetCurrentObject (hdc=0x500109d7, type=0x2) returned 0x1900010 [0044.195] GetCurrentObject (hdc=0x500109d7, type=0x7) returned 0xffffffff8d0509c0 [0044.195] GetCurrentObject (hdc=0x500109d7, type=0x6) returned 0x18a002e [0044.195] SaveDC (hdc=0x500109d7) returned 1 [0044.195] GetNearestColor (hdc=0x500109d7, color=0xf0f0f0) returned 0xf0f0f0 [0044.195] RestoreDC (hdc=0x500109d7, nSavedDC=-1) returned 1 [0044.195] GdipReleaseDC (graphics=0x1b86d040, hdc=0x500109d7) returned 0x0 [0044.196] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0044.196] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0044.196] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0044.196] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0044.196] GetCurrentObject (hdc=0x500109d7, type=0x1) returned 0x1b00017 [0044.196] GetCurrentObject (hdc=0x500109d7, type=0x2) returned 0x1900010 [0044.196] GetCurrentObject (hdc=0x500109d7, type=0x7) returned 0xffffffff8d0509c0 [0044.196] GetCurrentObject (hdc=0x500109d7, type=0x6) returned 0x18a002e [0044.196] SaveDC (hdc=0x500109d7) returned 1 [0044.197] GetTextAlign (hdc=0x500109d7) returned 0x0 [0044.197] GetTextColor (hdc=0x500109d7) returned 0x0 [0044.197] SetTextColor (hdc=0x500109d7, color=0xf0f0f0) returned 0x0 [0044.197] GetCurrentObject (hdc=0x500109d7, type=0x6) returned 0x18a002e [0044.197] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0044.197] SelectObject (hdc=0x500109d7, h=0x260a09ba) returned 0x18a002e [0044.197] GetBkMode (hdc=0x500109d7) returned 2 [0044.197] SetBkMode (hdc=0x500109d7, mode=1) returned 2 [0044.197] DrawTextExW (in: hdc=0x500109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27d6b80 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0044.197] DrawTextExW (in: hdc=0x500109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27d6b80 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0044.198] RestoreDC (hdc=0x500109d7, nSavedDC=-1) returned 1 [0044.198] GdipReleaseDC (graphics=0x1b86d040, hdc=0x500109d7) returned 0x0 [0044.198] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0044.198] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x500109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0044.198] GdipReleaseDC (graphics=0x1b86d040, hdc=0x500109d7) returned 0x0 [0044.198] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0044.198] SelectObject (hdc=0x500109d7, h=0x185000f) returned 0xffffffff8d0509c0 [0044.199] DeleteDC (hdc=0x500109d7) returned 1 [0044.199] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0044.199] DeleteObject (ho=0xffffffff8d0509c0) returned 1 [0044.202] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0044.202] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.202] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.202] WaitMessage () returned 1 [0044.318] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.318] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.318] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.318] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.318] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.318] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0044.318] GetCurrentThreadId () returned 0xa28 [0044.318] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0044.318] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.318] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.318] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.318] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.318] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.318] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0044.318] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0044.318] CreateCompatibleDC (hdc=0x60109d6) returned 0x5e0109d2 [0044.318] GetObjectType (h=0x60109d6) returned 0x3 [0044.318] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff8e0509c0 [0044.318] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8e0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.319] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8e0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.319] DeleteObject (ho=0xffffffff8e0509c0) returned 1 [0044.319] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x510509d7 [0044.319] SelectObject (hdc=0x5e0109d2, h=0x510509d7) returned 0x185000f [0044.319] GdipCreateFromHDC (hdc=0x5e0109d2, graphics=0x26e408) returned 0x0 [0044.319] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0044.319] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0044.319] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0044.319] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0044.319] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0044.319] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4da0 [0044.319] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4da0) returned 0x0 [0044.319] LocalFree (hMem=0x1a7d4da0) returned 0x0 [0044.319] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0044.319] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0044.319] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0044.319] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0044.319] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0044.320] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.320] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.320] GetSystemMetrics (nIndex=42) returned 0 [0044.320] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.320] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.320] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0044.320] IsAppThemed () returned 0x1 [0044.320] GetThemeAppProperties () returned 0x3 [0044.320] GetThemeAppProperties () returned 0x3 [0044.320] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0044.320] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0044.320] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0044.320] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0044.320] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0044.320] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4da0 [0044.320] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4da0) returned 0x0 [0044.320] LocalFree (hMem=0x1a7d4da0) returned 0x0 [0044.320] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0044.320] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4da0 [0044.320] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4da0) returned 0x0 [0044.320] LocalFree (hMem=0x1a7d4da0) returned 0x0 [0044.320] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0044.320] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0044.320] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0044.320] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0044.320] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0044.320] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0044.320] GetCurrentObject (hdc=0x5e0109d2, type=0x1) returned 0x1b00017 [0044.320] GetCurrentObject (hdc=0x5e0109d2, type=0x2) returned 0x1900010 [0044.320] GetCurrentObject (hdc=0x5e0109d2, type=0x7) returned 0x510509d7 [0044.321] GetCurrentObject (hdc=0x5e0109d2, type=0x6) returned 0x18a002e [0044.321] SaveDC (hdc=0x5e0109d2) returned 1 [0044.321] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff9f0409ff [0044.321] GetClipRgn (hdc=0x5e0109d2, hrgn=0xffffffff9f0409ff) returned 0 [0044.321] SelectClipRgn (hdc=0x5e0109d2, hrgn=0x7a0409f1) returned 2 [0044.321] DeleteObject (ho=0xffffffff9f0409ff) returned 1 [0044.321] DeleteObject (ho=0x7a0409f1) returned 1 [0044.321] OffsetViewportOrgEx (in: hdc=0x5e0109d2, x=0, y=0, lppt=0x27d8760 | out: lppt=0x27d8760) returned 1 [0044.321] OffsetViewportOrgEx (in: hdc=0x5e0109d2, x=-417, y=-278, lppt=0x27d8778 | out: lppt=0x27d8778) returned 1 [0044.321] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0044.321] GetCurrentObject (hdc=0x5e0109d2, type=0x1) returned 0x1b00017 [0044.321] GetCurrentObject (hdc=0x5e0109d2, type=0x2) returned 0x1900010 [0044.321] GetCurrentObject (hdc=0x5e0109d2, type=0x7) returned 0x510509d7 [0044.321] GetCurrentObject (hdc=0x5e0109d2, type=0x6) returned 0x18a002e [0044.321] SaveDC (hdc=0x5e0109d2) returned 2 [0044.321] GetNearestColor (hdc=0x5e0109d2, color=0x6c4607) returned 0x6c4607 [0044.321] CreateSolidBrush (color=0x6c4607) returned 0x75100276 [0044.321] FillRect (hDC=0x5e0109d2, lprc=0x26de08, hbr=0x75100276) returned 1 [0044.325] DeleteObject (ho=0x75100276) returned 1 [0044.325] RestoreDC (hdc=0x5e0109d2, nSavedDC=-1) returned 1 [0044.325] RestoreDC (hdc=0x5e0109d2, nSavedDC=-1) returned 1 [0044.325] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5e0109d2) returned 0x0 [0044.325] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd4c0dbd) returned 0x0 [0044.325] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0044.325] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.325] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.325] GetSystemMetrics (nIndex=42) returned 0 [0044.325] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.325] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.325] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0044.325] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0044.325] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0044.325] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0044.325] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0044.325] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0044.326] GetCurrentObject (hdc=0x5e0109d2, type=0x1) returned 0x1b00017 [0044.326] GetCurrentObject (hdc=0x5e0109d2, type=0x2) returned 0x1900010 [0044.326] GetCurrentObject (hdc=0x5e0109d2, type=0x7) returned 0x510509d7 [0044.326] GetCurrentObject (hdc=0x5e0109d2, type=0x6) returned 0x18a002e [0044.326] SaveDC (hdc=0x5e0109d2) returned 1 [0044.326] GetNearestColor (hdc=0x5e0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0044.326] RestoreDC (hdc=0x5e0109d2, nSavedDC=-1) returned 1 [0044.326] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5e0109d2) returned 0x0 [0044.326] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0044.326] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0044.326] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0044.326] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0044.326] GetCurrentObject (hdc=0x5e0109d2, type=0x1) returned 0x1b00017 [0044.326] GetCurrentObject (hdc=0x5e0109d2, type=0x2) returned 0x1900010 [0044.326] GetCurrentObject (hdc=0x5e0109d2, type=0x7) returned 0x510509d7 [0044.326] GetCurrentObject (hdc=0x5e0109d2, type=0x6) returned 0x18a002e [0044.326] SaveDC (hdc=0x5e0109d2) returned 1 [0044.326] GetTextAlign (hdc=0x5e0109d2) returned 0x0 [0044.326] GetTextColor (hdc=0x5e0109d2) returned 0x0 [0044.326] SetTextColor (hdc=0x5e0109d2, color=0xf0f0f0) returned 0x0 [0044.326] GetCurrentObject (hdc=0x5e0109d2, type=0x6) returned 0x18a002e [0044.326] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0044.327] SelectObject (hdc=0x5e0109d2, h=0x260a09ba) returned 0x18a002e [0044.327] GetBkMode (hdc=0x5e0109d2) returned 2 [0044.327] SetBkMode (hdc=0x5e0109d2, mode=1) returned 2 [0044.327] DrawTextExW (in: hdc=0x5e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27d9428 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0044.327] DrawTextExW (in: hdc=0x5e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27d9428 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0044.327] RestoreDC (hdc=0x5e0109d2, nSavedDC=-1) returned 1 [0044.327] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5e0109d2) returned 0x0 [0044.327] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0044.327] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x5e0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0044.328] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5e0109d2) returned 0x0 [0044.328] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0044.328] SelectObject (hdc=0x5e0109d2, h=0x185000f) returned 0x510509d7 [0044.328] DeleteDC (hdc=0x5e0109d2) returned 1 [0044.328] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0044.328] DeleteObject (ho=0x510509d7) returned 1 [0044.331] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0044.331] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.331] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.331] WaitMessage () returned 1 [0044.443] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.443] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.443] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.443] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.443] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.443] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0044.443] GetCurrentThreadId () returned 0xa28 [0044.443] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0044.443] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.443] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.443] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.443] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.443] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.443] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0044.443] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0044.443] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff900109c0 [0044.443] GetObjectType (h=0x60109d6) returned 0x3 [0044.443] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x520509d7 [0044.444] GetDIBits (in: hdc=0x60109d6, hbm=0x520509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.444] GetDIBits (in: hdc=0x60109d6, hbm=0x520509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.444] DeleteObject (ho=0x520509d7) returned 1 [0044.444] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x5f0509d2 [0044.444] SelectObject (hdc=0xffffffff900109c0, h=0x5f0509d2) returned 0x185000f [0044.444] GdipCreateFromHDC (hdc=0xffffffff900109c0, graphics=0x26e408) returned 0x0 [0044.444] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0044.444] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0044.444] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0044.444] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0044.444] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0044.444] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4da0 [0044.444] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4da0) returned 0x0 [0044.444] LocalFree (hMem=0x1a7d4da0) returned 0x0 [0044.444] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0044.444] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0044.444] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0044.444] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0044.444] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0044.445] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.445] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.445] GetSystemMetrics (nIndex=42) returned 0 [0044.445] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.445] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.445] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0044.445] IsAppThemed () returned 0x1 [0044.445] GetThemeAppProperties () returned 0x3 [0044.445] GetThemeAppProperties () returned 0x3 [0044.445] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0044.445] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0044.445] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0044.445] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0044.445] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0044.445] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4da0 [0044.445] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4da0) returned 0x0 [0044.445] LocalFree (hMem=0x1a7d4da0) returned 0x0 [0044.445] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0044.445] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4da0 [0044.445] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4da0) returned 0x0 [0044.445] LocalFree (hMem=0x1a7d4da0) returned 0x0 [0044.445] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0044.445] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0044.445] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0044.445] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0044.445] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0044.445] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0044.445] GetCurrentObject (hdc=0xffffffff900109c0, type=0x1) returned 0x1b00017 [0044.445] GetCurrentObject (hdc=0xffffffff900109c0, type=0x2) returned 0x1900010 [0044.445] GetCurrentObject (hdc=0xffffffff900109c0, type=0x7) returned 0x5f0509d2 [0044.446] GetCurrentObject (hdc=0xffffffff900109c0, type=0x6) returned 0x18a002e [0044.446] SaveDC (hdc=0xffffffff900109c0) returned 1 [0044.446] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7b0409f1 [0044.446] GetClipRgn (hdc=0xffffffff900109c0, hrgn=0x7b0409f1) returned 0 [0044.446] SelectClipRgn (hdc=0xffffffff900109c0, hrgn=0xffffffffa20409ff) returned 2 [0044.446] DeleteObject (ho=0x7b0409f1) returned 1 [0044.446] DeleteObject (ho=0xffffffffa20409ff) returned 1 [0044.446] OffsetViewportOrgEx (in: hdc=0xffffffff900109c0, x=0, y=0, lppt=0x27db008 | out: lppt=0x27db008) returned 1 [0044.446] OffsetViewportOrgEx (in: hdc=0xffffffff900109c0, x=-417, y=-278, lppt=0x27db020 | out: lppt=0x27db020) returned 1 [0044.446] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0044.446] GetCurrentObject (hdc=0xffffffff900109c0, type=0x1) returned 0x1b00017 [0044.446] GetCurrentObject (hdc=0xffffffff900109c0, type=0x2) returned 0x1900010 [0044.446] GetCurrentObject (hdc=0xffffffff900109c0, type=0x7) returned 0x5f0509d2 [0044.446] GetCurrentObject (hdc=0xffffffff900109c0, type=0x6) returned 0x18a002e [0044.446] SaveDC (hdc=0xffffffff900109c0) returned 2 [0044.446] GetNearestColor (hdc=0xffffffff900109c0, color=0x6c4607) returned 0x6c4607 [0044.446] CreateSolidBrush (color=0x6c4607) returned 0x76100276 [0044.446] FillRect (hDC=0xffffffff900109c0, lprc=0x26de08, hbr=0x76100276) returned 1 [0044.449] DeleteObject (ho=0x76100276) returned 1 [0044.449] RestoreDC (hdc=0xffffffff900109c0, nSavedDC=-1) returned 1 [0044.449] RestoreDC (hdc=0xffffffff900109c0, nSavedDC=-1) returned 1 [0044.450] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff900109c0) returned 0x0 [0044.450] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd4a0dbd) returned 0x0 [0044.450] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0044.450] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.450] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.450] GetSystemMetrics (nIndex=42) returned 0 [0044.450] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.450] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.450] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x38) returned 0x0 [0044.451] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0044.451] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0044.451] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0044.451] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0044.451] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0044.451] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0044.451] GetCurrentObject (hdc=0xffffffff900109c0, type=0x1) returned 0x1b00017 [0044.451] GetCurrentObject (hdc=0xffffffff900109c0, type=0x2) returned 0x1900010 [0044.451] GetCurrentObject (hdc=0xffffffff900109c0, type=0x7) returned 0x5f0509d2 [0044.451] GetCurrentObject (hdc=0xffffffff900109c0, type=0x6) returned 0x18a002e [0044.451] SaveDC (hdc=0xffffffff900109c0) returned 1 [0044.451] GetNearestColor (hdc=0xffffffff900109c0, color=0xf0f0f0) returned 0xf0f0f0 [0044.451] RestoreDC (hdc=0xffffffff900109c0, nSavedDC=-1) returned 1 [0044.451] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff900109c0) returned 0x0 [0044.452] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0044.452] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0044.452] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0044.452] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0044.452] GetCurrentObject (hdc=0xffffffff900109c0, type=0x1) returned 0x1b00017 [0044.452] GetCurrentObject (hdc=0xffffffff900109c0, type=0x2) returned 0x1900010 [0044.452] GetCurrentObject (hdc=0xffffffff900109c0, type=0x7) returned 0x5f0509d2 [0044.452] GetCurrentObject (hdc=0xffffffff900109c0, type=0x6) returned 0x18a002e [0044.452] SaveDC (hdc=0xffffffff900109c0) returned 1 [0044.452] GetTextAlign (hdc=0xffffffff900109c0) returned 0x0 [0044.452] GetTextColor (hdc=0xffffffff900109c0) returned 0x0 [0044.452] SetTextColor (hdc=0xffffffff900109c0, color=0xf0f0f0) returned 0x0 [0044.452] GetCurrentObject (hdc=0xffffffff900109c0, type=0x6) returned 0x18a002e [0044.452] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0044.452] SelectObject (hdc=0xffffffff900109c0, h=0x260a09ba) returned 0x18a002e [0044.452] GetBkMode (hdc=0xffffffff900109c0) returned 2 [0044.452] SetBkMode (hdc=0xffffffff900109c0, mode=1) returned 2 [0044.452] DrawTextExW (in: hdc=0xffffffff900109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27dbf20 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0044.452] DrawTextExW (in: hdc=0xffffffff900109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27dbf20 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0044.453] RestoreDC (hdc=0xffffffff900109c0, nSavedDC=-1) returned 1 [0044.453] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff900109c0) returned 0x0 [0044.453] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0044.453] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff900109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0044.453] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff900109c0) returned 0x0 [0044.453] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0044.453] SelectObject (hdc=0xffffffff900109c0, h=0x185000f) returned 0x5f0509d2 [0044.453] DeleteDC (hdc=0xffffffff900109c0) returned 1 [0044.453] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0044.453] DeleteObject (ho=0x5f0509d2) returned 1 [0044.456] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0044.456] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.456] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.456] WaitMessage () returned 1 [0044.567] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.567] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.567] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.567] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.567] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.567] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0044.568] GetCurrentThreadId () returned 0xa28 [0044.568] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0044.568] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.568] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.568] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.568] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.568] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.568] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0044.568] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0044.568] CreateCompatibleDC (hdc=0x60109d6) returned 0x540109d7 [0044.568] GetObjectType (h=0x60109d6) returned 0x3 [0044.568] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x600509d2 [0044.568] GetDIBits (in: hdc=0x60109d6, hbm=0x600509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.568] GetDIBits (in: hdc=0x60109d6, hbm=0x600509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.568] DeleteObject (ho=0x600509d2) returned 1 [0044.568] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff910509c0 [0044.568] SelectObject (hdc=0x540109d7, h=0xffffffff910509c0) returned 0x185000f [0044.568] GdipCreateFromHDC (hdc=0x540109d7, graphics=0x26e408) returned 0x0 [0044.569] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0044.569] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0044.569] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0044.569] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0044.569] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0044.569] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4e20 [0044.569] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4e20) returned 0x0 [0044.569] LocalFree (hMem=0x1a7d4e20) returned 0x0 [0044.569] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0044.569] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0044.569] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0044.569] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0044.569] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0044.569] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.569] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.569] GetSystemMetrics (nIndex=42) returned 0 [0044.569] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.569] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.569] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0044.569] IsAppThemed () returned 0x1 [0044.569] GetThemeAppProperties () returned 0x3 [0044.569] GetThemeAppProperties () returned 0x3 [0044.569] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0044.569] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0044.570] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0044.570] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0044.570] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0044.570] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4e20 [0044.570] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4e20) returned 0x0 [0044.570] LocalFree (hMem=0x1a7d4e20) returned 0x0 [0044.570] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0044.570] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4e20 [0044.570] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4e20) returned 0x0 [0044.570] LocalFree (hMem=0x1a7d4e20) returned 0x0 [0044.570] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0044.570] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0044.570] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0044.570] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0044.570] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0044.570] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0044.570] GetCurrentObject (hdc=0x540109d7, type=0x1) returned 0x1b00017 [0044.570] GetCurrentObject (hdc=0x540109d7, type=0x2) returned 0x1900010 [0044.570] GetCurrentObject (hdc=0x540109d7, type=0x7) returned 0xffffffff910509c0 [0044.570] GetCurrentObject (hdc=0x540109d7, type=0x6) returned 0x18a002e [0044.570] SaveDC (hdc=0x540109d7) returned 1 [0044.570] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa30409ff [0044.570] GetClipRgn (hdc=0x540109d7, hrgn=0xffffffffa30409ff) returned 0 [0044.570] SelectClipRgn (hdc=0x540109d7, hrgn=0x7e0409f1) returned 2 [0044.570] DeleteObject (ho=0xffffffffa30409ff) returned 1 [0044.570] DeleteObject (ho=0x7e0409f1) returned 1 [0044.570] OffsetViewportOrgEx (in: hdc=0x540109d7, x=0, y=0, lppt=0x27ddb00 | out: lppt=0x27ddb00) returned 1 [0044.570] OffsetViewportOrgEx (in: hdc=0x540109d7, x=-417, y=-278, lppt=0x27ddb18 | out: lppt=0x27ddb18) returned 1 [0044.570] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0044.570] GetCurrentObject (hdc=0x540109d7, type=0x1) returned 0x1b00017 [0044.571] GetCurrentObject (hdc=0x540109d7, type=0x2) returned 0x1900010 [0044.571] GetCurrentObject (hdc=0x540109d7, type=0x7) returned 0xffffffff910509c0 [0044.571] GetCurrentObject (hdc=0x540109d7, type=0x6) returned 0x18a002e [0044.571] SaveDC (hdc=0x540109d7) returned 2 [0044.571] GetNearestColor (hdc=0x540109d7, color=0x6c4607) returned 0x6c4607 [0044.571] CreateSolidBrush (color=0x6c4607) returned 0x77100276 [0044.571] FillRect (hDC=0x540109d7, lprc=0x26de08, hbr=0x77100276) returned 1 [0044.574] DeleteObject (ho=0x77100276) returned 1 [0044.574] RestoreDC (hdc=0x540109d7, nSavedDC=-1) returned 1 [0044.574] RestoreDC (hdc=0x540109d7, nSavedDC=-1) returned 1 [0044.574] GdipReleaseDC (graphics=0x1b86d040, hdc=0x540109d7) returned 0x0 [0044.574] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd480dbd) returned 0x0 [0044.574] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0044.574] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.574] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.574] GetSystemMetrics (nIndex=42) returned 0 [0044.574] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.574] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.575] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0044.575] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0044.575] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0044.575] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0044.575] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0044.575] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0044.575] GetCurrentObject (hdc=0x540109d7, type=0x1) returned 0x1b00017 [0044.575] GetCurrentObject (hdc=0x540109d7, type=0x2) returned 0x1900010 [0044.575] GetCurrentObject (hdc=0x540109d7, type=0x7) returned 0xffffffff910509c0 [0044.575] GetCurrentObject (hdc=0x540109d7, type=0x6) returned 0x18a002e [0044.575] SaveDC (hdc=0x540109d7) returned 1 [0044.575] GetNearestColor (hdc=0x540109d7, color=0xf0f0f0) returned 0xf0f0f0 [0044.575] RestoreDC (hdc=0x540109d7, nSavedDC=-1) returned 1 [0044.575] GdipReleaseDC (graphics=0x1b86d040, hdc=0x540109d7) returned 0x0 [0044.575] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0044.575] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0044.575] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0044.575] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0044.575] GetCurrentObject (hdc=0x540109d7, type=0x1) returned 0x1b00017 [0044.575] GetCurrentObject (hdc=0x540109d7, type=0x2) returned 0x1900010 [0044.576] GetCurrentObject (hdc=0x540109d7, type=0x7) returned 0xffffffff910509c0 [0044.576] GetCurrentObject (hdc=0x540109d7, type=0x6) returned 0x18a002e [0044.576] SaveDC (hdc=0x540109d7) returned 1 [0044.576] GetTextAlign (hdc=0x540109d7) returned 0x0 [0044.576] GetTextColor (hdc=0x540109d7) returned 0x0 [0044.576] SetTextColor (hdc=0x540109d7, color=0xf0f0f0) returned 0x0 [0044.576] GetCurrentObject (hdc=0x540109d7, type=0x6) returned 0x18a002e [0044.576] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0044.576] SelectObject (hdc=0x540109d7, h=0x260a09ba) returned 0x18a002e [0044.576] GetBkMode (hdc=0x540109d7) returned 2 [0044.576] SetBkMode (hdc=0x540109d7, mode=1) returned 2 [0044.576] DrawTextExW (in: hdc=0x540109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27de7c8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0044.576] DrawTextExW (in: hdc=0x540109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27de7c8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0044.577] RestoreDC (hdc=0x540109d7, nSavedDC=-1) returned 1 [0044.577] GdipReleaseDC (graphics=0x1b86d040, hdc=0x540109d7) returned 0x0 [0044.577] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0044.577] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x540109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0044.577] GdipReleaseDC (graphics=0x1b86d040, hdc=0x540109d7) returned 0x0 [0044.577] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0044.577] SelectObject (hdc=0x540109d7, h=0x185000f) returned 0xffffffff910509c0 [0044.577] DeleteDC (hdc=0x540109d7) returned 1 [0044.577] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0044.577] DeleteObject (ho=0xffffffff910509c0) returned 1 [0044.580] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0044.580] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.580] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.580] WaitMessage () returned 1 [0044.692] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.692] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.692] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.692] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.692] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.692] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0044.692] GetCurrentThreadId () returned 0xa28 [0044.692] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0044.692] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.692] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.692] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.692] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.692] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.692] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0044.693] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0044.693] CreateCompatibleDC (hdc=0x60109d6) returned 0x620109d2 [0044.693] GetObjectType (h=0x60109d6) returned 0x3 [0044.693] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff920509c0 [0044.693] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff920509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.693] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff920509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.693] DeleteObject (ho=0xffffffff920509c0) returned 1 [0044.693] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x550509d7 [0044.693] SelectObject (hdc=0x620109d2, h=0x550509d7) returned 0x185000f [0044.693] GdipCreateFromHDC (hdc=0x620109d2, graphics=0x26e408) returned 0x0 [0044.693] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0044.693] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0044.693] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0044.693] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0044.693] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0044.693] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4e20 [0044.693] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4e20) returned 0x0 [0044.694] LocalFree (hMem=0x1a7d4e20) returned 0x0 [0044.694] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0044.694] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0044.694] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0044.694] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0044.694] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0044.694] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.694] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.694] GetSystemMetrics (nIndex=42) returned 0 [0044.694] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.694] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.694] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0044.694] IsAppThemed () returned 0x1 [0044.694] GetThemeAppProperties () returned 0x3 [0044.694] GetThemeAppProperties () returned 0x3 [0044.694] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0044.694] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0044.694] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0044.694] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0044.694] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0044.694] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4e20 [0044.694] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4e20) returned 0x0 [0044.694] LocalFree (hMem=0x1a7d4e20) returned 0x0 [0044.694] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0044.694] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4e20 [0044.694] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4e20) returned 0x0 [0044.694] LocalFree (hMem=0x1a7d4e20) returned 0x0 [0044.695] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0044.695] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0044.695] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0044.695] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0044.695] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0044.695] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0044.695] GetCurrentObject (hdc=0x620109d2, type=0x1) returned 0x1b00017 [0044.695] GetCurrentObject (hdc=0x620109d2, type=0x2) returned 0x1900010 [0044.695] GetCurrentObject (hdc=0x620109d2, type=0x7) returned 0x550509d7 [0044.695] GetCurrentObject (hdc=0x620109d2, type=0x6) returned 0x18a002e [0044.695] SaveDC (hdc=0x620109d2) returned 1 [0044.695] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7f0409f1 [0044.695] GetClipRgn (hdc=0x620109d2, hrgn=0x7f0409f1) returned 0 [0044.695] SelectClipRgn (hdc=0x620109d2, hrgn=0xffffffffa60409ff) returned 2 [0044.695] DeleteObject (ho=0x7f0409f1) returned 1 [0044.695] DeleteObject (ho=0xffffffffa60409ff) returned 1 [0044.695] OffsetViewportOrgEx (in: hdc=0x620109d2, x=0, y=0, lppt=0x27e03a8 | out: lppt=0x27e03a8) returned 1 [0044.695] OffsetViewportOrgEx (in: hdc=0x620109d2, x=-417, y=-278, lppt=0x27e03c0 | out: lppt=0x27e03c0) returned 1 [0044.695] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0044.695] GetCurrentObject (hdc=0x620109d2, type=0x1) returned 0x1b00017 [0044.695] GetCurrentObject (hdc=0x620109d2, type=0x2) returned 0x1900010 [0044.695] GetCurrentObject (hdc=0x620109d2, type=0x7) returned 0x550509d7 [0044.695] GetCurrentObject (hdc=0x620109d2, type=0x6) returned 0x18a002e [0044.695] SaveDC (hdc=0x620109d2) returned 2 [0044.695] GetNearestColor (hdc=0x620109d2, color=0x6c4607) returned 0x6c4607 [0044.695] CreateSolidBrush (color=0x6c4607) returned 0x78100276 [0044.695] FillRect (hDC=0x620109d2, lprc=0x26de08, hbr=0x78100276) returned 1 [0044.699] DeleteObject (ho=0x78100276) returned 1 [0044.699] RestoreDC (hdc=0x620109d2, nSavedDC=-1) returned 1 [0044.699] RestoreDC (hdc=0x620109d2, nSavedDC=-1) returned 1 [0044.699] GdipReleaseDC (graphics=0x1b86d040, hdc=0x620109d2) returned 0x0 [0044.699] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd460dbd) returned 0x0 [0044.699] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0044.699] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.699] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.699] GetSystemMetrics (nIndex=42) returned 0 [0044.699] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.699] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.699] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x3a) returned 0x0 [0044.700] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0044.700] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0044.700] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0044.700] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0044.700] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0044.700] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0044.700] GetCurrentObject (hdc=0x620109d2, type=0x1) returned 0x1b00017 [0044.700] GetCurrentObject (hdc=0x620109d2, type=0x2) returned 0x1900010 [0044.700] GetCurrentObject (hdc=0x620109d2, type=0x7) returned 0x550509d7 [0044.701] GetCurrentObject (hdc=0x620109d2, type=0x6) returned 0x18a002e [0044.701] SaveDC (hdc=0x620109d2) returned 1 [0044.701] GetNearestColor (hdc=0x620109d2, color=0xf0f0f0) returned 0xf0f0f0 [0044.701] RestoreDC (hdc=0x620109d2, nSavedDC=-1) returned 1 [0044.701] GdipReleaseDC (graphics=0x1b86d040, hdc=0x620109d2) returned 0x0 [0044.701] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0044.701] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0044.701] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0044.701] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0044.701] GetCurrentObject (hdc=0x620109d2, type=0x1) returned 0x1b00017 [0044.701] GetCurrentObject (hdc=0x620109d2, type=0x2) returned 0x1900010 [0044.701] GetCurrentObject (hdc=0x620109d2, type=0x7) returned 0x550509d7 [0044.701] GetCurrentObject (hdc=0x620109d2, type=0x6) returned 0x18a002e [0044.701] SaveDC (hdc=0x620109d2) returned 1 [0044.701] GetTextAlign (hdc=0x620109d2) returned 0x0 [0044.701] GetTextColor (hdc=0x620109d2) returned 0x0 [0044.701] SetTextColor (hdc=0x620109d2, color=0xf0f0f0) returned 0x0 [0044.701] GetCurrentObject (hdc=0x620109d2, type=0x6) returned 0x18a002e [0044.701] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0044.701] SelectObject (hdc=0x620109d2, h=0x260a09ba) returned 0x18a002e [0044.701] GetBkMode (hdc=0x620109d2) returned 2 [0044.702] SetBkMode (hdc=0x620109d2, mode=1) returned 2 [0044.702] DrawTextExW (in: hdc=0x620109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27e12d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0044.702] DrawTextExW (in: hdc=0x620109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27e12d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0044.702] RestoreDC (hdc=0x620109d2, nSavedDC=-1) returned 1 [0044.702] GdipReleaseDC (graphics=0x1b86d040, hdc=0x620109d2) returned 0x0 [0044.702] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0044.702] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x620109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0044.703] GdipReleaseDC (graphics=0x1b86d040, hdc=0x620109d2) returned 0x0 [0044.703] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0044.703] SelectObject (hdc=0x620109d2, h=0x185000f) returned 0x550509d7 [0044.703] DeleteDC (hdc=0x620109d2) returned 1 [0044.703] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0044.703] DeleteObject (ho=0x550509d7) returned 1 [0044.706] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0044.706] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.706] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.706] WaitMessage () returned 1 [0044.817] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.817] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.817] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.817] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.817] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.817] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0044.817] GetCurrentThreadId () returned 0xa28 [0044.817] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0044.817] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.817] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.817] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.817] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.817] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.817] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0044.818] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0044.818] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff940109c0 [0044.818] GetObjectType (h=0x60109d6) returned 0x3 [0044.818] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x560509d7 [0044.818] GetDIBits (in: hdc=0x60109d6, hbm=0x560509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.818] GetDIBits (in: hdc=0x60109d6, hbm=0x560509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.818] DeleteObject (ho=0x560509d7) returned 1 [0044.818] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x630509d2 [0044.819] SelectObject (hdc=0xffffffff940109c0, h=0x630509d2) returned 0x185000f [0044.819] GdipCreateFromHDC (hdc=0xffffffff940109c0, graphics=0x26e408) returned 0x0 [0044.819] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0044.819] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0044.819] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0044.819] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0044.819] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0044.819] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ea0 [0044.819] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4ea0) returned 0x0 [0044.820] LocalFree (hMem=0x1a7d4ea0) returned 0x0 [0044.820] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0044.820] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0044.820] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0044.820] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0044.820] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0044.820] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.820] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.820] GetSystemMetrics (nIndex=42) returned 0 [0044.820] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.820] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.820] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0044.820] IsAppThemed () returned 0x1 [0044.820] GetThemeAppProperties () returned 0x3 [0044.820] GetThemeAppProperties () returned 0x3 [0044.820] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0044.820] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0044.820] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0044.820] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0044.820] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0044.820] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ea0 [0044.820] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ea0) returned 0x0 [0044.820] LocalFree (hMem=0x1a7d4ea0) returned 0x0 [0044.820] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0044.820] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ea0 [0044.820] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ea0) returned 0x0 [0044.820] LocalFree (hMem=0x1a7d4ea0) returned 0x0 [0044.820] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0044.820] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0044.821] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0044.821] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0044.821] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0044.821] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0044.821] GetCurrentObject (hdc=0xffffffff940109c0, type=0x1) returned 0x1b00017 [0044.821] GetCurrentObject (hdc=0xffffffff940109c0, type=0x2) returned 0x1900010 [0044.821] GetCurrentObject (hdc=0xffffffff940109c0, type=0x7) returned 0x630509d2 [0044.821] GetCurrentObject (hdc=0xffffffff940109c0, type=0x6) returned 0x18a002e [0044.821] SaveDC (hdc=0xffffffff940109c0) returned 1 [0044.821] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa70409ff [0044.821] GetClipRgn (hdc=0xffffffff940109c0, hrgn=0xffffffffa70409ff) returned 0 [0044.821] SelectClipRgn (hdc=0xffffffff940109c0, hrgn=0xffffffff820409f1) returned 2 [0044.821] DeleteObject (ho=0xffffffffa70409ff) returned 1 [0044.821] DeleteObject (ho=0xffffffff820409f1) returned 1 [0044.821] OffsetViewportOrgEx (in: hdc=0xffffffff940109c0, x=0, y=0, lppt=0x27e2eb0 | out: lppt=0x27e2eb0) returned 1 [0044.821] OffsetViewportOrgEx (in: hdc=0xffffffff940109c0, x=-417, y=-278, lppt=0x27e2ec8 | out: lppt=0x27e2ec8) returned 1 [0044.821] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0044.821] GetCurrentObject (hdc=0xffffffff940109c0, type=0x1) returned 0x1b00017 [0044.821] GetCurrentObject (hdc=0xffffffff940109c0, type=0x2) returned 0x1900010 [0044.821] GetCurrentObject (hdc=0xffffffff940109c0, type=0x7) returned 0x630509d2 [0044.821] GetCurrentObject (hdc=0xffffffff940109c0, type=0x6) returned 0x18a002e [0044.821] SaveDC (hdc=0xffffffff940109c0) returned 2 [0044.821] GetNearestColor (hdc=0xffffffff940109c0, color=0x6c4607) returned 0x6c4607 [0044.821] CreateSolidBrush (color=0x6c4607) returned 0x79100276 [0044.821] FillRect (hDC=0xffffffff940109c0, lprc=0x26de08, hbr=0x79100276) returned 1 [0044.825] DeleteObject (ho=0x79100276) returned 1 [0044.825] RestoreDC (hdc=0xffffffff940109c0, nSavedDC=-1) returned 1 [0044.825] RestoreDC (hdc=0xffffffff940109c0, nSavedDC=-1) returned 1 [0044.825] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff940109c0) returned 0x0 [0044.825] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd440dbd) returned 0x0 [0044.825] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0044.825] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.825] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.825] GetSystemMetrics (nIndex=42) returned 0 [0044.825] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.825] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.825] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0044.825] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0044.825] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0044.825] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0044.825] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0044.825] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0044.825] GetCurrentObject (hdc=0xffffffff940109c0, type=0x1) returned 0x1b00017 [0044.825] GetCurrentObject (hdc=0xffffffff940109c0, type=0x2) returned 0x1900010 [0044.825] GetCurrentObject (hdc=0xffffffff940109c0, type=0x7) returned 0x630509d2 [0044.825] GetCurrentObject (hdc=0xffffffff940109c0, type=0x6) returned 0x18a002e [0044.825] SaveDC (hdc=0xffffffff940109c0) returned 1 [0044.826] GetNearestColor (hdc=0xffffffff940109c0, color=0xf0f0f0) returned 0xf0f0f0 [0044.826] RestoreDC (hdc=0xffffffff940109c0, nSavedDC=-1) returned 1 [0044.826] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff940109c0) returned 0x0 [0044.826] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0044.826] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0044.826] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0044.826] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0044.826] GetCurrentObject (hdc=0xffffffff940109c0, type=0x1) returned 0x1b00017 [0044.826] GetCurrentObject (hdc=0xffffffff940109c0, type=0x2) returned 0x1900010 [0044.826] GetCurrentObject (hdc=0xffffffff940109c0, type=0x7) returned 0x630509d2 [0044.826] GetCurrentObject (hdc=0xffffffff940109c0, type=0x6) returned 0x18a002e [0044.826] SaveDC (hdc=0xffffffff940109c0) returned 1 [0044.826] GetTextAlign (hdc=0xffffffff940109c0) returned 0x0 [0044.826] GetTextColor (hdc=0xffffffff940109c0) returned 0x0 [0044.826] SetTextColor (hdc=0xffffffff940109c0, color=0xf0f0f0) returned 0x0 [0044.826] GetCurrentObject (hdc=0xffffffff940109c0, type=0x6) returned 0x18a002e [0044.826] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0044.826] SelectObject (hdc=0xffffffff940109c0, h=0x260a09ba) returned 0x18a002e [0044.826] GetBkMode (hdc=0xffffffff940109c0) returned 2 [0044.826] SetBkMode (hdc=0xffffffff940109c0, mode=1) returned 2 [0044.826] DrawTextExW (in: hdc=0xffffffff940109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27e3b78 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0044.827] DrawTextExW (in: hdc=0xffffffff940109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27e3b78 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0044.827] RestoreDC (hdc=0xffffffff940109c0, nSavedDC=-1) returned 1 [0044.827] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff940109c0) returned 0x0 [0044.827] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0044.827] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff940109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0044.827] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff940109c0) returned 0x0 [0044.827] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0044.827] SelectObject (hdc=0xffffffff940109c0, h=0x185000f) returned 0x630509d2 [0044.827] DeleteDC (hdc=0xffffffff940109c0) returned 1 [0044.827] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0044.827] DeleteObject (ho=0x630509d2) returned 1 [0044.831] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0044.831] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.831] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.831] WaitMessage () returned 1 [0044.942] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.942] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.942] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.942] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.942] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.942] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0044.942] GetCurrentThreadId () returned 0xa28 [0044.942] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0044.942] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.942] IsWindowUnicode (hWnd=0x3015e) returned 1 [0044.942] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0044.942] TranslateMessage (lpMsg=0x26ee10) returned 0 [0044.942] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0044.942] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0044.942] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0044.942] CreateCompatibleDC (hdc=0x60109d6) returned 0x580109d7 [0044.942] GetObjectType (h=0x60109d6) returned 0x3 [0044.942] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x640509d2 [0044.943] GetDIBits (in: hdc=0x60109d6, hbm=0x640509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.943] GetDIBits (in: hdc=0x60109d6, hbm=0x640509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0044.943] DeleteObject (ho=0x640509d2) returned 1 [0044.943] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff950509c0 [0044.943] SelectObject (hdc=0x580109d7, h=0xffffffff950509c0) returned 0x185000f [0044.943] GdipCreateFromHDC (hdc=0x580109d7, graphics=0x26e408) returned 0x0 [0044.943] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0044.943] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0044.943] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0044.943] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0044.943] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0044.943] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ea0 [0044.943] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4ea0) returned 0x0 [0044.943] LocalFree (hMem=0x1a7d4ea0) returned 0x0 [0044.943] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0044.943] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0044.943] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0044.943] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0044.944] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0044.944] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.944] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.944] GetSystemMetrics (nIndex=42) returned 0 [0044.944] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.944] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.944] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0044.944] IsAppThemed () returned 0x1 [0044.944] GetThemeAppProperties () returned 0x3 [0044.944] GetThemeAppProperties () returned 0x3 [0044.944] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0044.944] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0044.944] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0044.944] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0044.944] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0044.944] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ea0 [0044.944] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ea0) returned 0x0 [0044.944] LocalFree (hMem=0x1a7d4ea0) returned 0x0 [0044.944] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0044.944] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4ea0 [0044.944] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4ea0) returned 0x0 [0044.944] LocalFree (hMem=0x1a7d4ea0) returned 0x0 [0044.944] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0044.944] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0044.944] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0044.944] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0044.944] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0044.944] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0044.944] GetCurrentObject (hdc=0x580109d7, type=0x1) returned 0x1b00017 [0044.944] GetCurrentObject (hdc=0x580109d7, type=0x2) returned 0x1900010 [0044.944] GetCurrentObject (hdc=0x580109d7, type=0x7) returned 0xffffffff950509c0 [0044.945] GetCurrentObject (hdc=0x580109d7, type=0x6) returned 0x18a002e [0044.945] SaveDC (hdc=0x580109d7) returned 1 [0044.945] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff830409f1 [0044.945] GetClipRgn (hdc=0x580109d7, hrgn=0xffffffff830409f1) returned 0 [0044.945] SelectClipRgn (hdc=0x580109d7, hrgn=0xffffffffaa0409ff) returned 2 [0044.945] DeleteObject (ho=0xffffffff830409f1) returned 1 [0044.945] DeleteObject (ho=0xffffffffaa0409ff) returned 1 [0044.945] OffsetViewportOrgEx (in: hdc=0x580109d7, x=0, y=0, lppt=0x27e5758 | out: lppt=0x27e5758) returned 1 [0044.945] OffsetViewportOrgEx (in: hdc=0x580109d7, x=-417, y=-278, lppt=0x27e5770 | out: lppt=0x27e5770) returned 1 [0044.945] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0044.945] GetCurrentObject (hdc=0x580109d7, type=0x1) returned 0x1b00017 [0044.945] GetCurrentObject (hdc=0x580109d7, type=0x2) returned 0x1900010 [0044.945] GetCurrentObject (hdc=0x580109d7, type=0x7) returned 0xffffffff950509c0 [0044.945] GetCurrentObject (hdc=0x580109d7, type=0x6) returned 0x18a002e [0044.945] SaveDC (hdc=0x580109d7) returned 2 [0044.945] GetNearestColor (hdc=0x580109d7, color=0x6c4607) returned 0x6c4607 [0044.945] CreateSolidBrush (color=0x6c4607) returned 0x7a100276 [0044.945] FillRect (hDC=0x580109d7, lprc=0x26de08, hbr=0x7a100276) returned 1 [0044.949] DeleteObject (ho=0x7a100276) returned 1 [0044.949] RestoreDC (hdc=0x580109d7, nSavedDC=-1) returned 1 [0044.949] RestoreDC (hdc=0x580109d7, nSavedDC=-1) returned 1 [0044.949] GdipReleaseDC (graphics=0x1b86d040, hdc=0x580109d7) returned 0x0 [0044.949] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd420dbd) returned 0x0 [0044.949] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0044.949] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0044.949] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0044.949] GetSystemMetrics (nIndex=42) returned 0 [0044.949] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0044.949] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0044.949] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x3c) returned 0x0 [0044.950] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0044.950] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0044.950] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0044.950] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0044.950] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0044.950] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0044.950] GetCurrentObject (hdc=0x580109d7, type=0x1) returned 0x1b00017 [0044.950] GetCurrentObject (hdc=0x580109d7, type=0x2) returned 0x1900010 [0044.950] GetCurrentObject (hdc=0x580109d7, type=0x7) returned 0xffffffff950509c0 [0044.950] GetCurrentObject (hdc=0x580109d7, type=0x6) returned 0x18a002e [0044.950] SaveDC (hdc=0x580109d7) returned 1 [0044.950] GetNearestColor (hdc=0x580109d7, color=0xf0f0f0) returned 0xf0f0f0 [0044.950] RestoreDC (hdc=0x580109d7, nSavedDC=-1) returned 1 [0044.950] GdipReleaseDC (graphics=0x1b86d040, hdc=0x580109d7) returned 0x0 [0044.951] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0044.951] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0044.951] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0044.951] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0044.951] GetCurrentObject (hdc=0x580109d7, type=0x1) returned 0x1b00017 [0044.951] GetCurrentObject (hdc=0x580109d7, type=0x2) returned 0x1900010 [0044.951] GetCurrentObject (hdc=0x580109d7, type=0x7) returned 0xffffffff950509c0 [0044.951] GetCurrentObject (hdc=0x580109d7, type=0x6) returned 0x18a002e [0044.951] SaveDC (hdc=0x580109d7) returned 1 [0044.951] GetTextAlign (hdc=0x580109d7) returned 0x0 [0044.951] GetTextColor (hdc=0x580109d7) returned 0x0 [0044.951] SetTextColor (hdc=0x580109d7, color=0xf0f0f0) returned 0x0 [0044.951] GetCurrentObject (hdc=0x580109d7, type=0x6) returned 0x18a002e [0044.951] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0044.951] SelectObject (hdc=0x580109d7, h=0x260a09ba) returned 0x18a002e [0044.951] GetBkMode (hdc=0x580109d7) returned 2 [0044.951] SetBkMode (hdc=0x580109d7, mode=1) returned 2 [0044.951] DrawTextExW (in: hdc=0x580109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27e6678 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0044.951] DrawTextExW (in: hdc=0x580109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27e6678 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0044.952] RestoreDC (hdc=0x580109d7, nSavedDC=-1) returned 1 [0044.952] GdipReleaseDC (graphics=0x1b86d040, hdc=0x580109d7) returned 0x0 [0044.952] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0044.952] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x580109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0044.952] GdipReleaseDC (graphics=0x1b86d040, hdc=0x580109d7) returned 0x0 [0044.952] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0044.952] SelectObject (hdc=0x580109d7, h=0x185000f) returned 0xffffffff950509c0 [0044.952] DeleteDC (hdc=0x580109d7) returned 1 [0044.952] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0044.952] DeleteObject (ho=0xffffffff950509c0) returned 1 [0044.955] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0044.956] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.956] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0044.956] WaitMessage () returned 1 [0045.067] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.067] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.067] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.067] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.067] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.067] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0045.067] GetCurrentThreadId () returned 0xa28 [0045.067] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0045.067] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.067] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.067] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.067] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.067] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.067] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0045.067] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0045.067] CreateCompatibleDC (hdc=0x60109d6) returned 0x660109d2 [0045.067] GetObjectType (h=0x60109d6) returned 0x3 [0045.067] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff960509c0 [0045.067] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff960509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.068] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff960509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.068] DeleteObject (ho=0xffffffff960509c0) returned 1 [0045.068] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x590509d7 [0045.068] SelectObject (hdc=0x660109d2, h=0x590509d7) returned 0x185000f [0045.068] GdipCreateFromHDC (hdc=0x660109d2, graphics=0x26e408) returned 0x0 [0045.068] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0045.068] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0045.068] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0045.068] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0045.068] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0045.068] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4f20 [0045.068] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4f20) returned 0x0 [0045.068] LocalFree (hMem=0x1a7d4f20) returned 0x0 [0045.068] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0045.068] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0045.068] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0045.068] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0045.068] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0045.068] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.068] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.069] GetSystemMetrics (nIndex=42) returned 0 [0045.069] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.069] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.069] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0045.069] IsAppThemed () returned 0x1 [0045.069] GetThemeAppProperties () returned 0x3 [0045.069] GetThemeAppProperties () returned 0x3 [0045.069] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0045.069] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0045.069] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0045.069] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0045.069] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0045.069] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4f20 [0045.069] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4f20) returned 0x0 [0045.069] LocalFree (hMem=0x1a7d4f20) returned 0x0 [0045.069] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0045.069] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4f20 [0045.069] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4f20) returned 0x0 [0045.069] LocalFree (hMem=0x1a7d4f20) returned 0x0 [0045.069] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0045.069] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0045.069] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0045.069] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0045.069] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0045.069] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0045.069] GetCurrentObject (hdc=0x660109d2, type=0x1) returned 0x1b00017 [0045.069] GetCurrentObject (hdc=0x660109d2, type=0x2) returned 0x1900010 [0045.069] GetCurrentObject (hdc=0x660109d2, type=0x7) returned 0x590509d7 [0045.069] GetCurrentObject (hdc=0x660109d2, type=0x6) returned 0x18a002e [0045.070] SaveDC (hdc=0x660109d2) returned 1 [0045.070] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffab0409ff [0045.070] GetClipRgn (hdc=0x660109d2, hrgn=0xffffffffab0409ff) returned 0 [0045.070] SelectClipRgn (hdc=0x660109d2, hrgn=0xffffffff860409f1) returned 2 [0045.070] DeleteObject (ho=0xffffffffab0409ff) returned 1 [0045.070] DeleteObject (ho=0xffffffff860409f1) returned 1 [0045.070] OffsetViewportOrgEx (in: hdc=0x660109d2, x=0, y=0, lppt=0x27e8258 | out: lppt=0x27e8258) returned 1 [0045.070] OffsetViewportOrgEx (in: hdc=0x660109d2, x=-417, y=-278, lppt=0x27e8270 | out: lppt=0x27e8270) returned 1 [0045.070] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0045.070] GetCurrentObject (hdc=0x660109d2, type=0x1) returned 0x1b00017 [0045.070] GetCurrentObject (hdc=0x660109d2, type=0x2) returned 0x1900010 [0045.070] GetCurrentObject (hdc=0x660109d2, type=0x7) returned 0x590509d7 [0045.070] GetCurrentObject (hdc=0x660109d2, type=0x6) returned 0x18a002e [0045.070] SaveDC (hdc=0x660109d2) returned 2 [0045.070] GetNearestColor (hdc=0x660109d2, color=0x6c4607) returned 0x6c4607 [0045.070] CreateSolidBrush (color=0x6c4607) returned 0x7b100276 [0045.070] FillRect (hDC=0x660109d2, lprc=0x26de08, hbr=0x7b100276) returned 1 [0045.074] DeleteObject (ho=0x7b100276) returned 1 [0045.074] RestoreDC (hdc=0x660109d2, nSavedDC=-1) returned 1 [0045.074] RestoreDC (hdc=0x660109d2, nSavedDC=-1) returned 1 [0045.074] GdipReleaseDC (graphics=0x1b86d040, hdc=0x660109d2) returned 0x0 [0045.074] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd400dbd) returned 0x0 [0045.074] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0045.074] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.074] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.074] GetSystemMetrics (nIndex=42) returned 0 [0045.074] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.074] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.074] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0045.074] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0045.074] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0045.074] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0045.074] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0045.074] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0045.074] GetCurrentObject (hdc=0x660109d2, type=0x1) returned 0x1b00017 [0045.075] GetCurrentObject (hdc=0x660109d2, type=0x2) returned 0x1900010 [0045.075] GetCurrentObject (hdc=0x660109d2, type=0x7) returned 0x590509d7 [0045.075] GetCurrentObject (hdc=0x660109d2, type=0x6) returned 0x18a002e [0045.075] SaveDC (hdc=0x660109d2) returned 1 [0045.075] GetNearestColor (hdc=0x660109d2, color=0xf0f0f0) returned 0xf0f0f0 [0045.075] RestoreDC (hdc=0x660109d2, nSavedDC=-1) returned 1 [0045.075] GdipReleaseDC (graphics=0x1b86d040, hdc=0x660109d2) returned 0x0 [0045.075] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0045.075] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0045.075] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0045.075] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0045.075] GetCurrentObject (hdc=0x660109d2, type=0x1) returned 0x1b00017 [0045.075] GetCurrentObject (hdc=0x660109d2, type=0x2) returned 0x1900010 [0045.075] GetCurrentObject (hdc=0x660109d2, type=0x7) returned 0x590509d7 [0045.075] GetCurrentObject (hdc=0x660109d2, type=0x6) returned 0x18a002e [0045.075] SaveDC (hdc=0x660109d2) returned 1 [0045.075] GetTextAlign (hdc=0x660109d2) returned 0x0 [0045.075] GetTextColor (hdc=0x660109d2) returned 0x0 [0045.075] SetTextColor (hdc=0x660109d2, color=0xf0f0f0) returned 0x0 [0045.075] GetCurrentObject (hdc=0x660109d2, type=0x6) returned 0x18a002e [0045.075] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0045.076] SelectObject (hdc=0x660109d2, h=0x260a09ba) returned 0x18a002e [0045.076] GetBkMode (hdc=0x660109d2) returned 2 [0045.076] SetBkMode (hdc=0x660109d2, mode=1) returned 2 [0045.076] DrawTextExW (in: hdc=0x660109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27e8f20 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0045.076] DrawTextExW (in: hdc=0x660109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27e8f20 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0045.076] RestoreDC (hdc=0x660109d2, nSavedDC=-1) returned 1 [0045.076] GdipReleaseDC (graphics=0x1b86d040, hdc=0x660109d2) returned 0x0 [0045.076] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0045.076] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x660109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0045.077] GdipReleaseDC (graphics=0x1b86d040, hdc=0x660109d2) returned 0x0 [0045.077] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0045.077] SelectObject (hdc=0x660109d2, h=0x185000f) returned 0x590509d7 [0045.077] DeleteDC (hdc=0x660109d2) returned 1 [0045.077] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0045.077] DeleteObject (ho=0x590509d7) returned 1 [0045.081] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0045.081] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.081] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.081] WaitMessage () returned 1 [0045.191] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.191] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.191] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.191] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.191] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.191] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0045.191] GetCurrentThreadId () returned 0xa28 [0045.191] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0045.191] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.192] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.192] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.192] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.192] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.192] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0045.192] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0045.192] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff980109c0 [0045.192] GetObjectType (h=0x60109d6) returned 0x3 [0045.192] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x5a0509d7 [0045.192] GetDIBits (in: hdc=0x60109d6, hbm=0x5a0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.192] GetDIBits (in: hdc=0x60109d6, hbm=0x5a0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.192] DeleteObject (ho=0x5a0509d7) returned 1 [0045.192] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x670509d2 [0045.192] SelectObject (hdc=0xffffffff980109c0, h=0x670509d2) returned 0x185000f [0045.192] GdipCreateFromHDC (hdc=0xffffffff980109c0, graphics=0x26e408) returned 0x0 [0045.193] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0045.193] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0045.193] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0045.193] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0045.193] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0045.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4f20 [0045.193] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4f20) returned 0x0 [0045.193] LocalFree (hMem=0x1a7d4f20) returned 0x0 [0045.193] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0045.193] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0045.193] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0045.193] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0045.193] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0045.193] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.193] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.193] GetSystemMetrics (nIndex=42) returned 0 [0045.193] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.193] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.193] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0045.193] IsAppThemed () returned 0x1 [0045.193] GetThemeAppProperties () returned 0x3 [0045.193] GetThemeAppProperties () returned 0x3 [0045.193] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0045.193] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0045.193] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0045.193] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0045.193] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0045.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4f20 [0045.193] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4f20) returned 0x0 [0045.194] LocalFree (hMem=0x1a7d4f20) returned 0x0 [0045.194] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0045.194] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4f20 [0045.194] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4f20) returned 0x0 [0045.194] LocalFree (hMem=0x1a7d4f20) returned 0x0 [0045.194] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0045.194] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0045.194] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0045.194] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0045.194] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0045.194] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0045.194] GetCurrentObject (hdc=0xffffffff980109c0, type=0x1) returned 0x1b00017 [0045.194] GetCurrentObject (hdc=0xffffffff980109c0, type=0x2) returned 0x1900010 [0045.194] GetCurrentObject (hdc=0xffffffff980109c0, type=0x7) returned 0x670509d2 [0045.194] GetCurrentObject (hdc=0xffffffff980109c0, type=0x6) returned 0x18a002e [0045.194] SaveDC (hdc=0xffffffff980109c0) returned 1 [0045.194] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff870409f1 [0045.194] GetClipRgn (hdc=0xffffffff980109c0, hrgn=0xffffffff870409f1) returned 0 [0045.194] SelectClipRgn (hdc=0xffffffff980109c0, hrgn=0xffffffffae0409ff) returned 2 [0045.194] DeleteObject (ho=0xffffffff870409f1) returned 1 [0045.194] DeleteObject (ho=0xffffffffae0409ff) returned 1 [0045.194] OffsetViewportOrgEx (in: hdc=0xffffffff980109c0, x=0, y=0, lppt=0x27eab00 | out: lppt=0x27eab00) returned 1 [0045.194] OffsetViewportOrgEx (in: hdc=0xffffffff980109c0, x=-417, y=-278, lppt=0x27eab18 | out: lppt=0x27eab18) returned 1 [0045.194] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0045.194] GetCurrentObject (hdc=0xffffffff980109c0, type=0x1) returned 0x1b00017 [0045.194] GetCurrentObject (hdc=0xffffffff980109c0, type=0x2) returned 0x1900010 [0045.194] GetCurrentObject (hdc=0xffffffff980109c0, type=0x7) returned 0x670509d2 [0045.195] GetCurrentObject (hdc=0xffffffff980109c0, type=0x6) returned 0x18a002e [0045.195] SaveDC (hdc=0xffffffff980109c0) returned 2 [0045.195] GetNearestColor (hdc=0xffffffff980109c0, color=0x6c4607) returned 0x6c4607 [0045.195] CreateSolidBrush (color=0x6c4607) returned 0x7c100276 [0045.195] FillRect (hDC=0xffffffff980109c0, lprc=0x26de08, hbr=0x7c100276) returned 1 [0045.198] DeleteObject (ho=0x7c100276) returned 1 [0045.198] RestoreDC (hdc=0xffffffff980109c0, nSavedDC=-1) returned 1 [0045.198] RestoreDC (hdc=0xffffffff980109c0, nSavedDC=-1) returned 1 [0045.198] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff980109c0) returned 0x0 [0045.198] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd3e0dbd) returned 0x0 [0045.198] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0045.198] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.198] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.198] GetSystemMetrics (nIndex=42) returned 0 [0045.198] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.198] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.198] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x3e) returned 0x0 [0045.199] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0045.199] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0045.199] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0045.200] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0045.200] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0045.200] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0045.200] GetCurrentObject (hdc=0xffffffff980109c0, type=0x1) returned 0x1b00017 [0045.200] GetCurrentObject (hdc=0xffffffff980109c0, type=0x2) returned 0x1900010 [0045.200] GetCurrentObject (hdc=0xffffffff980109c0, type=0x7) returned 0x670509d2 [0045.200] GetCurrentObject (hdc=0xffffffff980109c0, type=0x6) returned 0x18a002e [0045.200] SaveDC (hdc=0xffffffff980109c0) returned 1 [0045.200] GetNearestColor (hdc=0xffffffff980109c0, color=0xf0f0f0) returned 0xf0f0f0 [0045.200] RestoreDC (hdc=0xffffffff980109c0, nSavedDC=-1) returned 1 [0045.200] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff980109c0) returned 0x0 [0045.200] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0045.200] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0045.200] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0045.200] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0045.200] GetCurrentObject (hdc=0xffffffff980109c0, type=0x1) returned 0x1b00017 [0045.200] GetCurrentObject (hdc=0xffffffff980109c0, type=0x2) returned 0x1900010 [0045.200] GetCurrentObject (hdc=0xffffffff980109c0, type=0x7) returned 0x670509d2 [0045.200] GetCurrentObject (hdc=0xffffffff980109c0, type=0x6) returned 0x18a002e [0045.200] SaveDC (hdc=0xffffffff980109c0) returned 1 [0045.200] GetTextAlign (hdc=0xffffffff980109c0) returned 0x0 [0045.200] GetTextColor (hdc=0xffffffff980109c0) returned 0x0 [0045.200] SetTextColor (hdc=0xffffffff980109c0, color=0xf0f0f0) returned 0x0 [0045.201] GetCurrentObject (hdc=0xffffffff980109c0, type=0x6) returned 0x18a002e [0045.201] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0045.201] SelectObject (hdc=0xffffffff980109c0, h=0x260a09ba) returned 0x18a002e [0045.201] GetBkMode (hdc=0xffffffff980109c0) returned 2 [0045.201] SetBkMode (hdc=0xffffffff980109c0, mode=1) returned 2 [0045.201] DrawTextExW (in: hdc=0xffffffff980109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27eba18 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0045.201] DrawTextExW (in: hdc=0xffffffff980109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27eba18 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0045.201] RestoreDC (hdc=0xffffffff980109c0, nSavedDC=-1) returned 1 [0045.201] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff980109c0) returned 0x0 [0045.201] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0045.201] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff980109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0045.201] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff980109c0) returned 0x0 [0045.202] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0045.202] SelectObject (hdc=0xffffffff980109c0, h=0x185000f) returned 0x670509d2 [0045.202] DeleteDC (hdc=0xffffffff980109c0) returned 1 [0045.202] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0045.202] DeleteObject (ho=0x670509d2) returned 1 [0045.205] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0045.205] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.205] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.205] WaitMessage () returned 1 [0045.318] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.318] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.318] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.318] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.318] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.319] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0045.319] GetCurrentThreadId () returned 0xa28 [0045.319] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0045.319] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.319] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.319] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.319] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.319] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.319] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0045.319] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0045.319] CreateCompatibleDC (hdc=0x60109d6) returned 0x5c0109d7 [0045.319] GetObjectType (h=0x60109d6) returned 0x3 [0045.319] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x680509d2 [0045.319] GetDIBits (in: hdc=0x60109d6, hbm=0x680509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.319] GetDIBits (in: hdc=0x60109d6, hbm=0x680509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.319] DeleteObject (ho=0x680509d2) returned 1 [0045.319] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff990509c0 [0045.320] SelectObject (hdc=0x5c0109d7, h=0xffffffff990509c0) returned 0x185000f [0045.320] GdipCreateFromHDC (hdc=0x5c0109d7, graphics=0x26e408) returned 0x0 [0045.320] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0045.320] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0045.320] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0045.320] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0045.320] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0045.320] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4fa0 [0045.320] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4fa0) returned 0x0 [0045.320] LocalFree (hMem=0x1a7d4fa0) returned 0x0 [0045.320] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0045.320] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0045.320] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0045.320] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0045.320] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0045.320] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.320] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.320] GetSystemMetrics (nIndex=42) returned 0 [0045.320] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.321] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.321] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0045.321] IsAppThemed () returned 0x1 [0045.321] GetThemeAppProperties () returned 0x3 [0045.321] GetThemeAppProperties () returned 0x3 [0045.321] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0045.321] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0045.321] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0045.321] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0045.321] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0045.321] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4fa0 [0045.321] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4fa0) returned 0x0 [0045.321] LocalFree (hMem=0x1a7d4fa0) returned 0x0 [0045.321] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0045.321] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4fa0 [0045.321] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4fa0) returned 0x0 [0045.321] LocalFree (hMem=0x1a7d4fa0) returned 0x0 [0045.321] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0045.321] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0045.321] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0045.321] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0045.321] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0045.321] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0045.321] GetCurrentObject (hdc=0x5c0109d7, type=0x1) returned 0x1b00017 [0045.321] GetCurrentObject (hdc=0x5c0109d7, type=0x2) returned 0x1900010 [0045.321] GetCurrentObject (hdc=0x5c0109d7, type=0x7) returned 0xffffffff990509c0 [0045.321] GetCurrentObject (hdc=0x5c0109d7, type=0x6) returned 0x18a002e [0045.321] SaveDC (hdc=0x5c0109d7) returned 1 [0045.322] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffaf0409ff [0045.322] GetClipRgn (hdc=0x5c0109d7, hrgn=0xffffffffaf0409ff) returned 0 [0045.322] SelectClipRgn (hdc=0x5c0109d7, hrgn=0xffffffff8a0409f1) returned 2 [0045.322] DeleteObject (ho=0xffffffffaf0409ff) returned 1 [0045.322] DeleteObject (ho=0xffffffff8a0409f1) returned 1 [0045.322] OffsetViewportOrgEx (in: hdc=0x5c0109d7, x=0, y=0, lppt=0x27ed5f8 | out: lppt=0x27ed5f8) returned 1 [0045.322] OffsetViewportOrgEx (in: hdc=0x5c0109d7, x=-417, y=-278, lppt=0x27ed610 | out: lppt=0x27ed610) returned 1 [0045.322] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0045.322] GetCurrentObject (hdc=0x5c0109d7, type=0x1) returned 0x1b00017 [0045.322] GetCurrentObject (hdc=0x5c0109d7, type=0x2) returned 0x1900010 [0045.322] GetCurrentObject (hdc=0x5c0109d7, type=0x7) returned 0xffffffff990509c0 [0045.322] GetCurrentObject (hdc=0x5c0109d7, type=0x6) returned 0x18a002e [0045.322] SaveDC (hdc=0x5c0109d7) returned 2 [0045.322] GetNearestColor (hdc=0x5c0109d7, color=0x6c4607) returned 0x6c4607 [0045.322] CreateSolidBrush (color=0x6c4607) returned 0x7d100276 [0045.322] FillRect (hDC=0x5c0109d7, lprc=0x26de08, hbr=0x7d100276) returned 1 [0045.326] DeleteObject (ho=0x7d100276) returned 1 [0045.326] RestoreDC (hdc=0x5c0109d7, nSavedDC=-1) returned 1 [0045.326] RestoreDC (hdc=0x5c0109d7, nSavedDC=-1) returned 1 [0045.326] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5c0109d7) returned 0x0 [0045.326] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd3c0dbd) returned 0x0 [0045.326] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0045.326] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.326] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.326] GetSystemMetrics (nIndex=42) returned 0 [0045.326] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.326] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.326] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0045.326] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0045.326] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0045.326] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0045.326] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0045.326] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0045.326] GetCurrentObject (hdc=0x5c0109d7, type=0x1) returned 0x1b00017 [0045.326] GetCurrentObject (hdc=0x5c0109d7, type=0x2) returned 0x1900010 [0045.326] GetCurrentObject (hdc=0x5c0109d7, type=0x7) returned 0xffffffff990509c0 [0045.327] GetCurrentObject (hdc=0x5c0109d7, type=0x6) returned 0x18a002e [0045.327] SaveDC (hdc=0x5c0109d7) returned 1 [0045.327] GetNearestColor (hdc=0x5c0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0045.327] RestoreDC (hdc=0x5c0109d7, nSavedDC=-1) returned 1 [0045.327] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5c0109d7) returned 0x0 [0045.327] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0045.327] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0045.327] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0045.327] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0045.327] GetCurrentObject (hdc=0x5c0109d7, type=0x1) returned 0x1b00017 [0045.327] GetCurrentObject (hdc=0x5c0109d7, type=0x2) returned 0x1900010 [0045.327] GetCurrentObject (hdc=0x5c0109d7, type=0x7) returned 0xffffffff990509c0 [0045.327] GetCurrentObject (hdc=0x5c0109d7, type=0x6) returned 0x18a002e [0045.327] SaveDC (hdc=0x5c0109d7) returned 1 [0045.327] GetTextAlign (hdc=0x5c0109d7) returned 0x0 [0045.327] GetTextColor (hdc=0x5c0109d7) returned 0x0 [0045.327] SetTextColor (hdc=0x5c0109d7, color=0xf0f0f0) returned 0x0 [0045.327] GetCurrentObject (hdc=0x5c0109d7, type=0x6) returned 0x18a002e [0045.328] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0045.328] SelectObject (hdc=0x5c0109d7, h=0x260a09ba) returned 0x18a002e [0045.328] GetBkMode (hdc=0x5c0109d7) returned 2 [0045.328] SetBkMode (hdc=0x5c0109d7, mode=1) returned 2 [0045.328] DrawTextExW (in: hdc=0x5c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27ee2c0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0045.328] DrawTextExW (in: hdc=0x5c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27ee2c0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0045.328] RestoreDC (hdc=0x5c0109d7, nSavedDC=-1) returned 1 [0045.328] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5c0109d7) returned 0x0 [0045.328] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0045.329] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x5c0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0045.329] GdipReleaseDC (graphics=0x1b86d040, hdc=0x5c0109d7) returned 0x0 [0045.329] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0045.329] SelectObject (hdc=0x5c0109d7, h=0x185000f) returned 0xffffffff990509c0 [0045.329] DeleteDC (hdc=0x5c0109d7) returned 1 [0045.329] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0045.329] DeleteObject (ho=0xffffffff990509c0) returned 1 [0045.332] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0045.332] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.332] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.333] WaitMessage () returned 1 [0045.457] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.457] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.457] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.457] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.457] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.457] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0045.457] GetCurrentThreadId () returned 0xa28 [0045.457] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0045.457] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.457] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.457] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.457] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.457] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.458] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0045.458] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0045.458] CreateCompatibleDC (hdc=0x60109d6) returned 0x6a0109d2 [0045.458] GetObjectType (h=0x60109d6) returned 0x3 [0045.458] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff9a0509c0 [0045.458] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9a0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.458] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9a0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.458] DeleteObject (ho=0xffffffff9a0509c0) returned 1 [0045.458] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x5d0509d7 [0045.458] SelectObject (hdc=0x6a0109d2, h=0x5d0509d7) returned 0x185000f [0045.458] GdipCreateFromHDC (hdc=0x6a0109d2, graphics=0x26e408) returned 0x0 [0045.459] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0045.459] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0045.459] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0045.459] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0045.459] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0045.459] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4fa0 [0045.459] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d4fa0) returned 0x0 [0045.459] LocalFree (hMem=0x1a7d4fa0) returned 0x0 [0045.459] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0045.459] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0045.459] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0045.459] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0045.459] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0045.459] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.459] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.459] GetSystemMetrics (nIndex=42) returned 0 [0045.459] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.459] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.459] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0045.459] IsAppThemed () returned 0x1 [0045.459] GetThemeAppProperties () returned 0x3 [0045.459] GetThemeAppProperties () returned 0x3 [0045.459] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0045.459] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0045.459] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0045.459] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0045.460] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0045.460] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4fa0 [0045.460] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4fa0) returned 0x0 [0045.460] LocalFree (hMem=0x1a7d4fa0) returned 0x0 [0045.460] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0045.460] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d4fa0 [0045.460] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d4fa0) returned 0x0 [0045.460] LocalFree (hMem=0x1a7d4fa0) returned 0x0 [0045.460] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0045.460] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0045.460] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0045.460] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0045.460] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0045.460] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0045.460] GetCurrentObject (hdc=0x6a0109d2, type=0x1) returned 0x1b00017 [0045.460] GetCurrentObject (hdc=0x6a0109d2, type=0x2) returned 0x1900010 [0045.460] GetCurrentObject (hdc=0x6a0109d2, type=0x7) returned 0x5d0509d7 [0045.460] GetCurrentObject (hdc=0x6a0109d2, type=0x6) returned 0x18a002e [0045.460] SaveDC (hdc=0x6a0109d2) returned 1 [0045.460] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff8b0409f1 [0045.460] GetClipRgn (hdc=0x6a0109d2, hrgn=0xffffffff8b0409f1) returned 0 [0045.460] SelectClipRgn (hdc=0x6a0109d2, hrgn=0xffffffffb20409ff) returned 2 [0045.460] DeleteObject (ho=0xffffffff8b0409f1) returned 1 [0045.460] DeleteObject (ho=0xffffffffb20409ff) returned 1 [0045.460] OffsetViewportOrgEx (in: hdc=0x6a0109d2, x=0, y=0, lppt=0x27efea0 | out: lppt=0x27efea0) returned 1 [0045.460] OffsetViewportOrgEx (in: hdc=0x6a0109d2, x=-417, y=-278, lppt=0x27efeb8 | out: lppt=0x27efeb8) returned 1 [0045.460] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0045.460] GetCurrentObject (hdc=0x6a0109d2, type=0x1) returned 0x1b00017 [0045.461] GetCurrentObject (hdc=0x6a0109d2, type=0x2) returned 0x1900010 [0045.461] GetCurrentObject (hdc=0x6a0109d2, type=0x7) returned 0x5d0509d7 [0045.461] GetCurrentObject (hdc=0x6a0109d2, type=0x6) returned 0x18a002e [0045.461] SaveDC (hdc=0x6a0109d2) returned 2 [0045.461] GetNearestColor (hdc=0x6a0109d2, color=0x6c4607) returned 0x6c4607 [0045.461] CreateSolidBrush (color=0x6c4607) returned 0x7e100276 [0045.461] FillRect (hDC=0x6a0109d2, lprc=0x26de08, hbr=0x7e100276) returned 1 [0045.466] DeleteObject (ho=0x7e100276) returned 1 [0045.466] RestoreDC (hdc=0x6a0109d2, nSavedDC=-1) returned 1 [0045.466] RestoreDC (hdc=0x6a0109d2, nSavedDC=-1) returned 1 [0045.467] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6a0109d2) returned 0x0 [0045.467] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd3a0dbd) returned 0x0 [0045.467] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0045.467] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.467] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.467] GetSystemMetrics (nIndex=42) returned 0 [0045.467] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.467] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.467] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x40) returned 0x0 [0045.468] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0045.468] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0045.468] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0045.468] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0045.468] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0045.468] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0045.468] GetCurrentObject (hdc=0x6a0109d2, type=0x1) returned 0x1b00017 [0045.468] GetCurrentObject (hdc=0x6a0109d2, type=0x2) returned 0x1900010 [0045.468] GetCurrentObject (hdc=0x6a0109d2, type=0x7) returned 0x5d0509d7 [0045.468] GetCurrentObject (hdc=0x6a0109d2, type=0x6) returned 0x18a002e [0045.468] SaveDC (hdc=0x6a0109d2) returned 1 [0045.468] GetNearestColor (hdc=0x6a0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0045.468] RestoreDC (hdc=0x6a0109d2, nSavedDC=-1) returned 1 [0045.468] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6a0109d2) returned 0x0 [0045.469] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0045.469] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0045.469] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0045.469] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0045.469] GetCurrentObject (hdc=0x6a0109d2, type=0x1) returned 0x1b00017 [0045.469] GetCurrentObject (hdc=0x6a0109d2, type=0x2) returned 0x1900010 [0045.469] GetCurrentObject (hdc=0x6a0109d2, type=0x7) returned 0x5d0509d7 [0045.469] GetCurrentObject (hdc=0x6a0109d2, type=0x6) returned 0x18a002e [0045.469] SaveDC (hdc=0x6a0109d2) returned 1 [0045.469] GetTextAlign (hdc=0x6a0109d2) returned 0x0 [0045.469] GetTextColor (hdc=0x6a0109d2) returned 0x0 [0045.469] SetTextColor (hdc=0x6a0109d2, color=0xf0f0f0) returned 0x0 [0045.469] GetCurrentObject (hdc=0x6a0109d2, type=0x6) returned 0x18a002e [0045.469] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0045.469] SelectObject (hdc=0x6a0109d2, h=0x260a09ba) returned 0x18a002e [0045.469] GetBkMode (hdc=0x6a0109d2) returned 2 [0045.469] SetBkMode (hdc=0x6a0109d2, mode=1) returned 2 [0045.469] DrawTextExW (in: hdc=0x6a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27f0d98 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0045.469] DrawTextExW (in: hdc=0x6a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27f0d98 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0045.470] RestoreDC (hdc=0x6a0109d2, nSavedDC=-1) returned 1 [0045.470] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6a0109d2) returned 0x0 [0045.470] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0045.470] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x6a0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0045.470] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6a0109d2) returned 0x0 [0045.470] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0045.470] SelectObject (hdc=0x6a0109d2, h=0x185000f) returned 0x5d0509d7 [0045.471] DeleteDC (hdc=0x6a0109d2) returned 1 [0045.471] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0045.471] DeleteObject (ho=0x5d0509d7) returned 1 [0045.474] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0045.474] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.474] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.474] WaitMessage () returned 1 [0045.597] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.597] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.597] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.597] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.597] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.597] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0045.597] GetCurrentThreadId () returned 0xa28 [0045.597] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0045.597] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.597] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.597] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.597] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.597] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.597] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0045.598] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0045.598] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff9c0109c0 [0045.598] GetObjectType (h=0x60109d6) returned 0x3 [0045.598] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x5e0509d7 [0045.598] GetDIBits (in: hdc=0x60109d6, hbm=0x5e0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.598] GetDIBits (in: hdc=0x60109d6, hbm=0x5e0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.598] DeleteObject (ho=0x5e0509d7) returned 1 [0045.598] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x6b0509d2 [0045.599] SelectObject (hdc=0xffffffff9c0109c0, h=0x6b0509d2) returned 0x185000f [0045.599] GdipCreateFromHDC (hdc=0xffffffff9c0109c0, graphics=0x26e408) returned 0x0 [0045.599] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0045.599] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0045.599] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0045.599] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0045.599] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0045.599] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5020 [0045.599] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d5020) returned 0x0 [0045.599] LocalFree (hMem=0x1a7d5020) returned 0x0 [0045.599] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0045.599] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0045.599] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0045.599] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0045.599] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0045.599] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.599] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.599] GetSystemMetrics (nIndex=42) returned 0 [0045.599] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.600] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.600] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0045.600] IsAppThemed () returned 0x1 [0045.600] GetThemeAppProperties () returned 0x3 [0045.600] GetThemeAppProperties () returned 0x3 [0045.600] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0045.600] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0045.600] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0045.600] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0045.600] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0045.600] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5020 [0045.600] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5020) returned 0x0 [0045.600] LocalFree (hMem=0x1a7d5020) returned 0x0 [0045.600] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0045.600] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5020 [0045.600] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5020) returned 0x0 [0045.600] LocalFree (hMem=0x1a7d5020) returned 0x0 [0045.600] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0045.600] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0045.600] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0045.600] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0045.600] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0045.600] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0045.600] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x1) returned 0x1b00017 [0045.600] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x2) returned 0x1900010 [0045.600] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x7) returned 0x6b0509d2 [0045.600] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x6) returned 0x18a002e [0045.600] SaveDC (hdc=0xffffffff9c0109c0) returned 1 [0045.601] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb30409ff [0045.601] GetClipRgn (hdc=0xffffffff9c0109c0, hrgn=0xffffffffb30409ff) returned 0 [0045.601] SelectClipRgn (hdc=0xffffffff9c0109c0, hrgn=0xffffffff8e0409f1) returned 2 [0045.601] DeleteObject (ho=0xffffffffb30409ff) returned 1 [0045.601] DeleteObject (ho=0xffffffff8e0409f1) returned 1 [0045.601] OffsetViewportOrgEx (in: hdc=0xffffffff9c0109c0, x=0, y=0, lppt=0x27f2978 | out: lppt=0x27f2978) returned 1 [0045.601] OffsetViewportOrgEx (in: hdc=0xffffffff9c0109c0, x=-417, y=-278, lppt=0x27f2990 | out: lppt=0x27f2990) returned 1 [0045.601] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0045.601] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x1) returned 0x1b00017 [0045.601] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x2) returned 0x1900010 [0045.601] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x7) returned 0x6b0509d2 [0045.601] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x6) returned 0x18a002e [0045.601] SaveDC (hdc=0xffffffff9c0109c0) returned 2 [0045.601] GetNearestColor (hdc=0xffffffff9c0109c0, color=0x6c4607) returned 0x6c4607 [0045.601] CreateSolidBrush (color=0x6c4607) returned 0x7f100276 [0045.601] FillRect (hDC=0xffffffff9c0109c0, lprc=0x26de08, hbr=0x7f100276) returned 1 [0045.606] DeleteObject (ho=0x7f100276) returned 1 [0045.606] RestoreDC (hdc=0xffffffff9c0109c0, nSavedDC=-1) returned 1 [0045.606] RestoreDC (hdc=0xffffffff9c0109c0, nSavedDC=-1) returned 1 [0045.606] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9c0109c0) returned 0x0 [0045.606] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd380dbd) returned 0x0 [0045.606] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0045.606] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.606] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.606] GetSystemMetrics (nIndex=42) returned 0 [0045.606] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.606] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.606] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0045.606] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0045.606] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0045.606] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0045.606] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0045.606] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0045.606] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x1) returned 0x1b00017 [0045.606] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x2) returned 0x1900010 [0045.606] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x7) returned 0x6b0509d2 [0045.606] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x6) returned 0x18a002e [0045.606] SaveDC (hdc=0xffffffff9c0109c0) returned 1 [0045.606] GetNearestColor (hdc=0xffffffff9c0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0045.606] RestoreDC (hdc=0xffffffff9c0109c0, nSavedDC=-1) returned 1 [0045.607] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9c0109c0) returned 0x0 [0045.607] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0045.607] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0045.607] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0045.607] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0045.607] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x1) returned 0x1b00017 [0045.607] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x2) returned 0x1900010 [0045.607] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x7) returned 0x6b0509d2 [0045.607] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x6) returned 0x18a002e [0045.607] SaveDC (hdc=0xffffffff9c0109c0) returned 1 [0045.607] GetTextAlign (hdc=0xffffffff9c0109c0) returned 0x0 [0045.607] GetTextColor (hdc=0xffffffff9c0109c0) returned 0x0 [0045.607] SetTextColor (hdc=0xffffffff9c0109c0, color=0xf0f0f0) returned 0x0 [0045.607] GetCurrentObject (hdc=0xffffffff9c0109c0, type=0x6) returned 0x18a002e [0045.607] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0045.607] SelectObject (hdc=0xffffffff9c0109c0, h=0x260a09ba) returned 0x18a002e [0045.607] GetBkMode (hdc=0xffffffff9c0109c0) returned 2 [0045.607] SetBkMode (hdc=0xffffffff9c0109c0, mode=1) returned 2 [0045.607] DrawTextExW (in: hdc=0xffffffff9c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27f3640 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0045.608] DrawTextExW (in: hdc=0xffffffff9c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27f3640 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0045.608] RestoreDC (hdc=0xffffffff9c0109c0, nSavedDC=-1) returned 1 [0045.608] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9c0109c0) returned 0x0 [0045.608] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0045.608] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff9c0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0045.608] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9c0109c0) returned 0x0 [0045.608] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0045.608] SelectObject (hdc=0xffffffff9c0109c0, h=0x185000f) returned 0x6b0509d2 [0045.608] DeleteDC (hdc=0xffffffff9c0109c0) returned 1 [0045.608] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0045.609] DeleteObject (ho=0x6b0509d2) returned 1 [0045.611] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0045.612] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.612] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.612] WaitMessage () returned 1 [0045.722] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.722] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.722] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.722] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.722] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.722] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0045.722] GetCurrentThreadId () returned 0xa28 [0045.722] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0045.722] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.722] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.722] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.722] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.722] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.722] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0045.722] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0045.722] CreateCompatibleDC (hdc=0x60109d6) returned 0x600109d7 [0045.723] GetObjectType (h=0x60109d6) returned 0x3 [0045.723] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x6c0509d2 [0045.723] GetDIBits (in: hdc=0x60109d6, hbm=0x6c0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.723] GetDIBits (in: hdc=0x60109d6, hbm=0x6c0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.723] DeleteObject (ho=0x6c0509d2) returned 1 [0045.723] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff9d0509c0 [0045.723] SelectObject (hdc=0x600109d7, h=0xffffffff9d0509c0) returned 0x185000f [0045.723] GdipCreateFromHDC (hdc=0x600109d7, graphics=0x26e408) returned 0x0 [0045.723] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0045.723] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0045.724] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0045.724] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0045.724] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0045.724] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5020 [0045.724] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d5020) returned 0x0 [0045.724] LocalFree (hMem=0x1a7d5020) returned 0x0 [0045.724] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0045.724] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0045.724] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0045.724] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0045.724] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0045.724] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.724] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.724] GetSystemMetrics (nIndex=42) returned 0 [0045.724] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.724] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.724] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0045.724] IsAppThemed () returned 0x1 [0045.724] GetThemeAppProperties () returned 0x3 [0045.724] GetThemeAppProperties () returned 0x3 [0045.724] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0045.724] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0045.724] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0045.724] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0045.724] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0045.724] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5020 [0045.724] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5020) returned 0x0 [0045.724] LocalFree (hMem=0x1a7d5020) returned 0x0 [0045.725] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0045.725] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5020 [0045.725] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5020) returned 0x0 [0045.725] LocalFree (hMem=0x1a7d5020) returned 0x0 [0045.725] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0045.725] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0045.725] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0045.725] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0045.725] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0045.725] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0045.725] GetCurrentObject (hdc=0x600109d7, type=0x1) returned 0x1b00017 [0045.725] GetCurrentObject (hdc=0x600109d7, type=0x2) returned 0x1900010 [0045.725] GetCurrentObject (hdc=0x600109d7, type=0x7) returned 0xffffffff9d0509c0 [0045.725] GetCurrentObject (hdc=0x600109d7, type=0x6) returned 0x18a002e [0045.725] SaveDC (hdc=0x600109d7) returned 1 [0045.725] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff8f0409f1 [0045.725] GetClipRgn (hdc=0x600109d7, hrgn=0xffffffff8f0409f1) returned 0 [0045.725] SelectClipRgn (hdc=0x600109d7, hrgn=0xffffffffb60409ff) returned 2 [0045.725] DeleteObject (ho=0xffffffff8f0409f1) returned 1 [0045.725] DeleteObject (ho=0xffffffffb60409ff) returned 1 [0045.725] OffsetViewportOrgEx (in: hdc=0x600109d7, x=0, y=0, lppt=0x27f5220 | out: lppt=0x27f5220) returned 1 [0045.725] OffsetViewportOrgEx (in: hdc=0x600109d7, x=-417, y=-278, lppt=0x27f5238 | out: lppt=0x27f5238) returned 1 [0045.725] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0045.725] GetCurrentObject (hdc=0x600109d7, type=0x1) returned 0x1b00017 [0045.725] GetCurrentObject (hdc=0x600109d7, type=0x2) returned 0x1900010 [0045.725] GetCurrentObject (hdc=0x600109d7, type=0x7) returned 0xffffffff9d0509c0 [0045.725] GetCurrentObject (hdc=0x600109d7, type=0x6) returned 0x18a002e [0045.725] SaveDC (hdc=0x600109d7) returned 2 [0045.726] GetNearestColor (hdc=0x600109d7, color=0x6c4607) returned 0x6c4607 [0045.726] CreateSolidBrush (color=0x6c4607) returned 0xffffffff80100276 [0045.726] FillRect (hDC=0x600109d7, lprc=0x26de08, hbr=0xffffffff80100276) returned 1 [0045.730] DeleteObject (ho=0xffffffff80100276) returned 1 [0045.730] RestoreDC (hdc=0x600109d7, nSavedDC=-1) returned 1 [0045.730] RestoreDC (hdc=0x600109d7, nSavedDC=-1) returned 1 [0045.730] GdipReleaseDC (graphics=0x1b86d040, hdc=0x600109d7) returned 0x0 [0045.730] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd360dbd) returned 0x0 [0045.730] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0045.730] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.730] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.730] GetSystemMetrics (nIndex=42) returned 0 [0045.730] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.730] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.730] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x42) returned 0x0 [0045.731] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0045.731] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0045.731] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0045.731] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0045.731] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0045.731] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0045.731] GetCurrentObject (hdc=0x600109d7, type=0x1) returned 0x1b00017 [0045.732] GetCurrentObject (hdc=0x600109d7, type=0x2) returned 0x1900010 [0045.732] GetCurrentObject (hdc=0x600109d7, type=0x7) returned 0xffffffff9d0509c0 [0045.732] GetCurrentObject (hdc=0x600109d7, type=0x6) returned 0x18a002e [0045.732] SaveDC (hdc=0x600109d7) returned 1 [0045.732] GetNearestColor (hdc=0x600109d7, color=0xf0f0f0) returned 0xf0f0f0 [0045.732] RestoreDC (hdc=0x600109d7, nSavedDC=-1) returned 1 [0045.732] GdipReleaseDC (graphics=0x1b86d040, hdc=0x600109d7) returned 0x0 [0045.732] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0045.732] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0045.732] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0045.732] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0045.732] GetCurrentObject (hdc=0x600109d7, type=0x1) returned 0x1b00017 [0045.732] GetCurrentObject (hdc=0x600109d7, type=0x2) returned 0x1900010 [0045.732] GetCurrentObject (hdc=0x600109d7, type=0x7) returned 0xffffffff9d0509c0 [0045.732] GetCurrentObject (hdc=0x600109d7, type=0x6) returned 0x18a002e [0045.732] SaveDC (hdc=0x600109d7) returned 1 [0045.732] GetTextAlign (hdc=0x600109d7) returned 0x0 [0045.732] GetTextColor (hdc=0x600109d7) returned 0x0 [0045.732] SetTextColor (hdc=0x600109d7, color=0xf0f0f0) returned 0x0 [0045.732] GetCurrentObject (hdc=0x600109d7, type=0x6) returned 0x18a002e [0045.733] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0045.733] SelectObject (hdc=0x600109d7, h=0x260a09ba) returned 0x18a002e [0045.733] GetBkMode (hdc=0x600109d7) returned 2 [0045.733] SetBkMode (hdc=0x600109d7, mode=1) returned 2 [0045.733] DrawTextExW (in: hdc=0x600109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27f60f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0045.733] DrawTextExW (in: hdc=0x600109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27f60f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0045.733] RestoreDC (hdc=0x600109d7, nSavedDC=-1) returned 1 [0045.733] GdipReleaseDC (graphics=0x1b86d040, hdc=0x600109d7) returned 0x0 [0045.733] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0045.733] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x600109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0045.734] GdipReleaseDC (graphics=0x1b86d040, hdc=0x600109d7) returned 0x0 [0045.734] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0045.734] SelectObject (hdc=0x600109d7, h=0x185000f) returned 0xffffffff9d0509c0 [0045.734] DeleteDC (hdc=0x600109d7) returned 1 [0045.734] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0045.734] DeleteObject (ho=0xffffffff9d0509c0) returned 1 [0045.737] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0045.737] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.737] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.737] WaitMessage () returned 1 [0045.863] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.863] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.863] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.863] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.863] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.863] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0045.863] GetCurrentThreadId () returned 0xa28 [0045.863] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0045.863] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.863] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.863] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.863] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.863] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.863] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0045.863] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0045.863] CreateCompatibleDC (hdc=0x60109d6) returned 0x6e0109d2 [0045.863] GetObjectType (h=0x60109d6) returned 0x3 [0045.863] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff9e0509c0 [0045.864] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9e0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.864] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9e0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.864] DeleteObject (ho=0xffffffff9e0509c0) returned 1 [0045.864] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x610509d7 [0045.864] SelectObject (hdc=0x6e0109d2, h=0x610509d7) returned 0x185000f [0045.864] GdipCreateFromHDC (hdc=0x6e0109d2, graphics=0x26e408) returned 0x0 [0045.864] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0045.864] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0045.864] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0045.864] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0045.864] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0045.864] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d50a0 [0045.864] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d50a0) returned 0x0 [0045.864] LocalFree (hMem=0x1a7d50a0) returned 0x0 [0045.864] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0045.864] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0045.864] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0045.864] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0045.865] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0045.865] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.865] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.865] GetSystemMetrics (nIndex=42) returned 0 [0045.865] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.865] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.865] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0045.865] IsAppThemed () returned 0x1 [0045.865] GetThemeAppProperties () returned 0x3 [0045.865] GetThemeAppProperties () returned 0x3 [0045.865] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0045.865] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0045.865] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0045.865] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0045.865] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0045.865] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d50a0 [0045.865] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d50a0) returned 0x0 [0045.865] LocalFree (hMem=0x1a7d50a0) returned 0x0 [0045.865] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0045.865] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d50a0 [0045.865] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d50a0) returned 0x0 [0045.865] LocalFree (hMem=0x1a7d50a0) returned 0x0 [0045.865] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0045.865] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0045.865] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0045.865] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0045.865] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0045.865] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0045.865] GetCurrentObject (hdc=0x6e0109d2, type=0x1) returned 0x1b00017 [0045.866] GetCurrentObject (hdc=0x6e0109d2, type=0x2) returned 0x1900010 [0045.866] GetCurrentObject (hdc=0x6e0109d2, type=0x7) returned 0x610509d7 [0045.866] GetCurrentObject (hdc=0x6e0109d2, type=0x6) returned 0x18a002e [0045.866] SaveDC (hdc=0x6e0109d2) returned 1 [0045.866] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb70409ff [0045.866] GetClipRgn (hdc=0x6e0109d2, hrgn=0xffffffffb70409ff) returned 0 [0045.866] SelectClipRgn (hdc=0x6e0109d2, hrgn=0xffffffff920409f1) returned 2 [0045.866] DeleteObject (ho=0xffffffffb70409ff) returned 1 [0045.866] DeleteObject (ho=0xffffffff920409f1) returned 1 [0045.866] OffsetViewportOrgEx (in: hdc=0x6e0109d2, x=0, y=0, lppt=0x27f7cd8 | out: lppt=0x27f7cd8) returned 1 [0045.866] OffsetViewportOrgEx (in: hdc=0x6e0109d2, x=-417, y=-278, lppt=0x27f7cf0 | out: lppt=0x27f7cf0) returned 1 [0045.866] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0045.866] GetCurrentObject (hdc=0x6e0109d2, type=0x1) returned 0x1b00017 [0045.866] GetCurrentObject (hdc=0x6e0109d2, type=0x2) returned 0x1900010 [0045.866] GetCurrentObject (hdc=0x6e0109d2, type=0x7) returned 0x610509d7 [0045.866] GetCurrentObject (hdc=0x6e0109d2, type=0x6) returned 0x18a002e [0045.866] SaveDC (hdc=0x6e0109d2) returned 2 [0045.866] GetNearestColor (hdc=0x6e0109d2, color=0x6c4607) returned 0x6c4607 [0045.866] CreateSolidBrush (color=0x6c4607) returned 0xffffffff81100276 [0045.866] FillRect (hDC=0x6e0109d2, lprc=0x26de08, hbr=0xffffffff81100276) returned 1 [0045.870] DeleteObject (ho=0xffffffff81100276) returned 1 [0045.870] RestoreDC (hdc=0x6e0109d2, nSavedDC=-1) returned 1 [0045.870] RestoreDC (hdc=0x6e0109d2, nSavedDC=-1) returned 1 [0045.870] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6e0109d2) returned 0x0 [0045.870] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd340dbd) returned 0x0 [0045.870] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0045.870] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.870] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.870] GetSystemMetrics (nIndex=42) returned 0 [0045.870] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.870] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.870] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0045.870] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0045.870] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0045.870] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0045.870] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0045.870] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0045.870] GetCurrentObject (hdc=0x6e0109d2, type=0x1) returned 0x1b00017 [0045.870] GetCurrentObject (hdc=0x6e0109d2, type=0x2) returned 0x1900010 [0045.870] GetCurrentObject (hdc=0x6e0109d2, type=0x7) returned 0x610509d7 [0045.871] GetCurrentObject (hdc=0x6e0109d2, type=0x6) returned 0x18a002e [0045.871] SaveDC (hdc=0x6e0109d2) returned 1 [0045.871] GetNearestColor (hdc=0x6e0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0045.871] RestoreDC (hdc=0x6e0109d2, nSavedDC=-1) returned 1 [0045.871] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6e0109d2) returned 0x0 [0045.871] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0045.871] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0045.871] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0045.871] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0045.871] GetCurrentObject (hdc=0x6e0109d2, type=0x1) returned 0x1b00017 [0045.871] GetCurrentObject (hdc=0x6e0109d2, type=0x2) returned 0x1900010 [0045.871] GetCurrentObject (hdc=0x6e0109d2, type=0x7) returned 0x610509d7 [0045.871] GetCurrentObject (hdc=0x6e0109d2, type=0x6) returned 0x18a002e [0045.871] SaveDC (hdc=0x6e0109d2) returned 1 [0045.871] GetTextAlign (hdc=0x6e0109d2) returned 0x0 [0045.871] GetTextColor (hdc=0x6e0109d2) returned 0x0 [0045.871] SetTextColor (hdc=0x6e0109d2, color=0xf0f0f0) returned 0x0 [0045.871] GetCurrentObject (hdc=0x6e0109d2, type=0x6) returned 0x18a002e [0045.871] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0045.872] SelectObject (hdc=0x6e0109d2, h=0x260a09ba) returned 0x18a002e [0045.872] GetBkMode (hdc=0x6e0109d2) returned 2 [0045.872] SetBkMode (hdc=0x6e0109d2, mode=1) returned 2 [0045.872] DrawTextExW (in: hdc=0x6e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27f89a0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0045.872] DrawTextExW (in: hdc=0x6e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27f89a0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0045.872] RestoreDC (hdc=0x6e0109d2, nSavedDC=-1) returned 1 [0045.872] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6e0109d2) returned 0x0 [0045.872] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0045.872] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x6e0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0045.873] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6e0109d2) returned 0x0 [0045.873] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0045.873] SelectObject (hdc=0x6e0109d2, h=0x185000f) returned 0x610509d7 [0045.873] DeleteDC (hdc=0x6e0109d2) returned 1 [0045.873] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0045.873] DeleteObject (ho=0x610509d7) returned 1 [0045.876] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0045.876] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.876] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0045.876] WaitMessage () returned 1 [0045.987] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.987] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.987] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.987] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.988] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.988] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0045.988] GetCurrentThreadId () returned 0xa28 [0045.988] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0045.988] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.988] IsWindowUnicode (hWnd=0x3015e) returned 1 [0045.988] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0045.988] TranslateMessage (lpMsg=0x26ee10) returned 0 [0045.988] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0045.988] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0045.988] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0045.988] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffa00109c0 [0045.988] GetObjectType (h=0x60109d6) returned 0x3 [0045.988] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x620509d7 [0045.988] GetDIBits (in: hdc=0x60109d6, hbm=0x620509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.988] GetDIBits (in: hdc=0x60109d6, hbm=0x620509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0045.988] DeleteObject (ho=0x620509d7) returned 1 [0045.988] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x6f0509d2 [0045.989] SelectObject (hdc=0xffffffffa00109c0, h=0x6f0509d2) returned 0x185000f [0045.989] GdipCreateFromHDC (hdc=0xffffffffa00109c0, graphics=0x26e408) returned 0x0 [0045.989] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0045.989] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0045.989] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0045.989] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0045.989] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0045.989] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d50a0 [0045.989] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d50a0) returned 0x0 [0045.989] LocalFree (hMem=0x1a7d50a0) returned 0x0 [0045.989] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0045.989] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0045.989] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0045.989] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0045.989] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0045.989] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.989] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.989] GetSystemMetrics (nIndex=42) returned 0 [0045.989] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.989] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.989] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0045.990] IsAppThemed () returned 0x1 [0045.990] GetThemeAppProperties () returned 0x3 [0045.990] GetThemeAppProperties () returned 0x3 [0045.990] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0045.990] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0045.990] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0045.990] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0045.990] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0045.990] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d50a0 [0045.990] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d50a0) returned 0x0 [0045.990] LocalFree (hMem=0x1a7d50a0) returned 0x0 [0045.990] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0045.990] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d50a0 [0045.990] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d50a0) returned 0x0 [0045.990] LocalFree (hMem=0x1a7d50a0) returned 0x0 [0045.990] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0045.990] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0045.990] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0045.990] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0045.990] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0045.990] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0045.990] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x1) returned 0x1b00017 [0045.990] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x2) returned 0x1900010 [0045.990] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x7) returned 0x6f0509d2 [0045.990] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x6) returned 0x18a002e [0045.991] SaveDC (hdc=0xffffffffa00109c0) returned 1 [0045.991] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff930409f1 [0045.991] GetClipRgn (hdc=0xffffffffa00109c0, hrgn=0xffffffff930409f1) returned 0 [0045.991] SelectClipRgn (hdc=0xffffffffa00109c0, hrgn=0xffffffffba0409ff) returned 2 [0045.991] DeleteObject (ho=0xffffffff930409f1) returned 1 [0045.991] DeleteObject (ho=0xffffffffba0409ff) returned 1 [0045.991] OffsetViewportOrgEx (in: hdc=0xffffffffa00109c0, x=0, y=0, lppt=0x27fa580 | out: lppt=0x27fa580) returned 1 [0045.991] OffsetViewportOrgEx (in: hdc=0xffffffffa00109c0, x=-417, y=-278, lppt=0x27fa598 | out: lppt=0x27fa598) returned 1 [0045.991] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0045.991] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x1) returned 0x1b00017 [0045.991] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x2) returned 0x1900010 [0045.991] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x7) returned 0x6f0509d2 [0045.991] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x6) returned 0x18a002e [0045.991] SaveDC (hdc=0xffffffffa00109c0) returned 2 [0045.991] GetNearestColor (hdc=0xffffffffa00109c0, color=0x6c4607) returned 0x6c4607 [0045.991] CreateSolidBrush (color=0x6c4607) returned 0xffffffff82100276 [0045.991] FillRect (hDC=0xffffffffa00109c0, lprc=0x26de08, hbr=0xffffffff82100276) returned 1 [0045.995] DeleteObject (ho=0xffffffff82100276) returned 1 [0045.995] RestoreDC (hdc=0xffffffffa00109c0, nSavedDC=-1) returned 1 [0045.995] RestoreDC (hdc=0xffffffffa00109c0, nSavedDC=-1) returned 1 [0045.995] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa00109c0) returned 0x0 [0045.995] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd320dbd) returned 0x0 [0045.995] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0045.995] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0045.995] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0045.995] GetSystemMetrics (nIndex=42) returned 0 [0045.995] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0045.995] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0045.995] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x44) returned 0x0 [0045.996] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0045.996] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0045.996] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0045.996] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0045.996] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0045.996] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0045.996] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x1) returned 0x1b00017 [0045.996] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x2) returned 0x1900010 [0045.996] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x7) returned 0x6f0509d2 [0045.996] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x6) returned 0x18a002e [0045.996] SaveDC (hdc=0xffffffffa00109c0) returned 1 [0045.996] GetNearestColor (hdc=0xffffffffa00109c0, color=0xf0f0f0) returned 0xf0f0f0 [0045.997] RestoreDC (hdc=0xffffffffa00109c0, nSavedDC=-1) returned 1 [0045.997] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa00109c0) returned 0x0 [0045.997] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0045.997] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0045.997] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0045.997] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0045.997] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x1) returned 0x1b00017 [0045.997] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x2) returned 0x1900010 [0045.997] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x7) returned 0x6f0509d2 [0045.997] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x6) returned 0x18a002e [0045.997] SaveDC (hdc=0xffffffffa00109c0) returned 1 [0045.997] GetTextAlign (hdc=0xffffffffa00109c0) returned 0x0 [0045.997] GetTextColor (hdc=0xffffffffa00109c0) returned 0x0 [0045.997] SetTextColor (hdc=0xffffffffa00109c0, color=0xf0f0f0) returned 0x0 [0045.997] GetCurrentObject (hdc=0xffffffffa00109c0, type=0x6) returned 0x18a002e [0045.997] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0045.997] SelectObject (hdc=0xffffffffa00109c0, h=0x260a09ba) returned 0x18a002e [0045.997] GetBkMode (hdc=0xffffffffa00109c0) returned 2 [0045.997] SetBkMode (hdc=0xffffffffa00109c0, mode=1) returned 2 [0045.997] DrawTextExW (in: hdc=0xffffffffa00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27fb448 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0045.998] DrawTextExW (in: hdc=0xffffffffa00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27fb448 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0045.998] RestoreDC (hdc=0xffffffffa00109c0, nSavedDC=-1) returned 1 [0045.998] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa00109c0) returned 0x0 [0045.998] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0045.998] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffa00109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0045.998] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa00109c0) returned 0x0 [0045.998] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0045.998] SelectObject (hdc=0xffffffffa00109c0, h=0x185000f) returned 0x6f0509d2 [0045.998] DeleteDC (hdc=0xffffffffa00109c0) returned 1 [0045.998] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0045.998] DeleteObject (ho=0x6f0509d2) returned 1 [0046.001] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0046.002] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.002] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.002] WaitMessage () returned 1 [0046.112] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.112] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.112] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.112] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.112] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.113] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0046.113] GetCurrentThreadId () returned 0xa28 [0046.113] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0046.113] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.113] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.113] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.113] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.113] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.113] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0046.113] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0046.113] CreateCompatibleDC (hdc=0x60109d6) returned 0x640109d7 [0046.113] GetObjectType (h=0x60109d6) returned 0x3 [0046.113] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x700509d2 [0046.113] GetDIBits (in: hdc=0x60109d6, hbm=0x700509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.113] GetDIBits (in: hdc=0x60109d6, hbm=0x700509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.113] DeleteObject (ho=0x700509d2) returned 1 [0046.113] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffa10509c0 [0046.114] SelectObject (hdc=0x640109d7, h=0xffffffffa10509c0) returned 0x185000f [0046.114] GdipCreateFromHDC (hdc=0x640109d7, graphics=0x26e408) returned 0x0 [0046.114] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0046.114] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0046.114] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0046.114] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0046.114] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0046.114] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5120 [0046.114] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d5120) returned 0x0 [0046.114] LocalFree (hMem=0x1a7d5120) returned 0x0 [0046.114] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0046.114] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0046.114] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0046.114] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0046.114] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0046.114] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.114] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.114] GetSystemMetrics (nIndex=42) returned 0 [0046.114] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0046.114] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.114] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0046.115] IsAppThemed () returned 0x1 [0046.115] GetThemeAppProperties () returned 0x3 [0046.115] GetThemeAppProperties () returned 0x3 [0046.115] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0046.115] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0046.115] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0046.115] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0046.115] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0046.115] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5120 [0046.115] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5120) returned 0x0 [0046.115] LocalFree (hMem=0x1a7d5120) returned 0x0 [0046.115] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0046.115] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5120 [0046.115] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5120) returned 0x0 [0046.115] LocalFree (hMem=0x1a7d5120) returned 0x0 [0046.115] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0046.115] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0046.115] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0046.115] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0046.115] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0046.115] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0046.115] GetCurrentObject (hdc=0x640109d7, type=0x1) returned 0x1b00017 [0046.115] GetCurrentObject (hdc=0x640109d7, type=0x2) returned 0x1900010 [0046.115] GetCurrentObject (hdc=0x640109d7, type=0x7) returned 0xffffffffa10509c0 [0046.115] GetCurrentObject (hdc=0x640109d7, type=0x6) returned 0x18a002e [0046.115] SaveDC (hdc=0x640109d7) returned 1 [0046.115] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffbb0409ff [0046.116] GetClipRgn (hdc=0x640109d7, hrgn=0xffffffffbb0409ff) returned 0 [0046.116] SelectClipRgn (hdc=0x640109d7, hrgn=0xffffffff960409f1) returned 2 [0046.116] DeleteObject (ho=0xffffffffbb0409ff) returned 1 [0046.116] DeleteObject (ho=0xffffffff960409f1) returned 1 [0046.116] OffsetViewportOrgEx (in: hdc=0x640109d7, x=0, y=0, lppt=0x27fd028 | out: lppt=0x27fd028) returned 1 [0046.116] OffsetViewportOrgEx (in: hdc=0x640109d7, x=-417, y=-278, lppt=0x27fd040 | out: lppt=0x27fd040) returned 1 [0046.116] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0046.116] GetCurrentObject (hdc=0x640109d7, type=0x1) returned 0x1b00017 [0046.116] GetCurrentObject (hdc=0x640109d7, type=0x2) returned 0x1900010 [0046.116] GetCurrentObject (hdc=0x640109d7, type=0x7) returned 0xffffffffa10509c0 [0046.116] GetCurrentObject (hdc=0x640109d7, type=0x6) returned 0x18a002e [0046.116] SaveDC (hdc=0x640109d7) returned 2 [0046.116] GetNearestColor (hdc=0x640109d7, color=0x6c4607) returned 0x6c4607 [0046.116] CreateSolidBrush (color=0x6c4607) returned 0xffffffff83100276 [0046.116] FillRect (hDC=0x640109d7, lprc=0x26de08, hbr=0xffffffff83100276) returned 1 [0046.119] DeleteObject (ho=0xffffffff83100276) returned 1 [0046.120] RestoreDC (hdc=0x640109d7, nSavedDC=-1) returned 1 [0046.120] RestoreDC (hdc=0x640109d7, nSavedDC=-1) returned 1 [0046.120] GdipReleaseDC (graphics=0x1b86d040, hdc=0x640109d7) returned 0x0 [0046.120] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd300dbd) returned 0x0 [0046.120] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0046.120] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.120] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.120] GetSystemMetrics (nIndex=42) returned 0 [0046.120] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0046.120] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.120] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0046.120] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0046.120] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0046.120] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0046.120] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0046.120] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0046.120] GetCurrentObject (hdc=0x640109d7, type=0x1) returned 0x1b00017 [0046.120] GetCurrentObject (hdc=0x640109d7, type=0x2) returned 0x1900010 [0046.120] GetCurrentObject (hdc=0x640109d7, type=0x7) returned 0xffffffffa10509c0 [0046.120] GetCurrentObject (hdc=0x640109d7, type=0x6) returned 0x18a002e [0046.120] SaveDC (hdc=0x640109d7) returned 1 [0046.120] GetNearestColor (hdc=0x640109d7, color=0xf0f0f0) returned 0xf0f0f0 [0046.120] RestoreDC (hdc=0x640109d7, nSavedDC=-1) returned 1 [0046.120] GdipReleaseDC (graphics=0x1b86d040, hdc=0x640109d7) returned 0x0 [0046.121] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0046.121] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0046.121] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0046.121] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0046.121] GetCurrentObject (hdc=0x640109d7, type=0x1) returned 0x1b00017 [0046.121] GetCurrentObject (hdc=0x640109d7, type=0x2) returned 0x1900010 [0046.121] GetCurrentObject (hdc=0x640109d7, type=0x7) returned 0xffffffffa10509c0 [0046.121] GetCurrentObject (hdc=0x640109d7, type=0x6) returned 0x18a002e [0046.121] SaveDC (hdc=0x640109d7) returned 1 [0046.121] GetTextAlign (hdc=0x640109d7) returned 0x0 [0046.121] GetTextColor (hdc=0x640109d7) returned 0x0 [0046.121] SetTextColor (hdc=0x640109d7, color=0xf0f0f0) returned 0x0 [0046.121] GetCurrentObject (hdc=0x640109d7, type=0x6) returned 0x18a002e [0046.121] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0046.121] SelectObject (hdc=0x640109d7, h=0x260a09ba) returned 0x18a002e [0046.121] GetBkMode (hdc=0x640109d7) returned 2 [0046.121] SetBkMode (hdc=0x640109d7, mode=1) returned 2 [0046.121] DrawTextExW (in: hdc=0x640109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27fdcf0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0046.122] DrawTextExW (in: hdc=0x640109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27fdcf0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0046.122] RestoreDC (hdc=0x640109d7, nSavedDC=-1) returned 1 [0046.122] GdipReleaseDC (graphics=0x1b86d040, hdc=0x640109d7) returned 0x0 [0046.122] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0046.122] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x640109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0046.122] GdipReleaseDC (graphics=0x1b86d040, hdc=0x640109d7) returned 0x0 [0046.122] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0046.122] SelectObject (hdc=0x640109d7, h=0x185000f) returned 0xffffffffa10509c0 [0046.122] DeleteDC (hdc=0x640109d7) returned 1 [0046.123] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0046.123] DeleteObject (ho=0xffffffffa10509c0) returned 1 [0046.126] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0046.126] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.126] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.126] WaitMessage () returned 1 [0046.237] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.237] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.237] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.237] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.237] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.237] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0046.237] GetCurrentThreadId () returned 0xa28 [0046.237] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0046.237] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.237] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.237] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.237] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.237] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.237] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0046.238] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0046.238] CreateCompatibleDC (hdc=0x60109d6) returned 0x720109d2 [0046.238] GetObjectType (h=0x60109d6) returned 0x3 [0046.238] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffa20509c0 [0046.238] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa20509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.238] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa20509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.238] DeleteObject (ho=0xffffffffa20509c0) returned 1 [0046.238] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x650509d7 [0046.238] SelectObject (hdc=0x720109d2, h=0x650509d7) returned 0x185000f [0046.238] GdipCreateFromHDC (hdc=0x720109d2, graphics=0x26e408) returned 0x0 [0046.238] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0046.238] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0046.239] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0046.239] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0046.239] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0046.239] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5120 [0046.239] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d5120) returned 0x0 [0046.239] LocalFree (hMem=0x1a7d5120) returned 0x0 [0046.239] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0046.239] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0046.239] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0046.239] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0046.239] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0046.239] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.239] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.239] GetSystemMetrics (nIndex=42) returned 0 [0046.239] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0046.239] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.239] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0046.239] IsAppThemed () returned 0x1 [0046.239] GetThemeAppProperties () returned 0x3 [0046.239] GetThemeAppProperties () returned 0x3 [0046.239] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0046.239] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0046.239] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0046.239] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0046.239] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0046.239] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5120 [0046.239] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5120) returned 0x0 [0046.239] LocalFree (hMem=0x1a7d5120) returned 0x0 [0046.240] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0046.240] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5120 [0046.240] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5120) returned 0x0 [0046.240] LocalFree (hMem=0x1a7d5120) returned 0x0 [0046.240] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0046.240] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0046.240] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0046.240] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0046.240] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0046.240] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0046.240] GetCurrentObject (hdc=0x720109d2, type=0x1) returned 0x1b00017 [0046.240] GetCurrentObject (hdc=0x720109d2, type=0x2) returned 0x1900010 [0046.240] GetCurrentObject (hdc=0x720109d2, type=0x7) returned 0x650509d7 [0046.240] GetCurrentObject (hdc=0x720109d2, type=0x6) returned 0x18a002e [0046.240] SaveDC (hdc=0x720109d2) returned 1 [0046.240] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff970409f1 [0046.240] GetClipRgn (hdc=0x720109d2, hrgn=0xffffffff970409f1) returned 0 [0046.240] SelectClipRgn (hdc=0x720109d2, hrgn=0xffffffffbe0409ff) returned 2 [0046.240] DeleteObject (ho=0xffffffff970409f1) returned 1 [0046.240] DeleteObject (ho=0xffffffffbe0409ff) returned 1 [0046.240] OffsetViewportOrgEx (in: hdc=0x720109d2, x=0, y=0, lppt=0x27ff8d0 | out: lppt=0x27ff8d0) returned 1 [0046.240] OffsetViewportOrgEx (in: hdc=0x720109d2, x=-417, y=-278, lppt=0x27ff8e8 | out: lppt=0x27ff8e8) returned 1 [0046.240] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0046.240] GetCurrentObject (hdc=0x720109d2, type=0x1) returned 0x1b00017 [0046.240] GetCurrentObject (hdc=0x720109d2, type=0x2) returned 0x1900010 [0046.240] GetCurrentObject (hdc=0x720109d2, type=0x7) returned 0x650509d7 [0046.240] GetCurrentObject (hdc=0x720109d2, type=0x6) returned 0x18a002e [0046.240] SaveDC (hdc=0x720109d2) returned 2 [0046.241] GetNearestColor (hdc=0x720109d2, color=0x6c4607) returned 0x6c4607 [0046.241] CreateSolidBrush (color=0x6c4607) returned 0xffffffff84100276 [0046.241] FillRect (hDC=0x720109d2, lprc=0x26de08, hbr=0xffffffff84100276) returned 1 [0046.244] DeleteObject (ho=0xffffffff84100276) returned 1 [0046.244] RestoreDC (hdc=0x720109d2, nSavedDC=-1) returned 1 [0046.244] RestoreDC (hdc=0x720109d2, nSavedDC=-1) returned 1 [0046.244] GdipReleaseDC (graphics=0x1b86d040, hdc=0x720109d2) returned 0x0 [0046.244] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd2e0dbd) returned 0x0 [0046.244] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0046.244] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.244] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.244] GetSystemMetrics (nIndex=42) returned 0 [0046.244] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0046.244] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.244] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x46) returned 0x0 [0046.245] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0046.245] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0046.245] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0046.245] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0046.245] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0046.245] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0046.245] GetCurrentObject (hdc=0x720109d2, type=0x1) returned 0x1b00017 [0046.246] GetCurrentObject (hdc=0x720109d2, type=0x2) returned 0x1900010 [0046.246] GetCurrentObject (hdc=0x720109d2, type=0x7) returned 0x650509d7 [0046.246] GetCurrentObject (hdc=0x720109d2, type=0x6) returned 0x18a002e [0046.246] SaveDC (hdc=0x720109d2) returned 1 [0046.246] GetNearestColor (hdc=0x720109d2, color=0xf0f0f0) returned 0xf0f0f0 [0046.246] RestoreDC (hdc=0x720109d2, nSavedDC=-1) returned 1 [0046.246] GdipReleaseDC (graphics=0x1b86d040, hdc=0x720109d2) returned 0x0 [0046.246] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0046.246] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0046.246] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0046.246] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0046.246] GetCurrentObject (hdc=0x720109d2, type=0x1) returned 0x1b00017 [0046.246] GetCurrentObject (hdc=0x720109d2, type=0x2) returned 0x1900010 [0046.246] GetCurrentObject (hdc=0x720109d2, type=0x7) returned 0x650509d7 [0046.246] GetCurrentObject (hdc=0x720109d2, type=0x6) returned 0x18a002e [0046.246] SaveDC (hdc=0x720109d2) returned 1 [0046.246] GetTextAlign (hdc=0x720109d2) returned 0x0 [0046.246] GetTextColor (hdc=0x720109d2) returned 0x0 [0046.246] SetTextColor (hdc=0x720109d2, color=0xf0f0f0) returned 0x0 [0046.246] GetCurrentObject (hdc=0x720109d2, type=0x6) returned 0x18a002e [0046.246] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0046.247] SelectObject (hdc=0x720109d2, h=0x260a09ba) returned 0x18a002e [0046.247] GetBkMode (hdc=0x720109d2) returned 2 [0046.247] SetBkMode (hdc=0x720109d2, mode=1) returned 2 [0046.247] DrawTextExW (in: hdc=0x720109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2800768 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0046.247] DrawTextExW (in: hdc=0x720109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2800768 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0046.247] RestoreDC (hdc=0x720109d2, nSavedDC=-1) returned 1 [0046.247] GdipReleaseDC (graphics=0x1b86d040, hdc=0x720109d2) returned 0x0 [0046.247] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0046.247] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x720109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0046.248] GdipReleaseDC (graphics=0x1b86d040, hdc=0x720109d2) returned 0x0 [0046.248] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0046.248] SelectObject (hdc=0x720109d2, h=0x185000f) returned 0x650509d7 [0046.248] DeleteDC (hdc=0x720109d2) returned 1 [0046.248] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0046.248] DeleteObject (ho=0x650509d7) returned 1 [0046.251] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0046.251] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.251] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.251] WaitMessage () returned 1 [0046.346] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.346] IsWindowUnicode (hWnd=0x5015a) returned 1 [0046.346] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.346] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.346] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.347] CoTaskMemAlloc (cb=0x121) returned 0x1a7d5fb0 [0046.379] CoTaskMemAlloc (cb=0x6) returned 0x1a7764b0 [0046.380] CoTaskMemAlloc (cb=0xb) returned 0x1a7e2cc0 [0046.381] CoTaskMemAlloc (cb=0xf) returned 0x1a7e2ce0 [0046.382] CoTaskMemAlloc (cb=0x12) returned 0x1a7e2d00 [0046.383] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.383] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.384] GetSystemMetrics (nIndex=42) returned 0 [0046.384] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e690, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0046.384] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e690) returned 0x5d [0046.384] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.384] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.384] GetSystemMetrics (nIndex=42) returned 0 [0046.384] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e630, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n1% complete\r\nDo not turn off your computer.") returned 93 [0046.384] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e630) returned 0x5d [0046.384] SetWindowTextW (hWnd=0x3015e, lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 1 [0046.384] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xc, wParam=0x0, lParam=0x2800a6c) returned 0x1 [0046.384] GetStockObject (i=5) returned 0x1900015 [0046.384] GetDlgItem (hDlg=0x50114, nIDDlgItem=196958) returned 0x3015e [0046.384] SendMessageW (hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26df90) returned 0x0 [0046.384] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26df90) returned 0x0 [0046.385] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0046.385] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.385] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.385] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.385] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.385] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.385] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0046.385] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0046.385] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffa40109c0 [0046.385] GetObjectType (h=0x60109d6) returned 0x3 [0046.385] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x660509d7 [0046.385] GetDIBits (in: hdc=0x60109d6, hbm=0x660509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.385] GetDIBits (in: hdc=0x60109d6, hbm=0x660509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.385] DeleteObject (ho=0x660509d7) returned 1 [0046.385] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x730509d2 [0046.386] SelectObject (hdc=0xffffffffa40109c0, h=0x730509d2) returned 0x185000f [0046.386] GdipCreateFromHDC (hdc=0xffffffffa40109c0, graphics=0x26e408) returned 0x0 [0046.386] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0046.386] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0046.386] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0046.386] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0046.386] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0046.386] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0046.386] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d51a0) returned 0x0 [0046.386] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0046.386] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0046.386] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0046.386] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0046.387] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0046.387] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0046.387] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.387] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.387] GetSystemMetrics (nIndex=42) returned 0 [0046.387] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.387] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.387] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0046.387] IsAppThemed () returned 0x1 [0046.387] GetThemeAppProperties () returned 0x3 [0046.387] GetThemeAppProperties () returned 0x3 [0046.387] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0046.387] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0046.387] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0046.387] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0046.387] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0046.387] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0046.387] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d51a0) returned 0x0 [0046.387] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0046.387] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0046.387] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0046.387] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d51a0) returned 0x0 [0046.387] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0046.387] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0046.387] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0046.387] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0046.387] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0046.388] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0046.388] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0046.388] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x1) returned 0x1b00017 [0046.388] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x2) returned 0x1900010 [0046.388] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x7) returned 0x730509d2 [0046.388] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x6) returned 0x18a002e [0046.388] SaveDC (hdc=0xffffffffa40109c0) returned 1 [0046.388] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffbf0409ff [0046.388] GetClipRgn (hdc=0xffffffffa40109c0, hrgn=0xffffffffbf0409ff) returned 0 [0046.388] SelectClipRgn (hdc=0xffffffffa40109c0, hrgn=0xffffffff9a0409f1) returned 2 [0046.388] DeleteObject (ho=0xffffffffbf0409ff) returned 1 [0046.388] DeleteObject (ho=0xffffffff9a0409f1) returned 1 [0046.388] OffsetViewportOrgEx (in: hdc=0xffffffffa40109c0, x=0, y=0, lppt=0x2802ac8 | out: lppt=0x2802ac8) returned 1 [0046.388] OffsetViewportOrgEx (in: hdc=0xffffffffa40109c0, x=-417, y=-278, lppt=0x2802ae0 | out: lppt=0x2802ae0) returned 1 [0046.388] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0046.388] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x1) returned 0x1b00017 [0046.388] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x2) returned 0x1900010 [0046.388] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x7) returned 0x730509d2 [0046.388] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x6) returned 0x18a002e [0046.388] SaveDC (hdc=0xffffffffa40109c0) returned 2 [0046.388] GetNearestColor (hdc=0xffffffffa40109c0, color=0x6c4607) returned 0x6c4607 [0046.388] CreateSolidBrush (color=0x6c4607) returned 0xffffffff85100276 [0046.388] FillRect (hDC=0xffffffffa40109c0, lprc=0x26de08, hbr=0xffffffff85100276) returned 1 [0046.392] DeleteObject (ho=0xffffffff85100276) returned 1 [0046.392] RestoreDC (hdc=0xffffffffa40109c0, nSavedDC=-1) returned 1 [0046.392] RestoreDC (hdc=0xffffffffa40109c0, nSavedDC=-1) returned 1 [0046.392] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa40109c0) returned 0x0 [0046.392] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd2c0dbd) returned 0x0 [0046.392] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0046.392] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.392] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.392] GetSystemMetrics (nIndex=42) returned 0 [0046.392] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.392] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.392] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0046.393] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0046.393] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0046.393] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0046.393] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0046.393] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0046.393] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x1) returned 0x1b00017 [0046.393] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x2) returned 0x1900010 [0046.393] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x7) returned 0x730509d2 [0046.393] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x6) returned 0x18a002e [0046.393] SaveDC (hdc=0xffffffffa40109c0) returned 1 [0046.393] GetNearestColor (hdc=0xffffffffa40109c0, color=0xf0f0f0) returned 0xf0f0f0 [0046.393] RestoreDC (hdc=0xffffffffa40109c0, nSavedDC=-1) returned 1 [0046.393] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa40109c0) returned 0x0 [0046.393] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0046.393] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0046.393] DrawTextExW (in: hdc=0xffffffff81010269, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e1c8, format=0x102405, lpdtp=0x2803340 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e1c8) returned 333 [0046.393] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0046.394] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0046.394] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x1) returned 0x1b00017 [0046.394] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x2) returned 0x1900010 [0046.394] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x7) returned 0x730509d2 [0046.394] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x6) returned 0x18a002e [0046.394] SaveDC (hdc=0xffffffffa40109c0) returned 1 [0046.394] GetTextAlign (hdc=0xffffffffa40109c0) returned 0x0 [0046.394] GetTextColor (hdc=0xffffffffa40109c0) returned 0x0 [0046.394] SetTextColor (hdc=0xffffffffa40109c0, color=0xf0f0f0) returned 0x0 [0046.394] GetCurrentObject (hdc=0xffffffffa40109c0, type=0x6) returned 0x18a002e [0046.394] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0046.394] SelectObject (hdc=0xffffffffa40109c0, h=0x260a09ba) returned 0x18a002e [0046.394] GetBkMode (hdc=0xffffffffa40109c0) returned 2 [0046.394] SetBkMode (hdc=0xffffffffa40109c0, mode=1) returned 2 [0046.394] DrawTextExW (in: hdc=0xffffffffa40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x28037b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0046.394] DrawTextExW (in: hdc=0xffffffffa40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x28037b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0046.395] RestoreDC (hdc=0xffffffffa40109c0, nSavedDC=-1) returned 1 [0046.395] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa40109c0) returned 0x0 [0046.396] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0046.396] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffa40109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0046.396] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa40109c0) returned 0x0 [0046.396] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0046.396] SelectObject (hdc=0xffffffffa40109c0, h=0x185000f) returned 0x730509d2 [0046.396] DeleteDC (hdc=0xffffffffa40109c0) returned 1 [0046.396] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0046.396] DeleteObject (ho=0x730509d2) returned 1 [0046.399] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0046.399] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.399] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.399] WaitMessage () returned 1 [0046.400] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.400] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.400] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.400] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.400] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.400] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0046.400] GetCurrentThreadId () returned 0xa28 [0046.400] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0046.400] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.400] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.400] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.400] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.400] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.400] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0046.400] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0046.401] CreateCompatibleDC (hdc=0x60109d6) returned 0x680109d7 [0046.401] GetObjectType (h=0x60109d6) returned 0x3 [0046.401] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x740509d2 [0046.401] GetDIBits (in: hdc=0x60109d6, hbm=0x740509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.401] GetDIBits (in: hdc=0x60109d6, hbm=0x740509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.401] DeleteObject (ho=0x740509d2) returned 1 [0046.401] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffa50509c0 [0046.401] SelectObject (hdc=0x680109d7, h=0xffffffffa50509c0) returned 0x185000f [0046.401] GdipCreateFromHDC (hdc=0x680109d7, graphics=0x26e408) returned 0x0 [0046.401] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0046.401] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0046.401] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0046.401] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0046.401] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0046.401] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0046.401] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d51a0) returned 0x0 [0046.402] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0046.402] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0046.402] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0046.402] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0046.402] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0046.402] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0046.402] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.402] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.402] GetSystemMetrics (nIndex=42) returned 0 [0046.402] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.402] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.402] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0046.402] IsAppThemed () returned 0x1 [0046.402] GetThemeAppProperties () returned 0x3 [0046.402] GetThemeAppProperties () returned 0x3 [0046.402] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0046.402] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0046.402] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0046.402] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0046.402] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0046.402] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0046.402] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d51a0) returned 0x0 [0046.402] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0046.402] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0046.402] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0046.402] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d51a0) returned 0x0 [0046.403] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0046.403] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0046.403] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0046.403] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0046.403] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0046.403] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0046.403] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0046.403] GetCurrentObject (hdc=0x680109d7, type=0x1) returned 0x1b00017 [0046.403] GetCurrentObject (hdc=0x680109d7, type=0x2) returned 0x1900010 [0046.403] GetCurrentObject (hdc=0x680109d7, type=0x7) returned 0xffffffffa50509c0 [0046.403] GetCurrentObject (hdc=0x680109d7, type=0x6) returned 0x18a002e [0046.403] SaveDC (hdc=0x680109d7) returned 1 [0046.403] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff9b0409f1 [0046.403] GetClipRgn (hdc=0x680109d7, hrgn=0xffffffff9b0409f1) returned 0 [0046.403] SelectClipRgn (hdc=0x680109d7, hrgn=0xffffffffc30409ff) returned 2 [0046.403] DeleteObject (ho=0xffffffff9b0409f1) returned 1 [0046.403] DeleteObject (ho=0xffffffffc30409ff) returned 1 [0046.403] OffsetViewportOrgEx (in: hdc=0x680109d7, x=0, y=0, lppt=0x2805398 | out: lppt=0x2805398) returned 1 [0046.403] OffsetViewportOrgEx (in: hdc=0x680109d7, x=-417, y=-278, lppt=0x28053b0 | out: lppt=0x28053b0) returned 1 [0046.403] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0046.403] GetCurrentObject (hdc=0x680109d7, type=0x1) returned 0x1b00017 [0046.403] GetCurrentObject (hdc=0x680109d7, type=0x2) returned 0x1900010 [0046.403] GetCurrentObject (hdc=0x680109d7, type=0x7) returned 0xffffffffa50509c0 [0046.403] GetCurrentObject (hdc=0x680109d7, type=0x6) returned 0x18a002e [0046.404] SaveDC (hdc=0x680109d7) returned 2 [0046.404] GetNearestColor (hdc=0x680109d7, color=0x6c4607) returned 0x6c4607 [0046.404] CreateSolidBrush (color=0x6c4607) returned 0xffffffff86100276 [0046.404] FillRect (hDC=0x680109d7, lprc=0x26de08, hbr=0xffffffff86100276) returned 1 [0046.410] DeleteObject (ho=0xffffffff86100276) returned 1 [0046.410] RestoreDC (hdc=0x680109d7, nSavedDC=-1) returned 1 [0046.410] RestoreDC (hdc=0x680109d7, nSavedDC=-1) returned 1 [0046.410] GdipReleaseDC (graphics=0x1b86d040, hdc=0x680109d7) returned 0x0 [0046.410] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd2a0dbd) returned 0x0 [0046.410] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0046.410] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.410] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.410] GetSystemMetrics (nIndex=42) returned 0 [0046.410] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.410] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.410] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0046.410] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0046.410] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0046.410] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0046.410] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0046.410] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0046.410] GetCurrentObject (hdc=0x680109d7, type=0x1) returned 0x1b00017 [0046.410] GetCurrentObject (hdc=0x680109d7, type=0x2) returned 0x1900010 [0046.410] GetCurrentObject (hdc=0x680109d7, type=0x7) returned 0xffffffffa50509c0 [0046.411] GetCurrentObject (hdc=0x680109d7, type=0x6) returned 0x18a002e [0046.411] SaveDC (hdc=0x680109d7) returned 1 [0046.411] GetNearestColor (hdc=0x680109d7, color=0xf0f0f0) returned 0xf0f0f0 [0046.411] RestoreDC (hdc=0x680109d7, nSavedDC=-1) returned 1 [0046.411] GdipReleaseDC (graphics=0x1b86d040, hdc=0x680109d7) returned 0x0 [0046.411] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0046.411] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0046.411] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0046.411] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0046.411] GetCurrentObject (hdc=0x680109d7, type=0x1) returned 0x1b00017 [0046.411] GetCurrentObject (hdc=0x680109d7, type=0x2) returned 0x1900010 [0046.411] GetCurrentObject (hdc=0x680109d7, type=0x7) returned 0xffffffffa50509c0 [0046.411] GetCurrentObject (hdc=0x680109d7, type=0x6) returned 0x18a002e [0046.411] SaveDC (hdc=0x680109d7) returned 1 [0046.411] GetTextAlign (hdc=0x680109d7) returned 0x0 [0046.411] GetTextColor (hdc=0x680109d7) returned 0x0 [0046.411] SetTextColor (hdc=0x680109d7, color=0xf0f0f0) returned 0x0 [0046.411] GetCurrentObject (hdc=0x680109d7, type=0x6) returned 0x18a002e [0046.412] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0046.412] SelectObject (hdc=0x680109d7, h=0x260a09ba) returned 0x18a002e [0046.412] GetBkMode (hdc=0x680109d7) returned 2 [0046.412] SetBkMode (hdc=0x680109d7, mode=1) returned 2 [0046.412] DrawTextExW (in: hdc=0x680109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2806060 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0046.412] DrawTextExW (in: hdc=0x680109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2806060 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0046.412] RestoreDC (hdc=0x680109d7, nSavedDC=-1) returned 1 [0046.412] GdipReleaseDC (graphics=0x1b86d040, hdc=0x680109d7) returned 0x0 [0046.412] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0046.412] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x680109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0046.413] GdipReleaseDC (graphics=0x1b86d040, hdc=0x680109d7) returned 0x0 [0046.413] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0046.413] SelectObject (hdc=0x680109d7, h=0x185000f) returned 0xffffffffa50509c0 [0046.413] DeleteDC (hdc=0x680109d7) returned 1 [0046.413] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0046.413] DeleteObject (ho=0xffffffffa50509c0) returned 1 [0046.416] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0046.416] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.416] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.416] WaitMessage () returned 1 [0046.550] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.550] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.551] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.551] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.551] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.551] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0046.551] GetCurrentThreadId () returned 0xa28 [0046.551] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0046.551] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.551] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.551] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.551] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.551] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.551] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0046.551] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0046.551] CreateCompatibleDC (hdc=0x60109d6) returned 0x760109d2 [0046.551] GetObjectType (h=0x60109d6) returned 0x3 [0046.551] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffa60509c0 [0046.551] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa60509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.551] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa60509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.551] DeleteObject (ho=0xffffffffa60509c0) returned 1 [0046.551] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x690509d7 [0046.552] SelectObject (hdc=0x760109d2, h=0x690509d7) returned 0x185000f [0046.552] GdipCreateFromHDC (hdc=0x760109d2, graphics=0x26e408) returned 0x0 [0046.552] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0046.552] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0046.552] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0046.552] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0046.552] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0046.552] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d52e0 [0046.552] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d52e0) returned 0x0 [0046.552] LocalFree (hMem=0x1a7d52e0) returned 0x0 [0046.552] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0046.552] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0046.552] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0046.552] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0046.552] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0046.552] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.552] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.552] GetSystemMetrics (nIndex=42) returned 0 [0046.552] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.552] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.553] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0046.553] IsAppThemed () returned 0x1 [0046.553] GetThemeAppProperties () returned 0x3 [0046.553] GetThemeAppProperties () returned 0x3 [0046.553] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0046.553] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0046.553] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0046.553] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0046.553] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0046.553] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d52e0 [0046.553] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d52e0) returned 0x0 [0046.553] LocalFree (hMem=0x1a7d52e0) returned 0x0 [0046.553] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0046.553] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d52e0 [0046.553] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d52e0) returned 0x0 [0046.553] LocalFree (hMem=0x1a7d52e0) returned 0x0 [0046.553] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0046.553] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0046.553] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0046.553] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0046.553] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0046.553] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0046.553] GetCurrentObject (hdc=0x760109d2, type=0x1) returned 0x1b00017 [0046.553] GetCurrentObject (hdc=0x760109d2, type=0x2) returned 0x1900010 [0046.553] GetCurrentObject (hdc=0x760109d2, type=0x7) returned 0x690509d7 [0046.553] GetCurrentObject (hdc=0x760109d2, type=0x6) returned 0x18a002e [0046.554] SaveDC (hdc=0x760109d2) returned 1 [0046.554] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc40409ff [0046.554] GetClipRgn (hdc=0x760109d2, hrgn=0xffffffffc40409ff) returned 0 [0046.554] SelectClipRgn (hdc=0x760109d2, hrgn=0xffffffff9e0409f1) returned 2 [0046.554] DeleteObject (ho=0xffffffffc40409ff) returned 1 [0046.554] DeleteObject (ho=0xffffffff9e0409f1) returned 1 [0046.554] OffsetViewportOrgEx (in: hdc=0x760109d2, x=0, y=0, lppt=0x2807c58 | out: lppt=0x2807c58) returned 1 [0046.554] OffsetViewportOrgEx (in: hdc=0x760109d2, x=-417, y=-278, lppt=0x2807c70 | out: lppt=0x2807c70) returned 1 [0046.554] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0046.554] GetCurrentObject (hdc=0x760109d2, type=0x1) returned 0x1b00017 [0046.554] GetCurrentObject (hdc=0x760109d2, type=0x2) returned 0x1900010 [0046.554] GetCurrentObject (hdc=0x760109d2, type=0x7) returned 0x690509d7 [0046.554] GetCurrentObject (hdc=0x760109d2, type=0x6) returned 0x18a002e [0046.554] SaveDC (hdc=0x760109d2) returned 2 [0046.554] GetNearestColor (hdc=0x760109d2, color=0x6c4607) returned 0x6c4607 [0046.554] CreateSolidBrush (color=0x6c4607) returned 0xffffffff87100276 [0046.554] FillRect (hDC=0x760109d2, lprc=0x26de08, hbr=0xffffffff87100276) returned 1 [0046.564] DeleteObject (ho=0xffffffff87100276) returned 1 [0046.564] RestoreDC (hdc=0x760109d2, nSavedDC=-1) returned 1 [0046.564] RestoreDC (hdc=0x760109d2, nSavedDC=-1) returned 1 [0046.564] GdipReleaseDC (graphics=0x1b86d040, hdc=0x760109d2) returned 0x0 [0046.564] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd280dbd) returned 0x0 [0046.564] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0046.564] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.564] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.564] GetSystemMetrics (nIndex=42) returned 0 [0046.564] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.564] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.564] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x48) returned 0x0 [0046.565] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0046.565] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0046.565] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0046.565] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0046.565] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0046.566] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0046.566] GetCurrentObject (hdc=0x760109d2, type=0x1) returned 0x1b00017 [0046.566] GetCurrentObject (hdc=0x760109d2, type=0x2) returned 0x1900010 [0046.566] GetCurrentObject (hdc=0x760109d2, type=0x7) returned 0x690509d7 [0046.566] GetCurrentObject (hdc=0x760109d2, type=0x6) returned 0x18a002e [0046.566] SaveDC (hdc=0x760109d2) returned 1 [0046.566] GetNearestColor (hdc=0x760109d2, color=0xf0f0f0) returned 0xf0f0f0 [0046.566] RestoreDC (hdc=0x760109d2, nSavedDC=-1) returned 1 [0046.566] GdipReleaseDC (graphics=0x1b86d040, hdc=0x760109d2) returned 0x0 [0046.566] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0046.638] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0046.638] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0046.638] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0046.638] GetCurrentObject (hdc=0x760109d2, type=0x1) returned 0x1b00017 [0046.638] GetCurrentObject (hdc=0x760109d2, type=0x2) returned 0x1900010 [0046.638] GetCurrentObject (hdc=0x760109d2, type=0x7) returned 0x690509d7 [0046.638] GetCurrentObject (hdc=0x760109d2, type=0x6) returned 0x18a002e [0046.638] SaveDC (hdc=0x760109d2) returned 1 [0046.638] GetTextAlign (hdc=0x760109d2) returned 0x0 [0046.638] GetTextColor (hdc=0x760109d2) returned 0x0 [0046.638] SetTextColor (hdc=0x760109d2, color=0xf0f0f0) returned 0x0 [0046.638] GetCurrentObject (hdc=0x760109d2, type=0x6) returned 0x18a002e [0046.638] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0046.638] SelectObject (hdc=0x760109d2, h=0x260a09ba) returned 0x18a002e [0046.638] GetBkMode (hdc=0x760109d2) returned 2 [0046.638] SetBkMode (hdc=0x760109d2, mode=1) returned 2 [0046.638] DrawTextExW (in: hdc=0x760109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2808ae0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0046.639] DrawTextExW (in: hdc=0x760109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2808ae0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0046.639] RestoreDC (hdc=0x760109d2, nSavedDC=-1) returned 1 [0046.639] GdipReleaseDC (graphics=0x1b86d040, hdc=0x760109d2) returned 0x0 [0046.639] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0046.639] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x760109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0046.639] GdipReleaseDC (graphics=0x1b86d040, hdc=0x760109d2) returned 0x0 [0046.640] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0046.640] SelectObject (hdc=0x760109d2, h=0x185000f) returned 0x690509d7 [0046.640] DeleteDC (hdc=0x760109d2) returned 1 [0046.640] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0046.640] DeleteObject (ho=0x690509d7) returned 1 [0046.643] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0046.643] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.643] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x810198) returned 0x1 [0046.643] IsWindowUnicode (hWnd=0x50114) returned 1 [0046.644] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.644] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.644] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.644] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0046.644] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.644] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x810198) returned 0x1 [0046.644] IsWindowUnicode (hWnd=0x50114) returned 1 [0046.644] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.644] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x810198) returned 0x1 [0046.644] SetCursor (hCursor=0x10007) returned 0x10007 [0046.644] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.644] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.644] _TrackMouseEvent (in: lpEventTrack=0x27477d0 | out: lpEventTrack=0x27477d0) returned 1 [0046.644] SendMessageW (hWnd=0x50114, Msg=0xc0e3, wParam=0x0, lParam=0x0) returned 0x0 [0046.644] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xc0e3, wParam=0x0, lParam=0x0) returned 0x0 [0046.644] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0x810198) returned 0x0 [0046.644] GetKeyState (nVirtKey=1) returned 0 [0046.644] GetKeyState (nVirtKey=2) returned 0 [0046.644] GetKeyState (nVirtKey=4) returned 0 [0046.644] GetKeyState (nVirtKey=5) returned 0 [0046.644] GetKeyState (nVirtKey=6) returned 0 [0046.644] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.644] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.644] WaitMessage () returned 1 [0046.689] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.689] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.689] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.689] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.689] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.689] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0046.689] GetCurrentThreadId () returned 0xa28 [0046.689] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0046.689] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.689] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.689] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.689] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.689] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.689] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0046.689] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0046.689] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffa80109c0 [0046.689] GetObjectType (h=0x60109d6) returned 0x3 [0046.689] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x6a0509d7 [0046.690] GetDIBits (in: hdc=0x60109d6, hbm=0x6a0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.690] GetDIBits (in: hdc=0x60109d6, hbm=0x6a0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.690] DeleteObject (ho=0x6a0509d7) returned 1 [0046.690] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x770509d2 [0046.690] SelectObject (hdc=0xffffffffa80109c0, h=0x770509d2) returned 0x185000f [0046.690] GdipCreateFromHDC (hdc=0xffffffffa80109c0, graphics=0x26e408) returned 0x0 [0046.690] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0046.690] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0046.690] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0046.690] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0046.690] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0046.690] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5660 [0046.690] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d5660) returned 0x0 [0046.690] LocalFree (hMem=0x1a7d5660) returned 0x0 [0046.690] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0046.691] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0046.691] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0046.691] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0046.691] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0046.691] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.691] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.691] GetSystemMetrics (nIndex=42) returned 0 [0046.691] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.691] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.691] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0046.691] IsAppThemed () returned 0x1 [0046.691] GetThemeAppProperties () returned 0x3 [0046.691] GetThemeAppProperties () returned 0x3 [0046.691] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0046.691] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0046.691] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0046.691] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0046.691] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0046.691] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5660 [0046.691] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5660) returned 0x0 [0046.691] LocalFree (hMem=0x1a7d5660) returned 0x0 [0046.691] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0046.691] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5660 [0046.691] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5660) returned 0x0 [0046.691] LocalFree (hMem=0x1a7d5660) returned 0x0 [0046.692] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0046.692] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0046.692] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0046.692] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0046.692] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0046.692] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0046.692] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x1) returned 0x1b00017 [0046.692] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x2) returned 0x1900010 [0046.692] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x7) returned 0x770509d2 [0046.692] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x6) returned 0x18a002e [0046.692] SaveDC (hdc=0xffffffffa80109c0) returned 1 [0046.692] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff9f0409f1 [0046.692] GetClipRgn (hdc=0xffffffffa80109c0, hrgn=0xffffffff9f0409f1) returned 0 [0046.692] SelectClipRgn (hdc=0xffffffffa80109c0, hrgn=0xffffffffc70409ff) returned 2 [0046.692] DeleteObject (ho=0xffffffff9f0409f1) returned 1 [0046.692] DeleteObject (ho=0xffffffffc70409ff) returned 1 [0046.692] OffsetViewportOrgEx (in: hdc=0xffffffffa80109c0, x=0, y=0, lppt=0x280a6e8 | out: lppt=0x280a6e8) returned 1 [0046.692] OffsetViewportOrgEx (in: hdc=0xffffffffa80109c0, x=-417, y=-278, lppt=0x280a700 | out: lppt=0x280a700) returned 1 [0046.692] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0046.692] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x1) returned 0x1b00017 [0046.692] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x2) returned 0x1900010 [0046.692] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x7) returned 0x770509d2 [0046.692] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x6) returned 0x18a002e [0046.692] SaveDC (hdc=0xffffffffa80109c0) returned 2 [0046.692] GetNearestColor (hdc=0xffffffffa80109c0, color=0x6c4607) returned 0x6c4607 [0046.692] CreateSolidBrush (color=0x6c4607) returned 0xffffffff88100276 [0046.692] FillRect (hDC=0xffffffffa80109c0, lprc=0x26de08, hbr=0xffffffff88100276) returned 1 [0046.698] DeleteObject (ho=0xffffffff88100276) returned 1 [0046.698] RestoreDC (hdc=0xffffffffa80109c0, nSavedDC=-1) returned 1 [0046.698] RestoreDC (hdc=0xffffffffa80109c0, nSavedDC=-1) returned 1 [0046.698] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109c0) returned 0x0 [0046.698] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd260dbd) returned 0x0 [0046.698] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0046.698] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.698] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.698] GetSystemMetrics (nIndex=42) returned 0 [0046.698] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.698] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.699] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0046.699] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0046.699] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0046.699] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0046.699] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0046.699] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0046.699] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x1) returned 0x1b00017 [0046.699] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x2) returned 0x1900010 [0046.699] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x7) returned 0x770509d2 [0046.699] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x6) returned 0x18a002e [0046.699] SaveDC (hdc=0xffffffffa80109c0) returned 1 [0046.699] GetNearestColor (hdc=0xffffffffa80109c0, color=0xf0f0f0) returned 0xf0f0f0 [0046.699] RestoreDC (hdc=0xffffffffa80109c0, nSavedDC=-1) returned 1 [0046.699] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109c0) returned 0x0 [0046.702] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0046.702] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0046.702] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0046.702] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0046.702] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x1) returned 0x1b00017 [0046.702] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x2) returned 0x1900010 [0046.702] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x7) returned 0x770509d2 [0046.702] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x6) returned 0x18a002e [0046.702] SaveDC (hdc=0xffffffffa80109c0) returned 1 [0046.702] GetTextAlign (hdc=0xffffffffa80109c0) returned 0x0 [0046.702] GetTextColor (hdc=0xffffffffa80109c0) returned 0x0 [0046.702] SetTextColor (hdc=0xffffffffa80109c0, color=0xf0f0f0) returned 0x0 [0046.702] GetCurrentObject (hdc=0xffffffffa80109c0, type=0x6) returned 0x18a002e [0046.702] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0046.702] SelectObject (hdc=0xffffffffa80109c0, h=0x260a09ba) returned 0x18a002e [0046.702] GetBkMode (hdc=0xffffffffa80109c0) returned 2 [0046.702] SetBkMode (hdc=0xffffffffa80109c0, mode=1) returned 2 [0046.702] DrawTextExW (in: hdc=0xffffffffa80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x280b3b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0046.703] DrawTextExW (in: hdc=0xffffffffa80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x280b3b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0046.703] RestoreDC (hdc=0xffffffffa80109c0, nSavedDC=-1) returned 1 [0046.703] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109c0) returned 0x0 [0046.703] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0046.703] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffa80109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0046.703] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109c0) returned 0x0 [0046.703] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0046.703] SelectObject (hdc=0xffffffffa80109c0, h=0x185000f) returned 0x770509d2 [0046.703] DeleteDC (hdc=0xffffffffa80109c0) returned 1 [0046.704] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0046.704] DeleteObject (ho=0x770509d2) returned 1 [0046.707] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0046.708] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.708] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.708] WaitMessage () returned 1 [0046.751] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.751] IsWindowUnicode (hWnd=0x50114) returned 1 [0046.751] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.751] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.751] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.751] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.751] IsWindowUnicode (hWnd=0x50114) returned 1 [0046.751] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.751] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.751] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.751] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x2a1, wParam=0x0, lParam=0x810198) returned 0x0 [0046.751] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.751] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.751] WaitMessage () returned 1 [0046.892] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.892] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.892] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.892] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.892] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.892] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0046.892] GetCurrentThreadId () returned 0xa28 [0046.892] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0046.892] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.892] IsWindowUnicode (hWnd=0x3015e) returned 1 [0046.892] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0046.892] TranslateMessage (lpMsg=0x26ee10) returned 0 [0046.892] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0046.893] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0046.893] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0046.893] CreateCompatibleDC (hdc=0x60109d6) returned 0x6c0109d7 [0046.893] GetObjectType (h=0x60109d6) returned 0x3 [0046.893] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x780509d2 [0046.893] GetDIBits (in: hdc=0x60109d6, hbm=0x780509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.893] GetDIBits (in: hdc=0x60109d6, hbm=0x780509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0046.893] DeleteObject (ho=0x780509d2) returned 1 [0046.893] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffa90509c0 [0046.893] SelectObject (hdc=0x6c0109d7, h=0xffffffffa90509c0) returned 0x185000f [0046.893] GdipCreateFromHDC (hdc=0x6c0109d7, graphics=0x26e408) returned 0x0 [0046.894] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0046.894] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0046.894] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0046.894] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0046.894] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0046.894] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5660 [0046.894] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d5660) returned 0x0 [0046.894] LocalFree (hMem=0x1a7d5660) returned 0x0 [0046.894] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0046.894] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0046.894] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0046.894] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0046.894] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0046.894] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.894] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.894] GetSystemMetrics (nIndex=42) returned 0 [0046.894] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.894] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.894] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0046.894] IsAppThemed () returned 0x1 [0046.894] GetThemeAppProperties () returned 0x3 [0046.894] GetThemeAppProperties () returned 0x3 [0046.894] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0046.894] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0046.894] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0046.894] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0046.894] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0046.894] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5660 [0046.895] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5660) returned 0x0 [0046.895] LocalFree (hMem=0x1a7d5660) returned 0x0 [0046.895] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0046.895] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d5660 [0046.895] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d5660) returned 0x0 [0046.895] LocalFree (hMem=0x1a7d5660) returned 0x0 [0046.895] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0046.895] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0046.895] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0046.895] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0046.895] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0046.895] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0046.895] GetCurrentObject (hdc=0x6c0109d7, type=0x1) returned 0x1b00017 [0046.895] GetCurrentObject (hdc=0x6c0109d7, type=0x2) returned 0x1900010 [0046.895] GetCurrentObject (hdc=0x6c0109d7, type=0x7) returned 0xffffffffa90509c0 [0046.895] GetCurrentObject (hdc=0x6c0109d7, type=0x6) returned 0x18a002e [0046.895] SaveDC (hdc=0x6c0109d7) returned 1 [0046.895] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc80409ff [0046.895] GetClipRgn (hdc=0x6c0109d7, hrgn=0xffffffffc80409ff) returned 0 [0046.895] SelectClipRgn (hdc=0x6c0109d7, hrgn=0xffffffffa20409f1) returned 2 [0046.895] DeleteObject (ho=0xffffffffc80409ff) returned 1 [0046.895] DeleteObject (ho=0xffffffffa20409f1) returned 1 [0046.895] OffsetViewportOrgEx (in: hdc=0x6c0109d7, x=0, y=0, lppt=0x280d610 | out: lppt=0x280d610) returned 1 [0046.895] OffsetViewportOrgEx (in: hdc=0x6c0109d7, x=-417, y=-278, lppt=0x280d628 | out: lppt=0x280d628) returned 1 [0046.895] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0046.895] GetCurrentObject (hdc=0x6c0109d7, type=0x1) returned 0x1b00017 [0046.895] GetCurrentObject (hdc=0x6c0109d7, type=0x2) returned 0x1900010 [0046.895] GetCurrentObject (hdc=0x6c0109d7, type=0x7) returned 0xffffffffa90509c0 [0046.896] GetCurrentObject (hdc=0x6c0109d7, type=0x6) returned 0x18a002e [0046.896] SaveDC (hdc=0x6c0109d7) returned 2 [0046.896] GetNearestColor (hdc=0x6c0109d7, color=0x6c4607) returned 0x6c4607 [0046.896] CreateSolidBrush (color=0x6c4607) returned 0xffffffff89100276 [0046.896] FillRect (hDC=0x6c0109d7, lprc=0x26de08, hbr=0xffffffff89100276) returned 1 [0046.902] DeleteObject (ho=0xffffffff89100276) returned 1 [0046.902] RestoreDC (hdc=0x6c0109d7, nSavedDC=-1) returned 1 [0046.902] RestoreDC (hdc=0x6c0109d7, nSavedDC=-1) returned 1 [0046.902] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6c0109d7) returned 0x0 [0046.902] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd240dbd) returned 0x0 [0046.902] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0046.902] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0046.902] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0046.902] GetSystemMetrics (nIndex=42) returned 0 [0046.902] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0046.902] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0046.902] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x4a) returned 0x0 [0046.903] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0046.903] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0046.903] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0046.903] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0046.903] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0046.903] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0046.903] GetCurrentObject (hdc=0x6c0109d7, type=0x1) returned 0x1b00017 [0046.903] GetCurrentObject (hdc=0x6c0109d7, type=0x2) returned 0x1900010 [0046.903] GetCurrentObject (hdc=0x6c0109d7, type=0x7) returned 0xffffffffa90509c0 [0046.903] GetCurrentObject (hdc=0x6c0109d7, type=0x6) returned 0x18a002e [0046.903] SaveDC (hdc=0x6c0109d7) returned 1 [0046.903] GetNearestColor (hdc=0x6c0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0046.904] RestoreDC (hdc=0x6c0109d7, nSavedDC=-1) returned 1 [0046.904] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6c0109d7) returned 0x0 [0046.904] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0046.904] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0046.904] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0046.904] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0046.904] GetCurrentObject (hdc=0x6c0109d7, type=0x1) returned 0x1b00017 [0046.904] GetCurrentObject (hdc=0x6c0109d7, type=0x2) returned 0x1900010 [0046.904] GetCurrentObject (hdc=0x6c0109d7, type=0x7) returned 0xffffffffa90509c0 [0046.904] GetCurrentObject (hdc=0x6c0109d7, type=0x6) returned 0x18a002e [0046.904] SaveDC (hdc=0x6c0109d7) returned 1 [0046.904] GetTextAlign (hdc=0x6c0109d7) returned 0x0 [0046.904] GetTextColor (hdc=0x6c0109d7) returned 0x0 [0046.904] SetTextColor (hdc=0x6c0109d7, color=0xf0f0f0) returned 0x0 [0046.904] GetCurrentObject (hdc=0x6c0109d7, type=0x6) returned 0x18a002e [0046.904] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0046.905] SelectObject (hdc=0x6c0109d7, h=0x260a09ba) returned 0x18a002e [0046.905] GetBkMode (hdc=0x6c0109d7) returned 2 [0046.905] SetBkMode (hdc=0x6c0109d7, mode=1) returned 2 [0046.905] DrawTextExW (in: hdc=0x6c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x280e488 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0046.905] DrawTextExW (in: hdc=0x6c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x280e488 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0046.905] RestoreDC (hdc=0x6c0109d7, nSavedDC=-1) returned 1 [0046.905] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6c0109d7) returned 0x0 [0046.905] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0046.905] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x6c0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0046.906] GdipReleaseDC (graphics=0x1b86d040, hdc=0x6c0109d7) returned 0x0 [0046.906] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0046.906] SelectObject (hdc=0x6c0109d7, h=0x185000f) returned 0xffffffffa90509c0 [0046.906] DeleteDC (hdc=0x6c0109d7) returned 1 [0046.906] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0046.906] DeleteObject (ho=0xffffffffa90509c0) returned 1 [0046.913] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0046.913] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.913] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0046.913] WaitMessage () returned 1 [0047.048] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.048] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.048] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.049] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.049] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.049] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0047.049] GetCurrentThreadId () returned 0xa28 [0047.049] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0047.049] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.049] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.049] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.049] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.049] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.049] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0047.049] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0047.049] CreateCompatibleDC (hdc=0x60109d6) returned 0x7a0109d2 [0047.049] GetObjectType (h=0x60109d6) returned 0x3 [0047.049] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffaa0509c0 [0047.049] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffaa0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.049] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffaa0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.049] DeleteObject (ho=0xffffffffaa0509c0) returned 1 [0047.049] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x6d0509d7 [0047.050] SelectObject (hdc=0x7a0109d2, h=0x6d0509d7) returned 0x185000f [0047.050] GdipCreateFromHDC (hdc=0x7a0109d2, graphics=0x26e408) returned 0x0 [0047.050] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0047.050] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0047.050] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0047.050] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0047.050] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0047.050] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0047.050] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d51a0) returned 0x0 [0047.050] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0047.050] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0047.050] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0047.050] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0047.050] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0047.050] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0047.050] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.050] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.050] GetSystemMetrics (nIndex=42) returned 0 [0047.050] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.050] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.051] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0047.051] IsAppThemed () returned 0x1 [0047.051] GetThemeAppProperties () returned 0x3 [0047.051] GetThemeAppProperties () returned 0x3 [0047.051] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0047.051] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0047.051] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0047.051] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0047.051] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0047.051] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0047.051] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d51a0) returned 0x0 [0047.051] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0047.051] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0047.051] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0047.051] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d51a0) returned 0x0 [0047.051] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0047.051] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0047.051] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0047.051] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0047.051] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0047.051] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0047.051] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0047.051] GetCurrentObject (hdc=0x7a0109d2, type=0x1) returned 0x1b00017 [0047.051] GetCurrentObject (hdc=0x7a0109d2, type=0x2) returned 0x1900010 [0047.051] GetCurrentObject (hdc=0x7a0109d2, type=0x7) returned 0x6d0509d7 [0047.051] GetCurrentObject (hdc=0x7a0109d2, type=0x6) returned 0x18a002e [0047.051] SaveDC (hdc=0x7a0109d2) returned 1 [0047.051] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa30409f1 [0047.052] GetClipRgn (hdc=0x7a0109d2, hrgn=0xffffffffa30409f1) returned 0 [0047.052] SelectClipRgn (hdc=0x7a0109d2, hrgn=0xffffffffcb0409ff) returned 2 [0047.052] DeleteObject (ho=0xffffffffa30409f1) returned 1 [0047.052] DeleteObject (ho=0xffffffffcb0409ff) returned 1 [0047.052] OffsetViewportOrgEx (in: hdc=0x7a0109d2, x=0, y=0, lppt=0x26af2e0 | out: lppt=0x26af2e0) returned 1 [0047.052] OffsetViewportOrgEx (in: hdc=0x7a0109d2, x=-417, y=-278, lppt=0x26af2f8 | out: lppt=0x26af2f8) returned 1 [0047.052] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0047.052] GetCurrentObject (hdc=0x7a0109d2, type=0x1) returned 0x1b00017 [0047.052] GetCurrentObject (hdc=0x7a0109d2, type=0x2) returned 0x1900010 [0047.052] GetCurrentObject (hdc=0x7a0109d2, type=0x7) returned 0x6d0509d7 [0047.052] GetCurrentObject (hdc=0x7a0109d2, type=0x6) returned 0x18a002e [0047.052] SaveDC (hdc=0x7a0109d2) returned 2 [0047.052] GetNearestColor (hdc=0x7a0109d2, color=0x6c4607) returned 0x6c4607 [0047.052] CreateSolidBrush (color=0x6c4607) returned 0xffffffff8a100276 [0047.052] FillRect (hDC=0x7a0109d2, lprc=0x26de08, hbr=0xffffffff8a100276) returned 1 [0047.057] DeleteObject (ho=0xffffffff8a100276) returned 1 [0047.057] RestoreDC (hdc=0x7a0109d2, nSavedDC=-1) returned 1 [0047.057] RestoreDC (hdc=0x7a0109d2, nSavedDC=-1) returned 1 [0047.057] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7a0109d2) returned 0x0 [0047.057] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd220dbd) returned 0x0 [0047.058] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0047.058] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.058] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.058] GetSystemMetrics (nIndex=42) returned 0 [0047.058] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.058] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.058] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0047.058] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0047.058] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0047.058] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0047.058] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0047.058] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0047.058] GetCurrentObject (hdc=0x7a0109d2, type=0x1) returned 0x1b00017 [0047.058] GetCurrentObject (hdc=0x7a0109d2, type=0x2) returned 0x1900010 [0047.058] GetCurrentObject (hdc=0x7a0109d2, type=0x7) returned 0x6d0509d7 [0047.058] GetCurrentObject (hdc=0x7a0109d2, type=0x6) returned 0x18a002e [0047.058] SaveDC (hdc=0x7a0109d2) returned 1 [0047.058] GetNearestColor (hdc=0x7a0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0047.058] RestoreDC (hdc=0x7a0109d2, nSavedDC=-1) returned 1 [0047.058] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7a0109d2) returned 0x0 [0047.059] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0047.059] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0047.059] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0047.059] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0047.059] GetCurrentObject (hdc=0x7a0109d2, type=0x1) returned 0x1b00017 [0047.059] GetCurrentObject (hdc=0x7a0109d2, type=0x2) returned 0x1900010 [0047.059] GetCurrentObject (hdc=0x7a0109d2, type=0x7) returned 0x6d0509d7 [0047.059] GetCurrentObject (hdc=0x7a0109d2, type=0x6) returned 0x18a002e [0047.059] SaveDC (hdc=0x7a0109d2) returned 1 [0047.059] GetTextAlign (hdc=0x7a0109d2) returned 0x0 [0047.059] GetTextColor (hdc=0x7a0109d2) returned 0x0 [0047.059] SetTextColor (hdc=0x7a0109d2, color=0xf0f0f0) returned 0x0 [0047.059] GetCurrentObject (hdc=0x7a0109d2, type=0x6) returned 0x18a002e [0047.059] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0047.059] SelectObject (hdc=0x7a0109d2, h=0x260a09ba) returned 0x18a002e [0047.059] GetBkMode (hdc=0x7a0109d2) returned 2 [0047.059] SetBkMode (hdc=0x7a0109d2, mode=1) returned 2 [0047.059] DrawTextExW (in: hdc=0x7a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26affa8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0047.059] DrawTextExW (in: hdc=0x7a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26affa8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0047.060] RestoreDC (hdc=0x7a0109d2, nSavedDC=-1) returned 1 [0047.060] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7a0109d2) returned 0x0 [0047.060] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0047.060] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x7a0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0047.060] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7a0109d2) returned 0x0 [0047.060] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0047.060] SelectObject (hdc=0x7a0109d2, h=0x185000f) returned 0x6d0509d7 [0047.060] DeleteDC (hdc=0x7a0109d2) returned 1 [0047.060] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0047.060] DeleteObject (ho=0x6d0509d7) returned 1 [0047.063] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0047.063] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.063] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.063] WaitMessage () returned 1 [0047.191] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.191] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.191] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.191] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.191] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.191] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0047.191] GetCurrentThreadId () returned 0xa28 [0047.191] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0047.191] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.191] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.191] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.191] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.191] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.191] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0047.192] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0047.192] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffac0109c0 [0047.192] GetObjectType (h=0x60109d6) returned 0x3 [0047.192] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x6e0509d7 [0047.192] GetDIBits (in: hdc=0x60109d6, hbm=0x6e0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.192] GetDIBits (in: hdc=0x60109d6, hbm=0x6e0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.192] DeleteObject (ho=0x6e0509d7) returned 1 [0047.192] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x7b0509d2 [0047.192] SelectObject (hdc=0xffffffffac0109c0, h=0x7b0509d2) returned 0x185000f [0047.192] GdipCreateFromHDC (hdc=0xffffffffac0109c0, graphics=0x26e408) returned 0x0 [0047.192] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0047.192] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0047.192] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0047.192] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0047.193] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0047.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0047.193] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d51a0) returned 0x0 [0047.193] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0047.193] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0047.193] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0047.193] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0047.193] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0047.193] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0047.193] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.193] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.193] GetSystemMetrics (nIndex=42) returned 0 [0047.193] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.193] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.193] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0047.193] IsAppThemed () returned 0x1 [0047.193] GetThemeAppProperties () returned 0x3 [0047.193] GetThemeAppProperties () returned 0x3 [0047.193] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0047.193] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0047.193] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0047.193] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0047.193] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0047.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0047.193] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d51a0) returned 0x0 [0047.193] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0047.193] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0047.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d51a0 [0047.193] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d51a0) returned 0x0 [0047.194] LocalFree (hMem=0x1a7d51a0) returned 0x0 [0047.194] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0047.194] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0047.194] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0047.194] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0047.194] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0047.194] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0047.194] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x1) returned 0x1b00017 [0047.194] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x2) returned 0x1900010 [0047.194] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x7) returned 0x7b0509d2 [0047.194] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x6) returned 0x18a002e [0047.194] SaveDC (hdc=0xffffffffac0109c0) returned 1 [0047.194] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffcc0409ff [0047.194] GetClipRgn (hdc=0xffffffffac0109c0, hrgn=0xffffffffcc0409ff) returned 0 [0047.194] SelectClipRgn (hdc=0xffffffffac0109c0, hrgn=0xffffffffa60409f1) returned 2 [0047.194] DeleteObject (ho=0xffffffffcc0409ff) returned 1 [0047.194] DeleteObject (ho=0xffffffffa60409f1) returned 1 [0047.194] OffsetViewportOrgEx (in: hdc=0xffffffffac0109c0, x=0, y=0, lppt=0x26b6658 | out: lppt=0x26b6658) returned 1 [0047.194] OffsetViewportOrgEx (in: hdc=0xffffffffac0109c0, x=-417, y=-278, lppt=0x26b6670 | out: lppt=0x26b6670) returned 1 [0047.194] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0047.194] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x1) returned 0x1b00017 [0047.194] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x2) returned 0x1900010 [0047.194] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x7) returned 0x7b0509d2 [0047.194] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x6) returned 0x18a002e [0047.194] SaveDC (hdc=0xffffffffac0109c0) returned 2 [0047.194] GetNearestColor (hdc=0xffffffffac0109c0, color=0x6c4607) returned 0x6c4607 [0047.194] CreateSolidBrush (color=0x6c4607) returned 0xffffffff8b100276 [0047.194] FillRect (hDC=0xffffffffac0109c0, lprc=0x26de08, hbr=0xffffffff8b100276) returned 1 [0047.201] DeleteObject (ho=0xffffffff8b100276) returned 1 [0047.201] RestoreDC (hdc=0xffffffffac0109c0, nSavedDC=-1) returned 1 [0047.201] RestoreDC (hdc=0xffffffffac0109c0, nSavedDC=-1) returned 1 [0047.201] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffac0109c0) returned 0x0 [0047.201] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd200dbd) returned 0x0 [0047.201] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0047.201] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.201] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.201] GetSystemMetrics (nIndex=42) returned 0 [0047.201] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.201] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.201] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1) returned 0x0 [0047.202] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0047.202] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0047.202] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0047.202] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0047.202] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0047.202] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0047.202] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x1) returned 0x1b00017 [0047.202] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x2) returned 0x1900010 [0047.202] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x7) returned 0x7b0509d2 [0047.202] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x6) returned 0x18a002e [0047.202] SaveDC (hdc=0xffffffffac0109c0) returned 1 [0047.202] GetNearestColor (hdc=0xffffffffac0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0047.203] RestoreDC (hdc=0xffffffffac0109c0, nSavedDC=-1) returned 1 [0047.203] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffac0109c0) returned 0x0 [0047.203] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0047.203] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0047.203] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0047.203] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0047.203] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x1) returned 0x1b00017 [0047.203] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x2) returned 0x1900010 [0047.203] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x7) returned 0x7b0509d2 [0047.203] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x6) returned 0x18a002e [0047.203] SaveDC (hdc=0xffffffffac0109c0) returned 1 [0047.203] GetTextAlign (hdc=0xffffffffac0109c0) returned 0x0 [0047.203] GetTextColor (hdc=0xffffffffac0109c0) returned 0x0 [0047.203] SetTextColor (hdc=0xffffffffac0109c0, color=0xf0f0f0) returned 0x0 [0047.203] GetCurrentObject (hdc=0xffffffffac0109c0, type=0x6) returned 0x18a002e [0047.204] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0047.204] SelectObject (hdc=0xffffffffac0109c0, h=0x260a09ba) returned 0x18a002e [0047.204] GetBkMode (hdc=0xffffffffac0109c0) returned 2 [0047.204] SetBkMode (hdc=0xffffffffac0109c0, mode=1) returned 2 [0047.204] DrawTextExW (in: hdc=0xffffffffac0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26b7458 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0047.204] DrawTextExW (in: hdc=0xffffffffac0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26b7458 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0047.204] RestoreDC (hdc=0xffffffffac0109c0, nSavedDC=-1) returned 1 [0047.204] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffac0109c0) returned 0x0 [0047.204] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0047.204] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffac0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0047.205] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffac0109c0) returned 0x0 [0047.205] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0047.205] SelectObject (hdc=0xffffffffac0109c0, h=0x185000f) returned 0x7b0509d2 [0047.205] DeleteDC (hdc=0xffffffffac0109c0) returned 1 [0047.205] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0047.205] DeleteObject (ho=0x7b0509d2) returned 1 [0047.208] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0047.208] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.208] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.208] WaitMessage () returned 1 [0047.344] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.344] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.344] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.344] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.344] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.344] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0047.344] GetCurrentThreadId () returned 0xa28 [0047.344] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0047.344] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.344] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.344] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.344] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.344] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.344] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0047.345] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0047.345] CreateCompatibleDC (hdc=0x60109d6) returned 0x700109d7 [0047.345] GetObjectType (h=0x60109d6) returned 0x3 [0047.345] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x7c0509d2 [0047.345] GetDIBits (in: hdc=0x60109d6, hbm=0x7c0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.345] GetDIBits (in: hdc=0x60109d6, hbm=0x7c0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.345] DeleteObject (ho=0x7c0509d2) returned 1 [0047.345] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffad0509c0 [0047.345] SelectObject (hdc=0x700109d7, h=0xffffffffad0509c0) returned 0x185000f [0047.345] GdipCreateFromHDC (hdc=0x700109d7, graphics=0x26e408) returned 0x0 [0047.345] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0047.345] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0047.345] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0047.345] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0047.346] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0047.346] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d57e0 [0047.346] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d57e0) returned 0x0 [0047.346] LocalFree (hMem=0x1a7d57e0) returned 0x0 [0047.346] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0047.346] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0047.346] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0047.346] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0047.346] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0047.346] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.346] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.346] GetSystemMetrics (nIndex=42) returned 0 [0047.346] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.346] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.346] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0047.346] IsAppThemed () returned 0x1 [0047.346] GetThemeAppProperties () returned 0x3 [0047.346] GetThemeAppProperties () returned 0x3 [0047.346] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0047.346] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0047.346] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0047.346] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0047.346] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0047.346] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d57e0 [0047.346] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d57e0) returned 0x0 [0047.346] LocalFree (hMem=0x1a7d57e0) returned 0x0 [0047.346] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0047.346] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d57e0 [0047.346] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d57e0) returned 0x0 [0047.347] LocalFree (hMem=0x1a7d57e0) returned 0x0 [0047.347] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0047.347] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0047.347] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0047.347] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0047.347] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0047.347] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0047.347] GetCurrentObject (hdc=0x700109d7, type=0x1) returned 0x1b00017 [0047.347] GetCurrentObject (hdc=0x700109d7, type=0x2) returned 0x1900010 [0047.347] GetCurrentObject (hdc=0x700109d7, type=0x7) returned 0xffffffffad0509c0 [0047.347] GetCurrentObject (hdc=0x700109d7, type=0x6) returned 0x18a002e [0047.347] SaveDC (hdc=0x700109d7) returned 1 [0047.347] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa70409f1 [0047.347] GetClipRgn (hdc=0x700109d7, hrgn=0xffffffffa70409f1) returned 0 [0047.347] SelectClipRgn (hdc=0x700109d7, hrgn=0xffffffffcf0409ff) returned 2 [0047.347] DeleteObject (ho=0xffffffffa70409f1) returned 1 [0047.347] DeleteObject (ho=0xffffffffcf0409ff) returned 1 [0047.347] OffsetViewportOrgEx (in: hdc=0x700109d7, x=0, y=0, lppt=0x26c50e0 | out: lppt=0x26c50e0) returned 1 [0047.347] OffsetViewportOrgEx (in: hdc=0x700109d7, x=-417, y=-278, lppt=0x26c50f8 | out: lppt=0x26c50f8) returned 1 [0047.347] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0047.347] GetCurrentObject (hdc=0x700109d7, type=0x1) returned 0x1b00017 [0047.347] GetCurrentObject (hdc=0x700109d7, type=0x2) returned 0x1900010 [0047.347] GetCurrentObject (hdc=0x700109d7, type=0x7) returned 0xffffffffad0509c0 [0047.347] GetCurrentObject (hdc=0x700109d7, type=0x6) returned 0x18a002e [0047.347] SaveDC (hdc=0x700109d7) returned 2 [0047.347] GetNearestColor (hdc=0x700109d7, color=0x6c4607) returned 0x6c4607 [0047.348] CreateSolidBrush (color=0x6c4607) returned 0xffffffff8c100276 [0047.348] FillRect (hDC=0x700109d7, lprc=0x26de08, hbr=0xffffffff8c100276) returned 1 [0047.352] DeleteObject (ho=0xffffffff8c100276) returned 1 [0047.352] RestoreDC (hdc=0x700109d7, nSavedDC=-1) returned 1 [0047.352] RestoreDC (hdc=0x700109d7, nSavedDC=-1) returned 1 [0047.352] GdipReleaseDC (graphics=0x1b86d040, hdc=0x700109d7) returned 0x0 [0047.352] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd1e0dbd) returned 0x0 [0047.352] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0047.352] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.352] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.352] GetSystemMetrics (nIndex=42) returned 0 [0047.352] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.352] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.352] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0047.352] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0047.352] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0047.352] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0047.352] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0047.353] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0047.353] GetCurrentObject (hdc=0x700109d7, type=0x1) returned 0x1b00017 [0047.353] GetCurrentObject (hdc=0x700109d7, type=0x2) returned 0x1900010 [0047.353] GetCurrentObject (hdc=0x700109d7, type=0x7) returned 0xffffffffad0509c0 [0047.353] GetCurrentObject (hdc=0x700109d7, type=0x6) returned 0x18a002e [0047.353] SaveDC (hdc=0x700109d7) returned 1 [0047.353] GetNearestColor (hdc=0x700109d7, color=0xf0f0f0) returned 0xf0f0f0 [0047.353] RestoreDC (hdc=0x700109d7, nSavedDC=-1) returned 1 [0047.353] GdipReleaseDC (graphics=0x1b86d040, hdc=0x700109d7) returned 0x0 [0047.353] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0047.353] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0047.353] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0047.353] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0047.353] GetCurrentObject (hdc=0x700109d7, type=0x1) returned 0x1b00017 [0047.353] GetCurrentObject (hdc=0x700109d7, type=0x2) returned 0x1900010 [0047.353] GetCurrentObject (hdc=0x700109d7, type=0x7) returned 0xffffffffad0509c0 [0047.353] GetCurrentObject (hdc=0x700109d7, type=0x6) returned 0x18a002e [0047.353] SaveDC (hdc=0x700109d7) returned 1 [0047.353] GetTextAlign (hdc=0x700109d7) returned 0x0 [0047.353] GetTextColor (hdc=0x700109d7) returned 0x0 [0047.353] SetTextColor (hdc=0x700109d7, color=0xf0f0f0) returned 0x0 [0047.354] GetCurrentObject (hdc=0x700109d7, type=0x6) returned 0x18a002e [0047.354] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0047.354] SelectObject (hdc=0x700109d7, h=0x260a09ba) returned 0x18a002e [0047.354] GetBkMode (hdc=0x700109d7) returned 2 [0047.354] SetBkMode (hdc=0x700109d7, mode=1) returned 2 [0047.354] DrawTextExW (in: hdc=0x700109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c5da8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0047.354] DrawTextExW (in: hdc=0x700109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c5da8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0047.354] RestoreDC (hdc=0x700109d7, nSavedDC=-1) returned 1 [0047.354] GdipReleaseDC (graphics=0x1b86d040, hdc=0x700109d7) returned 0x0 [0047.354] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0047.354] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x700109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0047.355] GdipReleaseDC (graphics=0x1b86d040, hdc=0x700109d7) returned 0x0 [0047.355] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0047.355] SelectObject (hdc=0x700109d7, h=0x185000f) returned 0xffffffffad0509c0 [0047.355] DeleteDC (hdc=0x700109d7) returned 1 [0047.355] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0047.355] DeleteObject (ho=0xffffffffad0509c0) returned 1 [0047.358] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0047.358] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.358] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.358] WaitMessage () returned 1 [0047.485] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.485] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.485] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.485] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.485] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.485] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0047.485] GetCurrentThreadId () returned 0xa28 [0047.485] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0047.485] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.485] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.485] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.485] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.485] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.485] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0047.485] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0047.485] CreateCompatibleDC (hdc=0x60109d6) returned 0x7e0109d2 [0047.485] GetObjectType (h=0x60109d6) returned 0x3 [0047.485] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffae0509c0 [0047.485] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffae0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.485] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffae0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.486] DeleteObject (ho=0xffffffffae0509c0) returned 1 [0047.486] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x710509d7 [0047.486] SelectObject (hdc=0x7e0109d2, h=0x710509d7) returned 0x185000f [0047.486] GdipCreateFromHDC (hdc=0x7e0109d2, graphics=0x26e408) returned 0x0 [0047.486] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0047.486] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0047.486] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0047.486] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0047.486] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0047.486] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d57e0 [0047.486] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d57e0) returned 0x0 [0047.486] LocalFree (hMem=0x1a7d57e0) returned 0x0 [0047.486] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0047.486] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0047.486] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0047.486] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0047.486] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0047.486] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.486] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.486] GetSystemMetrics (nIndex=42) returned 0 [0047.486] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.487] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.487] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0047.487] IsAppThemed () returned 0x1 [0047.487] GetThemeAppProperties () returned 0x3 [0047.487] GetThemeAppProperties () returned 0x3 [0047.487] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0047.487] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0047.487] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0047.487] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0047.487] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0047.487] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d57e0 [0047.487] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d57e0) returned 0x0 [0047.487] LocalFree (hMem=0x1a7d57e0) returned 0x0 [0047.487] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0047.487] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d57e0 [0047.487] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d57e0) returned 0x0 [0047.487] LocalFree (hMem=0x1a7d57e0) returned 0x0 [0047.487] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0047.487] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0047.487] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0047.487] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0047.487] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0047.487] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0047.487] GetCurrentObject (hdc=0x7e0109d2, type=0x1) returned 0x1b00017 [0047.487] GetCurrentObject (hdc=0x7e0109d2, type=0x2) returned 0x1900010 [0047.487] GetCurrentObject (hdc=0x7e0109d2, type=0x7) returned 0x710509d7 [0047.487] GetCurrentObject (hdc=0x7e0109d2, type=0x6) returned 0x18a002e [0047.487] SaveDC (hdc=0x7e0109d2) returned 1 [0047.488] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd00409ff [0047.488] GetClipRgn (hdc=0x7e0109d2, hrgn=0xffffffffd00409ff) returned 0 [0047.488] SelectClipRgn (hdc=0x7e0109d2, hrgn=0xffffffffaa0409f1) returned 2 [0047.488] DeleteObject (ho=0xffffffffd00409ff) returned 1 [0047.488] DeleteObject (ho=0xffffffffaa0409f1) returned 1 [0047.488] OffsetViewportOrgEx (in: hdc=0x7e0109d2, x=0, y=0, lppt=0x26cc6d0 | out: lppt=0x26cc6d0) returned 1 [0047.488] OffsetViewportOrgEx (in: hdc=0x7e0109d2, x=-417, y=-278, lppt=0x26cc6e8 | out: lppt=0x26cc6e8) returned 1 [0047.488] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0047.488] GetCurrentObject (hdc=0x7e0109d2, type=0x1) returned 0x1b00017 [0047.488] GetCurrentObject (hdc=0x7e0109d2, type=0x2) returned 0x1900010 [0047.488] GetCurrentObject (hdc=0x7e0109d2, type=0x7) returned 0x710509d7 [0047.488] GetCurrentObject (hdc=0x7e0109d2, type=0x6) returned 0x18a002e [0047.488] SaveDC (hdc=0x7e0109d2) returned 2 [0047.488] GetNearestColor (hdc=0x7e0109d2, color=0x6c4607) returned 0x6c4607 [0047.488] CreateSolidBrush (color=0x6c4607) returned 0xffffffff8d100276 [0047.488] FillRect (hDC=0x7e0109d2, lprc=0x26de08, hbr=0xffffffff8d100276) returned 1 [0047.494] DeleteObject (ho=0xffffffff8d100276) returned 1 [0047.494] RestoreDC (hdc=0x7e0109d2, nSavedDC=-1) returned 1 [0047.494] RestoreDC (hdc=0x7e0109d2, nSavedDC=-1) returned 1 [0047.494] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7e0109d2) returned 0x0 [0047.494] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd1c0dbd) returned 0x0 [0047.495] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0047.495] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.495] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.495] GetSystemMetrics (nIndex=42) returned 0 [0047.495] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.495] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.495] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x3) returned 0x0 [0047.495] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0047.495] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0047.496] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0047.496] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0047.496] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0047.496] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0047.496] GetCurrentObject (hdc=0x7e0109d2, type=0x1) returned 0x1b00017 [0047.496] GetCurrentObject (hdc=0x7e0109d2, type=0x2) returned 0x1900010 [0047.496] GetCurrentObject (hdc=0x7e0109d2, type=0x7) returned 0x710509d7 [0047.496] GetCurrentObject (hdc=0x7e0109d2, type=0x6) returned 0x18a002e [0047.496] SaveDC (hdc=0x7e0109d2) returned 1 [0047.496] GetNearestColor (hdc=0x7e0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0047.496] RestoreDC (hdc=0x7e0109d2, nSavedDC=-1) returned 1 [0047.496] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7e0109d2) returned 0x0 [0047.496] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0047.496] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0047.496] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0047.496] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0047.496] GetCurrentObject (hdc=0x7e0109d2, type=0x1) returned 0x1b00017 [0047.496] GetCurrentObject (hdc=0x7e0109d2, type=0x2) returned 0x1900010 [0047.496] GetCurrentObject (hdc=0x7e0109d2, type=0x7) returned 0x710509d7 [0047.496] GetCurrentObject (hdc=0x7e0109d2, type=0x6) returned 0x18a002e [0047.497] SaveDC (hdc=0x7e0109d2) returned 1 [0047.497] GetTextAlign (hdc=0x7e0109d2) returned 0x0 [0047.497] GetTextColor (hdc=0x7e0109d2) returned 0x0 [0047.497] SetTextColor (hdc=0x7e0109d2, color=0xf0f0f0) returned 0x0 [0047.497] GetCurrentObject (hdc=0x7e0109d2, type=0x6) returned 0x18a002e [0047.497] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0047.497] SelectObject (hdc=0x7e0109d2, h=0x260a09ba) returned 0x18a002e [0047.497] GetBkMode (hdc=0x7e0109d2) returned 2 [0047.497] SetBkMode (hdc=0x7e0109d2, mode=1) returned 2 [0047.497] DrawTextExW (in: hdc=0x7e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26cd4f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0047.497] DrawTextExW (in: hdc=0x7e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26cd4f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0047.498] RestoreDC (hdc=0x7e0109d2, nSavedDC=-1) returned 1 [0047.498] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7e0109d2) returned 0x0 [0047.498] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0047.498] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x7e0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0047.498] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7e0109d2) returned 0x0 [0047.498] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0047.498] SelectObject (hdc=0x7e0109d2, h=0x185000f) returned 0x710509d7 [0047.498] DeleteDC (hdc=0x7e0109d2) returned 1 [0047.498] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0047.498] DeleteObject (ho=0x710509d7) returned 1 [0047.502] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0047.502] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.502] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.502] WaitMessage () returned 1 [0047.644] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.644] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.645] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.645] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.645] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.645] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0047.645] GetCurrentThreadId () returned 0xa28 [0047.645] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0047.645] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.645] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.645] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.645] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.645] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.645] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0047.645] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0047.645] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffb00109c0 [0047.645] GetObjectType (h=0x60109d6) returned 0x3 [0047.645] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x720509d7 [0047.645] GetDIBits (in: hdc=0x60109d6, hbm=0x720509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.645] GetDIBits (in: hdc=0x60109d6, hbm=0x720509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.645] DeleteObject (ho=0x720509d7) returned 1 [0047.645] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x7f0509d2 [0047.646] SelectObject (hdc=0xffffffffb00109c0, h=0x7f0509d2) returned 0x185000f [0047.646] GdipCreateFromHDC (hdc=0xffffffffb00109c0, graphics=0x26e408) returned 0x0 [0047.646] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0047.646] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0047.646] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0047.646] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0047.646] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0047.646] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d58a0 [0047.646] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a7d58a0) returned 0x0 [0047.646] LocalFree (hMem=0x1a7d58a0) returned 0x0 [0047.646] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0047.646] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0047.646] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0047.646] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0047.646] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0047.646] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.646] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.646] GetSystemMetrics (nIndex=42) returned 0 [0047.647] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.647] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.647] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0047.647] IsAppThemed () returned 0x1 [0047.647] GetThemeAppProperties () returned 0x3 [0047.647] GetThemeAppProperties () returned 0x3 [0047.647] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0047.647] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0047.647] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0047.647] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0047.647] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0047.647] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d58a0 [0047.647] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d58a0) returned 0x0 [0047.647] LocalFree (hMem=0x1a7d58a0) returned 0x0 [0047.647] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0047.647] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a7d58a0 [0047.647] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a7d58a0) returned 0x0 [0047.647] LocalFree (hMem=0x1a7d58a0) returned 0x0 [0047.647] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0047.647] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0047.647] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0047.647] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0047.647] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0047.647] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0047.647] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x1) returned 0x1b00017 [0047.647] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x2) returned 0x1900010 [0047.647] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x7) returned 0x7f0509d2 [0047.647] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x6) returned 0x18a002e [0047.648] SaveDC (hdc=0xffffffffb00109c0) returned 1 [0047.648] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffab0409f1 [0047.648] GetClipRgn (hdc=0xffffffffb00109c0, hrgn=0xffffffffab0409f1) returned 0 [0047.648] SelectClipRgn (hdc=0xffffffffb00109c0, hrgn=0xffffffffd30409ff) returned 2 [0047.648] DeleteObject (ho=0xffffffffab0409f1) returned 1 [0047.648] DeleteObject (ho=0xffffffffd30409ff) returned 1 [0047.648] OffsetViewportOrgEx (in: hdc=0xffffffffb00109c0, x=0, y=0, lppt=0x2737a58 | out: lppt=0x2737a58) returned 1 [0047.648] OffsetViewportOrgEx (in: hdc=0xffffffffb00109c0, x=-417, y=-278, lppt=0x2737a70 | out: lppt=0x2737a70) returned 1 [0047.648] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0047.648] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x1) returned 0x1b00017 [0047.648] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x2) returned 0x1900010 [0047.648] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x7) returned 0x7f0509d2 [0047.648] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x6) returned 0x18a002e [0047.648] SaveDC (hdc=0xffffffffb00109c0) returned 2 [0047.648] GetNearestColor (hdc=0xffffffffb00109c0, color=0x6c4607) returned 0x6c4607 [0047.648] CreateSolidBrush (color=0x6c4607) returned 0xffffffff8e100276 [0047.648] FillRect (hDC=0xffffffffb00109c0, lprc=0x26de08, hbr=0xffffffff8e100276) returned 1 [0047.654] DeleteObject (ho=0xffffffff8e100276) returned 1 [0047.654] RestoreDC (hdc=0xffffffffb00109c0, nSavedDC=-1) returned 1 [0047.655] RestoreDC (hdc=0xffffffffb00109c0, nSavedDC=-1) returned 1 [0047.655] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb00109c0) returned 0x0 [0047.655] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd1a0dbd) returned 0x0 [0047.655] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0047.655] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.655] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.655] GetSystemMetrics (nIndex=42) returned 0 [0047.655] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.655] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.655] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0047.655] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0047.655] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0047.655] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0047.655] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0047.655] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0047.655] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x1) returned 0x1b00017 [0047.655] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x2) returned 0x1900010 [0047.655] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x7) returned 0x7f0509d2 [0047.655] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x6) returned 0x18a002e [0047.655] SaveDC (hdc=0xffffffffb00109c0) returned 1 [0047.655] GetNearestColor (hdc=0xffffffffb00109c0, color=0xf0f0f0) returned 0xf0f0f0 [0047.655] RestoreDC (hdc=0xffffffffb00109c0, nSavedDC=-1) returned 1 [0047.655] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb00109c0) returned 0x0 [0047.656] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0047.656] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0047.656] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0047.656] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0047.656] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x1) returned 0x1b00017 [0047.656] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x2) returned 0x1900010 [0047.656] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x7) returned 0x7f0509d2 [0047.656] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x6) returned 0x18a002e [0047.656] SaveDC (hdc=0xffffffffb00109c0) returned 1 [0047.656] GetTextAlign (hdc=0xffffffffb00109c0) returned 0x0 [0047.656] GetTextColor (hdc=0xffffffffb00109c0) returned 0x0 [0047.656] SetTextColor (hdc=0xffffffffb00109c0, color=0xf0f0f0) returned 0x0 [0047.656] GetCurrentObject (hdc=0xffffffffb00109c0, type=0x6) returned 0x18a002e [0047.656] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0047.656] SelectObject (hdc=0xffffffffb00109c0, h=0x260a09ba) returned 0x18a002e [0047.656] GetBkMode (hdc=0xffffffffb00109c0) returned 2 [0047.656] SetBkMode (hdc=0xffffffffb00109c0, mode=1) returned 2 [0047.656] DrawTextExW (in: hdc=0xffffffffb00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2738720 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0047.657] DrawTextExW (in: hdc=0xffffffffb00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2738720 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0047.657] RestoreDC (hdc=0xffffffffb00109c0, nSavedDC=-1) returned 1 [0047.657] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb00109c0) returned 0x0 [0047.657] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0047.657] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffb00109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0047.657] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb00109c0) returned 0x0 [0047.657] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0047.657] SelectObject (hdc=0xffffffffb00109c0, h=0x185000f) returned 0x7f0509d2 [0047.658] DeleteDC (hdc=0xffffffffb00109c0) returned 1 [0047.658] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0047.658] DeleteObject (ho=0x7f0509d2) returned 1 [0047.661] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0047.661] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.661] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.661] WaitMessage () returned 1 [0047.782] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.782] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.782] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.782] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.782] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.782] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0047.782] GetCurrentThreadId () returned 0xa28 [0047.782] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0047.782] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.782] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.782] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.782] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.782] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.782] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0047.782] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0047.782] CreateCompatibleDC (hdc=0x60109d6) returned 0x740109d7 [0047.782] GetObjectType (h=0x60109d6) returned 0x3 [0047.783] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff800509d2 [0047.783] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff800509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.783] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff800509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.783] DeleteObject (ho=0xffffffff800509d2) returned 1 [0047.783] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffb10509c0 [0047.783] SelectObject (hdc=0x740109d7, h=0xffffffffb10509c0) returned 0x185000f [0047.783] GdipCreateFromHDC (hdc=0x740109d7, graphics=0x26e408) returned 0x0 [0047.783] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0047.783] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0047.783] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0047.783] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0047.783] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0047.783] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78cd70 [0047.783] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78cd70) returned 0x0 [0047.783] LocalFree (hMem=0x1a78cd70) returned 0x0 [0047.784] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0047.784] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0047.784] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0047.784] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0047.784] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0047.784] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.784] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.784] GetSystemMetrics (nIndex=42) returned 0 [0047.784] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.784] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.784] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0047.784] IsAppThemed () returned 0x1 [0047.784] GetThemeAppProperties () returned 0x3 [0047.784] GetThemeAppProperties () returned 0x3 [0047.784] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0047.784] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0047.784] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0047.784] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0047.784] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0047.784] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78cd70 [0047.784] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78cd70) returned 0x0 [0047.784] LocalFree (hMem=0x1a78cd70) returned 0x0 [0047.784] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0047.784] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78cd70 [0047.784] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78cd70) returned 0x0 [0047.784] LocalFree (hMem=0x1a78cd70) returned 0x0 [0047.784] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0047.784] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0047.784] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0047.784] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0047.785] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0047.785] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0047.785] GetCurrentObject (hdc=0x740109d7, type=0x1) returned 0x1b00017 [0047.785] GetCurrentObject (hdc=0x740109d7, type=0x2) returned 0x1900010 [0047.785] GetCurrentObject (hdc=0x740109d7, type=0x7) returned 0xffffffffb10509c0 [0047.785] GetCurrentObject (hdc=0x740109d7, type=0x6) returned 0x18a002e [0047.785] SaveDC (hdc=0x740109d7) returned 1 [0047.785] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd40409ff [0047.785] GetClipRgn (hdc=0x740109d7, hrgn=0xffffffffd40409ff) returned 0 [0047.785] SelectClipRgn (hdc=0x740109d7, hrgn=0xffffffffae0409f1) returned 2 [0047.785] DeleteObject (ho=0xffffffffd40409ff) returned 1 [0047.785] DeleteObject (ho=0xffffffffae0409f1) returned 1 [0047.785] OffsetViewportOrgEx (in: hdc=0x740109d7, x=0, y=0, lppt=0x276eb60 | out: lppt=0x276eb60) returned 1 [0047.785] OffsetViewportOrgEx (in: hdc=0x740109d7, x=-417, y=-278, lppt=0x276eb78 | out: lppt=0x276eb78) returned 1 [0047.785] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0047.785] GetCurrentObject (hdc=0x740109d7, type=0x1) returned 0x1b00017 [0047.785] GetCurrentObject (hdc=0x740109d7, type=0x2) returned 0x1900010 [0047.785] GetCurrentObject (hdc=0x740109d7, type=0x7) returned 0xffffffffb10509c0 [0047.785] GetCurrentObject (hdc=0x740109d7, type=0x6) returned 0x18a002e [0047.785] SaveDC (hdc=0x740109d7) returned 2 [0047.785] GetNearestColor (hdc=0x740109d7, color=0x6c4607) returned 0x6c4607 [0047.785] CreateSolidBrush (color=0x6c4607) returned 0xffffffff8f100276 [0047.785] FillRect (hDC=0x740109d7, lprc=0x26de08, hbr=0xffffffff8f100276) returned 1 [0047.791] DeleteObject (ho=0xffffffff8f100276) returned 1 [0047.791] RestoreDC (hdc=0x740109d7, nSavedDC=-1) returned 1 [0047.791] RestoreDC (hdc=0x740109d7, nSavedDC=-1) returned 1 [0047.791] GdipReleaseDC (graphics=0x1b86d040, hdc=0x740109d7) returned 0x0 [0047.791] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd180dbd) returned 0x0 [0047.791] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0047.792] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.792] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.792] GetSystemMetrics (nIndex=42) returned 0 [0047.792] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.792] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.792] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x5) returned 0x0 [0047.792] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0047.792] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0047.792] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0047.792] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0047.792] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0047.793] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0047.793] GetCurrentObject (hdc=0x740109d7, type=0x1) returned 0x1b00017 [0047.793] GetCurrentObject (hdc=0x740109d7, type=0x2) returned 0x1900010 [0047.793] GetCurrentObject (hdc=0x740109d7, type=0x7) returned 0xffffffffb10509c0 [0047.793] GetCurrentObject (hdc=0x740109d7, type=0x6) returned 0x18a002e [0047.793] SaveDC (hdc=0x740109d7) returned 1 [0047.793] GetNearestColor (hdc=0x740109d7, color=0xf0f0f0) returned 0xf0f0f0 [0047.793] RestoreDC (hdc=0x740109d7, nSavedDC=-1) returned 1 [0047.793] GdipReleaseDC (graphics=0x1b86d040, hdc=0x740109d7) returned 0x0 [0047.793] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0047.793] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0047.793] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0047.793] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0047.793] GetCurrentObject (hdc=0x740109d7, type=0x1) returned 0x1b00017 [0047.793] GetCurrentObject (hdc=0x740109d7, type=0x2) returned 0x1900010 [0047.793] GetCurrentObject (hdc=0x740109d7, type=0x7) returned 0xffffffffb10509c0 [0047.793] GetCurrentObject (hdc=0x740109d7, type=0x6) returned 0x18a002e [0047.793] SaveDC (hdc=0x740109d7) returned 1 [0047.793] GetTextAlign (hdc=0x740109d7) returned 0x0 [0047.793] GetTextColor (hdc=0x740109d7) returned 0x0 [0047.794] SetTextColor (hdc=0x740109d7, color=0xf0f0f0) returned 0x0 [0047.794] GetCurrentObject (hdc=0x740109d7, type=0x6) returned 0x18a002e [0047.794] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0047.794] SelectObject (hdc=0x740109d7, h=0x260a09ba) returned 0x18a002e [0047.794] GetBkMode (hdc=0x740109d7) returned 2 [0047.794] SetBkMode (hdc=0x740109d7, mode=1) returned 2 [0047.794] DrawTextExW (in: hdc=0x740109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x276f9a0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0047.794] DrawTextExW (in: hdc=0x740109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x276f9a0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0047.794] RestoreDC (hdc=0x740109d7, nSavedDC=-1) returned 1 [0047.795] GdipReleaseDC (graphics=0x1b86d040, hdc=0x740109d7) returned 0x0 [0047.795] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0047.795] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x740109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0047.795] GdipReleaseDC (graphics=0x1b86d040, hdc=0x740109d7) returned 0x0 [0047.795] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0047.795] SelectObject (hdc=0x740109d7, h=0x185000f) returned 0xffffffffb10509c0 [0047.795] DeleteDC (hdc=0x740109d7) returned 1 [0047.795] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0047.795] DeleteObject (ho=0xffffffffb10509c0) returned 1 [0047.798] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0047.799] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.799] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.799] WaitMessage () returned 1 [0047.937] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.937] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.937] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.937] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.937] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.937] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0047.937] GetCurrentThreadId () returned 0xa28 [0047.937] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0047.937] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.937] IsWindowUnicode (hWnd=0x3015e) returned 1 [0047.937] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0047.938] TranslateMessage (lpMsg=0x26ee10) returned 0 [0047.938] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0047.938] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0047.938] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0047.938] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff820109d2 [0047.938] GetObjectType (h=0x60109d6) returned 0x3 [0047.938] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffb20509c0 [0047.938] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb20509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.938] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb20509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0047.938] DeleteObject (ho=0xffffffffb20509c0) returned 1 [0047.938] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x750509d7 [0047.938] SelectObject (hdc=0xffffffff820109d2, h=0x750509d7) returned 0x185000f [0047.938] GdipCreateFromHDC (hdc=0xffffffff820109d2, graphics=0x26e408) returned 0x0 [0047.939] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0047.939] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0047.939] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0047.939] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0047.939] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0047.939] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ce70 [0047.939] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ce70) returned 0x0 [0047.939] LocalFree (hMem=0x1a78ce70) returned 0x0 [0047.939] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0047.939] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0047.939] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0047.939] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0047.939] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0047.939] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.939] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.939] GetSystemMetrics (nIndex=42) returned 0 [0047.939] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.939] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.939] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0047.939] IsAppThemed () returned 0x1 [0047.939] GetThemeAppProperties () returned 0x3 [0047.939] GetThemeAppProperties () returned 0x3 [0047.939] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0047.939] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0047.939] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0047.940] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0047.940] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0047.940] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ce70 [0047.940] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ce70) returned 0x0 [0047.940] LocalFree (hMem=0x1a78ce70) returned 0x0 [0047.940] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0047.940] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ce70 [0047.940] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ce70) returned 0x0 [0047.940] LocalFree (hMem=0x1a78ce70) returned 0x0 [0047.940] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0047.940] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0047.940] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0047.940] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0047.940] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0047.940] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0047.940] GetCurrentObject (hdc=0xffffffff820109d2, type=0x1) returned 0x1b00017 [0047.940] GetCurrentObject (hdc=0xffffffff820109d2, type=0x2) returned 0x1900010 [0047.940] GetCurrentObject (hdc=0xffffffff820109d2, type=0x7) returned 0x750509d7 [0047.940] GetCurrentObject (hdc=0xffffffff820109d2, type=0x6) returned 0x18a002e [0047.940] SaveDC (hdc=0xffffffff820109d2) returned 1 [0047.940] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffaf0409f1 [0047.940] GetClipRgn (hdc=0xffffffff820109d2, hrgn=0xffffffffaf0409f1) returned 0 [0047.940] SelectClipRgn (hdc=0xffffffff820109d2, hrgn=0xffffffffd70409ff) returned 2 [0047.940] DeleteObject (ho=0xffffffffaf0409f1) returned 1 [0047.940] DeleteObject (ho=0xffffffffd70409ff) returned 1 [0047.940] OffsetViewportOrgEx (in: hdc=0xffffffff820109d2, x=0, y=0, lppt=0x27ee0e0 | out: lppt=0x27ee0e0) returned 1 [0047.940] OffsetViewportOrgEx (in: hdc=0xffffffff820109d2, x=-417, y=-278, lppt=0x27ee0f8 | out: lppt=0x27ee0f8) returned 1 [0047.940] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0047.940] GetCurrentObject (hdc=0xffffffff820109d2, type=0x1) returned 0x1b00017 [0047.941] GetCurrentObject (hdc=0xffffffff820109d2, type=0x2) returned 0x1900010 [0047.941] GetCurrentObject (hdc=0xffffffff820109d2, type=0x7) returned 0x750509d7 [0047.941] GetCurrentObject (hdc=0xffffffff820109d2, type=0x6) returned 0x18a002e [0047.941] SaveDC (hdc=0xffffffff820109d2) returned 2 [0047.941] GetNearestColor (hdc=0xffffffff820109d2, color=0x6c4607) returned 0x6c4607 [0047.941] CreateSolidBrush (color=0x6c4607) returned 0xffffffff90100276 [0047.941] FillRect (hDC=0xffffffff820109d2, lprc=0x26de08, hbr=0xffffffff90100276) returned 1 [0047.945] DeleteObject (ho=0xffffffff90100276) returned 1 [0047.946] RestoreDC (hdc=0xffffffff820109d2, nSavedDC=-1) returned 1 [0047.946] RestoreDC (hdc=0xffffffff820109d2, nSavedDC=-1) returned 1 [0047.946] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff820109d2) returned 0x0 [0047.946] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd160dbd) returned 0x0 [0047.946] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0047.946] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0047.946] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0047.946] GetSystemMetrics (nIndex=42) returned 0 [0047.946] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0047.946] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0047.946] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0047.946] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0047.946] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0047.946] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0047.946] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0047.946] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0047.946] GetCurrentObject (hdc=0xffffffff820109d2, type=0x1) returned 0x1b00017 [0047.946] GetCurrentObject (hdc=0xffffffff820109d2, type=0x2) returned 0x1900010 [0047.946] GetCurrentObject (hdc=0xffffffff820109d2, type=0x7) returned 0x750509d7 [0047.946] GetCurrentObject (hdc=0xffffffff820109d2, type=0x6) returned 0x18a002e [0047.946] SaveDC (hdc=0xffffffff820109d2) returned 1 [0047.946] GetNearestColor (hdc=0xffffffff820109d2, color=0xf0f0f0) returned 0xf0f0f0 [0047.946] RestoreDC (hdc=0xffffffff820109d2, nSavedDC=-1) returned 1 [0047.946] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff820109d2) returned 0x0 [0047.947] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0047.947] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0047.947] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0047.947] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0047.947] GetCurrentObject (hdc=0xffffffff820109d2, type=0x1) returned 0x1b00017 [0047.947] GetCurrentObject (hdc=0xffffffff820109d2, type=0x2) returned 0x1900010 [0047.947] GetCurrentObject (hdc=0xffffffff820109d2, type=0x7) returned 0x750509d7 [0047.947] GetCurrentObject (hdc=0xffffffff820109d2, type=0x6) returned 0x18a002e [0047.947] SaveDC (hdc=0xffffffff820109d2) returned 1 [0047.947] GetTextAlign (hdc=0xffffffff820109d2) returned 0x0 [0047.947] GetTextColor (hdc=0xffffffff820109d2) returned 0x0 [0047.947] SetTextColor (hdc=0xffffffff820109d2, color=0xf0f0f0) returned 0x0 [0047.947] GetCurrentObject (hdc=0xffffffff820109d2, type=0x6) returned 0x18a002e [0047.947] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0047.947] SelectObject (hdc=0xffffffff820109d2, h=0x260a09ba) returned 0x18a002e [0047.947] GetBkMode (hdc=0xffffffff820109d2) returned 2 [0047.947] SetBkMode (hdc=0xffffffff820109d2, mode=1) returned 2 [0047.947] DrawTextExW (in: hdc=0xffffffff820109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27eeda8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0047.948] DrawTextExW (in: hdc=0xffffffff820109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27eeda8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0047.948] RestoreDC (hdc=0xffffffff820109d2, nSavedDC=-1) returned 1 [0047.948] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff820109d2) returned 0x0 [0047.948] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0047.948] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff820109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0047.948] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff820109d2) returned 0x0 [0047.948] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0047.948] SelectObject (hdc=0xffffffff820109d2, h=0x185000f) returned 0x750509d7 [0047.948] DeleteDC (hdc=0xffffffff820109d2) returned 1 [0047.949] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0047.949] DeleteObject (ho=0x750509d7) returned 1 [0047.952] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0047.952] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.952] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0047.952] WaitMessage () returned 1 [0048.119] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.119] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.119] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.119] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.119] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.119] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0048.119] GetCurrentThreadId () returned 0xa28 [0048.119] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0048.119] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.119] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.119] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.119] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.119] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.119] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0048.120] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0048.120] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffb40109c0 [0048.120] GetObjectType (h=0x60109d6) returned 0x3 [0048.120] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x760509d7 [0048.120] GetDIBits (in: hdc=0x60109d6, hbm=0x760509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.120] GetDIBits (in: hdc=0x60109d6, hbm=0x760509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.120] DeleteObject (ho=0x760509d7) returned 1 [0048.120] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff830509d2 [0048.120] SelectObject (hdc=0xffffffffb40109c0, h=0xffffffff830509d2) returned 0x185000f [0048.120] GdipCreateFromHDC (hdc=0xffffffffb40109c0, graphics=0x26e408) returned 0x0 [0048.120] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0048.120] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0048.120] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0048.120] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0048.120] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0048.120] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ce70 [0048.121] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ce70) returned 0x0 [0048.121] LocalFree (hMem=0x1a78ce70) returned 0x0 [0048.121] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0048.121] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0048.121] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0048.121] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0048.121] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0048.121] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.121] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.121] GetSystemMetrics (nIndex=42) returned 0 [0048.121] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.121] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.121] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0048.121] IsAppThemed () returned 0x1 [0048.121] GetThemeAppProperties () returned 0x3 [0048.121] GetThemeAppProperties () returned 0x3 [0048.121] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0048.121] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0048.121] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0048.121] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0048.121] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0048.121] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ce70 [0048.121] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ce70) returned 0x0 [0048.121] LocalFree (hMem=0x1a78ce70) returned 0x0 [0048.121] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0048.121] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ce70 [0048.121] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ce70) returned 0x0 [0048.121] LocalFree (hMem=0x1a78ce70) returned 0x0 [0048.121] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0048.121] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0048.121] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0048.122] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0048.122] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0048.122] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0048.122] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x1) returned 0x1b00017 [0048.122] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x2) returned 0x1900010 [0048.122] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x7) returned 0xffffffff830509d2 [0048.122] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x6) returned 0x18a002e [0048.122] SaveDC (hdc=0xffffffffb40109c0) returned 1 [0048.122] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd80409ff [0048.122] GetClipRgn (hdc=0xffffffffb40109c0, hrgn=0xffffffffd80409ff) returned 0 [0048.122] SelectClipRgn (hdc=0xffffffffb40109c0, hrgn=0xffffffffb20409f1) returned 2 [0048.122] DeleteObject (ho=0xffffffffd80409ff) returned 1 [0048.122] DeleteObject (ho=0xffffffffb20409f1) returned 1 [0048.122] OffsetViewportOrgEx (in: hdc=0xffffffffb40109c0, x=0, y=0, lppt=0x26e2750 | out: lppt=0x26e2750) returned 1 [0048.122] OffsetViewportOrgEx (in: hdc=0xffffffffb40109c0, x=-417, y=-278, lppt=0x26e2768 | out: lppt=0x26e2768) returned 1 [0048.122] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0048.122] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x1) returned 0x1b00017 [0048.122] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x2) returned 0x1900010 [0048.122] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x7) returned 0xffffffff830509d2 [0048.122] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x6) returned 0x18a002e [0048.122] SaveDC (hdc=0xffffffffb40109c0) returned 2 [0048.122] GetNearestColor (hdc=0xffffffffb40109c0, color=0x6c4607) returned 0x6c4607 [0048.122] CreateSolidBrush (color=0x6c4607) returned 0xffffffff91100276 [0048.122] FillRect (hDC=0xffffffffb40109c0, lprc=0x26de08, hbr=0xffffffff91100276) returned 1 [0048.128] DeleteObject (ho=0xffffffff91100276) returned 1 [0048.128] RestoreDC (hdc=0xffffffffb40109c0, nSavedDC=-1) returned 1 [0048.128] RestoreDC (hdc=0xffffffffb40109c0, nSavedDC=-1) returned 1 [0048.128] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb40109c0) returned 0x0 [0048.128] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd140dbd) returned 0x0 [0048.128] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0048.128] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.128] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.128] GetSystemMetrics (nIndex=42) returned 0 [0048.128] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.128] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.129] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x7) returned 0x0 [0048.129] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0048.129] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0048.129] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0048.129] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0048.129] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0048.129] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0048.129] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x1) returned 0x1b00017 [0048.129] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x2) returned 0x1900010 [0048.129] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x7) returned 0xffffffff830509d2 [0048.129] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x6) returned 0x18a002e [0048.129] SaveDC (hdc=0xffffffffb40109c0) returned 1 [0048.130] GetNearestColor (hdc=0xffffffffb40109c0, color=0xf0f0f0) returned 0xf0f0f0 [0048.130] RestoreDC (hdc=0xffffffffb40109c0, nSavedDC=-1) returned 1 [0048.130] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb40109c0) returned 0x0 [0048.130] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0048.130] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0048.130] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0048.130] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0048.130] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x1) returned 0x1b00017 [0048.130] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x2) returned 0x1900010 [0048.130] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x7) returned 0xffffffff830509d2 [0048.130] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x6) returned 0x18a002e [0048.130] SaveDC (hdc=0xffffffffb40109c0) returned 1 [0048.130] GetTextAlign (hdc=0xffffffffb40109c0) returned 0x0 [0048.130] GetTextColor (hdc=0xffffffffb40109c0) returned 0x0 [0048.130] SetTextColor (hdc=0xffffffffb40109c0, color=0xf0f0f0) returned 0x0 [0048.130] GetCurrentObject (hdc=0xffffffffb40109c0, type=0x6) returned 0x18a002e [0048.130] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0048.130] SelectObject (hdc=0xffffffffb40109c0, h=0x260a09ba) returned 0x18a002e [0048.130] GetBkMode (hdc=0xffffffffb40109c0) returned 2 [0048.130] SetBkMode (hdc=0xffffffffb40109c0, mode=1) returned 2 [0048.130] DrawTextExW (in: hdc=0xffffffffb40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26e35b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0048.131] DrawTextExW (in: hdc=0xffffffffb40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26e35b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0048.131] RestoreDC (hdc=0xffffffffb40109c0, nSavedDC=-1) returned 1 [0048.131] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb40109c0) returned 0x0 [0048.131] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0048.131] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffb40109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0048.131] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb40109c0) returned 0x0 [0048.131] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0048.131] SelectObject (hdc=0xffffffffb40109c0, h=0x185000f) returned 0xffffffff830509d2 [0048.132] DeleteDC (hdc=0xffffffffb40109c0) returned 1 [0048.132] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0048.132] DeleteObject (ho=0xffffffff830509d2) returned 1 [0048.135] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0048.135] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.135] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.135] WaitMessage () returned 1 [0048.332] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.332] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.332] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.332] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.332] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.332] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0048.332] GetCurrentThreadId () returned 0xa28 [0048.332] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0048.332] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.332] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.332] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.332] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.332] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.332] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0048.333] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0048.333] CreateCompatibleDC (hdc=0x60109d6) returned 0x780109d7 [0048.333] GetObjectType (h=0x60109d6) returned 0x3 [0048.333] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff840509d2 [0048.333] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff840509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.333] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff840509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.333] DeleteObject (ho=0xffffffff840509d2) returned 1 [0048.333] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffb50509c0 [0048.333] SelectObject (hdc=0x780109d7, h=0xffffffffb50509c0) returned 0x185000f [0048.333] GdipCreateFromHDC (hdc=0x780109d7, graphics=0x26e408) returned 0x0 [0048.334] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0048.334] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0048.334] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0048.334] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0048.334] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0048.334] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.334] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0048.334] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.334] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0048.334] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0048.334] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0048.334] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0048.335] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0048.335] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.335] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.335] GetSystemMetrics (nIndex=42) returned 0 [0048.335] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.335] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.335] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0048.335] IsAppThemed () returned 0x1 [0048.335] GetThemeAppProperties () returned 0x3 [0048.335] GetThemeAppProperties () returned 0x3 [0048.335] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0048.335] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0048.335] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0048.335] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0048.335] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0048.335] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.335] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0048.335] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.335] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0048.335] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.335] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0048.335] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.335] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0048.335] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0048.335] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0048.335] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0048.336] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0048.336] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0048.336] GetCurrentObject (hdc=0x780109d7, type=0x1) returned 0x1b00017 [0048.336] GetCurrentObject (hdc=0x780109d7, type=0x2) returned 0x1900010 [0048.336] GetCurrentObject (hdc=0x780109d7, type=0x7) returned 0xffffffffb50509c0 [0048.336] GetCurrentObject (hdc=0x780109d7, type=0x6) returned 0x18a002e [0048.336] SaveDC (hdc=0x780109d7) returned 1 [0048.336] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb30409f1 [0048.336] GetClipRgn (hdc=0x780109d7, hrgn=0xffffffffb30409f1) returned 0 [0048.336] SelectClipRgn (hdc=0x780109d7, hrgn=0xffffffffdb0409ff) returned 2 [0048.336] DeleteObject (ho=0xffffffffb30409f1) returned 1 [0048.336] DeleteObject (ho=0xffffffffdb0409ff) returned 1 [0048.336] OffsetViewportOrgEx (in: hdc=0x780109d7, x=0, y=0, lppt=0x27117e8 | out: lppt=0x27117e8) returned 1 [0048.336] OffsetViewportOrgEx (in: hdc=0x780109d7, x=-417, y=-278, lppt=0x2711800 | out: lppt=0x2711800) returned 1 [0048.336] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0048.336] GetCurrentObject (hdc=0x780109d7, type=0x1) returned 0x1b00017 [0048.336] GetCurrentObject (hdc=0x780109d7, type=0x2) returned 0x1900010 [0048.336] GetCurrentObject (hdc=0x780109d7, type=0x7) returned 0xffffffffb50509c0 [0048.336] GetCurrentObject (hdc=0x780109d7, type=0x6) returned 0x18a002e [0048.336] SaveDC (hdc=0x780109d7) returned 2 [0048.336] GetNearestColor (hdc=0x780109d7, color=0x6c4607) returned 0x6c4607 [0048.336] CreateSolidBrush (color=0x6c4607) returned 0xffffffff92100276 [0048.336] FillRect (hDC=0x780109d7, lprc=0x26de08, hbr=0xffffffff92100276) returned 1 [0048.343] DeleteObject (ho=0xffffffff92100276) returned 1 [0048.343] RestoreDC (hdc=0x780109d7, nSavedDC=-1) returned 1 [0048.343] RestoreDC (hdc=0x780109d7, nSavedDC=-1) returned 1 [0048.343] GdipReleaseDC (graphics=0x1b86d040, hdc=0x780109d7) returned 0x0 [0048.343] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd120dbd) returned 0x0 [0048.343] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0048.343] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.343] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.343] GetSystemMetrics (nIndex=42) returned 0 [0048.343] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.343] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.343] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0048.343] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0048.343] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0048.343] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0048.343] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0048.344] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0048.344] GetCurrentObject (hdc=0x780109d7, type=0x1) returned 0x1b00017 [0048.344] GetCurrentObject (hdc=0x780109d7, type=0x2) returned 0x1900010 [0048.344] GetCurrentObject (hdc=0x780109d7, type=0x7) returned 0xffffffffb50509c0 [0048.344] GetCurrentObject (hdc=0x780109d7, type=0x6) returned 0x18a002e [0048.344] SaveDC (hdc=0x780109d7) returned 1 [0048.344] GetNearestColor (hdc=0x780109d7, color=0xf0f0f0) returned 0xf0f0f0 [0048.344] RestoreDC (hdc=0x780109d7, nSavedDC=-1) returned 1 [0048.344] GdipReleaseDC (graphics=0x1b86d040, hdc=0x780109d7) returned 0x0 [0048.344] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0048.344] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0048.344] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0048.344] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0048.344] GetCurrentObject (hdc=0x780109d7, type=0x1) returned 0x1b00017 [0048.344] GetCurrentObject (hdc=0x780109d7, type=0x2) returned 0x1900010 [0048.344] GetCurrentObject (hdc=0x780109d7, type=0x7) returned 0xffffffffb50509c0 [0048.344] GetCurrentObject (hdc=0x780109d7, type=0x6) returned 0x18a002e [0048.344] SaveDC (hdc=0x780109d7) returned 1 [0048.345] GetTextAlign (hdc=0x780109d7) returned 0x0 [0048.345] GetTextColor (hdc=0x780109d7) returned 0x0 [0048.345] SetTextColor (hdc=0x780109d7, color=0xf0f0f0) returned 0x0 [0048.345] GetCurrentObject (hdc=0x780109d7, type=0x6) returned 0x18a002e [0048.345] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0048.345] SelectObject (hdc=0x780109d7, h=0x260a09ba) returned 0x18a002e [0048.345] GetBkMode (hdc=0x780109d7) returned 2 [0048.345] SetBkMode (hdc=0x780109d7, mode=1) returned 2 [0048.345] DrawTextExW (in: hdc=0x780109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27124b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0048.346] DrawTextExW (in: hdc=0x780109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27124b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0048.346] RestoreDC (hdc=0x780109d7, nSavedDC=-1) returned 1 [0048.346] GdipReleaseDC (graphics=0x1b86d040, hdc=0x780109d7) returned 0x0 [0048.346] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0048.346] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x780109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0048.347] GdipReleaseDC (graphics=0x1b86d040, hdc=0x780109d7) returned 0x0 [0048.347] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0048.347] SelectObject (hdc=0x780109d7, h=0x185000f) returned 0xffffffffb50509c0 [0048.347] DeleteDC (hdc=0x780109d7) returned 1 [0048.347] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0048.347] DeleteObject (ho=0xffffffffb50509c0) returned 1 [0048.350] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0048.350] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.350] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.350] WaitMessage () returned 1 [0048.636] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.636] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.636] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.637] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.637] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.637] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0048.637] GetCurrentThreadId () returned 0xa28 [0048.637] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0048.637] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.637] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.637] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.637] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.637] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.637] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0048.637] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0048.637] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff860109d2 [0048.637] GetObjectType (h=0x60109d6) returned 0x3 [0048.637] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffb60509c0 [0048.637] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb60509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.637] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb60509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.637] DeleteObject (ho=0xffffffffb60509c0) returned 1 [0048.638] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x790509d7 [0048.638] SelectObject (hdc=0xffffffff860109d2, h=0x790509d7) returned 0x185000f [0048.638] GdipCreateFromHDC (hdc=0xffffffff860109d2, graphics=0x26e408) returned 0x0 [0048.638] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0048.638] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0048.638] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0048.638] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0048.638] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0048.638] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.638] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0048.638] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.638] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0048.638] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0048.638] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0048.638] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0048.638] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0048.638] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.638] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.639] GetSystemMetrics (nIndex=42) returned 0 [0048.639] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.639] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.639] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0048.639] IsAppThemed () returned 0x1 [0048.639] GetThemeAppProperties () returned 0x3 [0048.639] GetThemeAppProperties () returned 0x3 [0048.639] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0048.639] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0048.639] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0048.639] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0048.639] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0048.639] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.639] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0048.639] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.639] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0048.639] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.639] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0048.639] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.639] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0048.639] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0048.639] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0048.639] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0048.639] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0048.639] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0048.639] GetCurrentObject (hdc=0xffffffff860109d2, type=0x1) returned 0x1b00017 [0048.639] GetCurrentObject (hdc=0xffffffff860109d2, type=0x2) returned 0x1900010 [0048.639] GetCurrentObject (hdc=0xffffffff860109d2, type=0x7) returned 0x790509d7 [0048.639] GetCurrentObject (hdc=0xffffffff860109d2, type=0x6) returned 0x18a002e [0048.640] SaveDC (hdc=0xffffffff860109d2) returned 1 [0048.640] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffdc0409ff [0048.640] GetClipRgn (hdc=0xffffffff860109d2, hrgn=0xffffffffdc0409ff) returned 0 [0048.640] SelectClipRgn (hdc=0xffffffff860109d2, hrgn=0xffffffffb60409f1) returned 2 [0048.640] DeleteObject (ho=0xffffffffdc0409ff) returned 1 [0048.640] DeleteObject (ho=0xffffffffb60409f1) returned 1 [0048.640] OffsetViewportOrgEx (in: hdc=0xffffffff860109d2, x=0, y=0, lppt=0x26d6648 | out: lppt=0x26d6648) returned 1 [0048.640] OffsetViewportOrgEx (in: hdc=0xffffffff860109d2, x=-417, y=-278, lppt=0x26d6660 | out: lppt=0x26d6660) returned 1 [0048.640] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0048.640] GetCurrentObject (hdc=0xffffffff860109d2, type=0x1) returned 0x1b00017 [0048.640] GetCurrentObject (hdc=0xffffffff860109d2, type=0x2) returned 0x1900010 [0048.640] GetCurrentObject (hdc=0xffffffff860109d2, type=0x7) returned 0x790509d7 [0048.640] GetCurrentObject (hdc=0xffffffff860109d2, type=0x6) returned 0x18a002e [0048.640] SaveDC (hdc=0xffffffff860109d2) returned 2 [0048.640] GetNearestColor (hdc=0xffffffff860109d2, color=0x6c4607) returned 0x6c4607 [0048.640] CreateSolidBrush (color=0x6c4607) returned 0xffffffff93100276 [0048.640] FillRect (hDC=0xffffffff860109d2, lprc=0x26de08, hbr=0xffffffff93100276) returned 1 [0048.646] DeleteObject (ho=0xffffffff93100276) returned 1 [0048.646] RestoreDC (hdc=0xffffffff860109d2, nSavedDC=-1) returned 1 [0048.646] RestoreDC (hdc=0xffffffff860109d2, nSavedDC=-1) returned 1 [0048.646] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff860109d2) returned 0x0 [0048.646] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd100dbd) returned 0x0 [0048.646] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0048.646] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.646] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.646] GetSystemMetrics (nIndex=42) returned 0 [0048.646] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.646] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.646] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x9) returned 0x0 [0048.648] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0048.648] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0048.648] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0048.648] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0048.648] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0048.649] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0048.649] GetCurrentObject (hdc=0xffffffff860109d2, type=0x1) returned 0x1b00017 [0048.649] GetCurrentObject (hdc=0xffffffff860109d2, type=0x2) returned 0x1900010 [0048.649] GetCurrentObject (hdc=0xffffffff860109d2, type=0x7) returned 0x790509d7 [0048.649] GetCurrentObject (hdc=0xffffffff860109d2, type=0x6) returned 0x18a002e [0048.649] SaveDC (hdc=0xffffffff860109d2) returned 1 [0048.649] GetNearestColor (hdc=0xffffffff860109d2, color=0xf0f0f0) returned 0xf0f0f0 [0048.649] RestoreDC (hdc=0xffffffff860109d2, nSavedDC=-1) returned 1 [0048.649] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff860109d2) returned 0x0 [0048.649] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0048.649] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0048.649] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0048.649] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0048.649] GetCurrentObject (hdc=0xffffffff860109d2, type=0x1) returned 0x1b00017 [0048.649] GetCurrentObject (hdc=0xffffffff860109d2, type=0x2) returned 0x1900010 [0048.649] GetCurrentObject (hdc=0xffffffff860109d2, type=0x7) returned 0x790509d7 [0048.649] GetCurrentObject (hdc=0xffffffff860109d2, type=0x6) returned 0x18a002e [0048.649] SaveDC (hdc=0xffffffff860109d2) returned 1 [0048.650] GetTextAlign (hdc=0xffffffff860109d2) returned 0x0 [0048.650] GetTextColor (hdc=0xffffffff860109d2) returned 0x0 [0048.650] SetTextColor (hdc=0xffffffff860109d2, color=0xf0f0f0) returned 0x0 [0048.650] GetCurrentObject (hdc=0xffffffff860109d2, type=0x6) returned 0x18a002e [0048.650] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0048.650] SelectObject (hdc=0xffffffff860109d2, h=0x260a09ba) returned 0x18a002e [0048.650] GetBkMode (hdc=0xffffffff860109d2) returned 2 [0048.650] SetBkMode (hdc=0xffffffff860109d2, mode=1) returned 2 [0048.650] DrawTextExW (in: hdc=0xffffffff860109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26d74d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0048.650] DrawTextExW (in: hdc=0xffffffff860109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26d74d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0048.650] RestoreDC (hdc=0xffffffff860109d2, nSavedDC=-1) returned 1 [0048.650] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff860109d2) returned 0x0 [0048.650] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0048.650] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff860109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0048.651] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff860109d2) returned 0x0 [0048.651] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0048.651] SelectObject (hdc=0xffffffff860109d2, h=0x185000f) returned 0x790509d7 [0048.651] DeleteDC (hdc=0xffffffff860109d2) returned 1 [0048.651] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0048.651] DeleteObject (ho=0x790509d7) returned 1 [0048.654] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0048.654] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.654] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.654] WaitMessage () returned 1 [0048.811] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.811] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.811] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.811] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.811] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.811] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0048.811] GetCurrentThreadId () returned 0xa28 [0048.811] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0048.811] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.811] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.811] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.811] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.811] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.811] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0048.811] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0048.811] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffb80109c0 [0048.811] GetObjectType (h=0x60109d6) returned 0x3 [0048.812] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x7a0509d7 [0048.812] GetDIBits (in: hdc=0x60109d6, hbm=0x7a0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.812] GetDIBits (in: hdc=0x60109d6, hbm=0x7a0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.812] DeleteObject (ho=0x7a0509d7) returned 1 [0048.812] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff870509d2 [0048.812] SelectObject (hdc=0xffffffffb80109c0, h=0xffffffff870509d2) returned 0x185000f [0048.812] GdipCreateFromHDC (hdc=0xffffffffb80109c0, graphics=0x26e408) returned 0x0 [0048.812] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0048.812] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0048.812] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0048.812] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0048.812] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0048.812] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.812] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0048.812] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.812] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0048.812] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0048.813] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0048.813] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0048.813] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0048.813] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.813] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.813] GetSystemMetrics (nIndex=42) returned 0 [0048.813] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.813] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.813] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0048.813] IsAppThemed () returned 0x1 [0048.813] GetThemeAppProperties () returned 0x3 [0048.813] GetThemeAppProperties () returned 0x3 [0048.813] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0048.813] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0048.813] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0048.813] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0048.813] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0048.813] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.813] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0048.813] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.813] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0048.813] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.813] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0048.813] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.813] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0048.813] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0048.813] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0048.813] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0048.813] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0048.813] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0048.813] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x1) returned 0x1b00017 [0048.814] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x2) returned 0x1900010 [0048.814] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x7) returned 0xffffffff870509d2 [0048.814] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x6) returned 0x18a002e [0048.814] SaveDC (hdc=0xffffffffb80109c0) returned 1 [0048.814] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb70409f1 [0048.814] GetClipRgn (hdc=0xffffffffb80109c0, hrgn=0xffffffffb70409f1) returned 0 [0048.814] SelectClipRgn (hdc=0xffffffffb80109c0, hrgn=0xffffffffdf0409ff) returned 2 [0048.814] DeleteObject (ho=0xffffffffb70409f1) returned 1 [0048.814] DeleteObject (ho=0xffffffffdf0409ff) returned 1 [0048.814] OffsetViewportOrgEx (in: hdc=0xffffffffb80109c0, x=0, y=0, lppt=0x26f1370 | out: lppt=0x26f1370) returned 1 [0048.814] OffsetViewportOrgEx (in: hdc=0xffffffffb80109c0, x=-417, y=-278, lppt=0x26f1388 | out: lppt=0x26f1388) returned 1 [0048.814] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0048.814] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x1) returned 0x1b00017 [0048.814] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x2) returned 0x1900010 [0048.814] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x7) returned 0xffffffff870509d2 [0048.814] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x6) returned 0x18a002e [0048.814] SaveDC (hdc=0xffffffffb80109c0) returned 2 [0048.814] GetNearestColor (hdc=0xffffffffb80109c0, color=0x6c4607) returned 0x6c4607 [0048.814] CreateSolidBrush (color=0x6c4607) returned 0xffffffff94100276 [0048.814] FillRect (hDC=0xffffffffb80109c0, lprc=0x26de08, hbr=0xffffffff94100276) returned 1 [0048.820] DeleteObject (ho=0xffffffff94100276) returned 1 [0048.820] RestoreDC (hdc=0xffffffffb80109c0, nSavedDC=-1) returned 1 [0048.821] RestoreDC (hdc=0xffffffffb80109c0, nSavedDC=-1) returned 1 [0048.821] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb80109c0) returned 0x0 [0048.821] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd0e0dbd) returned 0x0 [0048.821] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0048.821] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.821] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.821] GetSystemMetrics (nIndex=42) returned 0 [0048.821] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.821] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.821] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0048.821] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0048.821] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0048.821] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0048.821] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0048.821] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0048.821] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x1) returned 0x1b00017 [0048.821] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x2) returned 0x1900010 [0048.821] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x7) returned 0xffffffff870509d2 [0048.821] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x6) returned 0x18a002e [0048.821] SaveDC (hdc=0xffffffffb80109c0) returned 1 [0048.821] GetNearestColor (hdc=0xffffffffb80109c0, color=0xf0f0f0) returned 0xf0f0f0 [0048.821] RestoreDC (hdc=0xffffffffb80109c0, nSavedDC=-1) returned 1 [0048.821] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb80109c0) returned 0x0 [0048.822] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0048.822] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0048.822] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0048.822] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0048.822] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x1) returned 0x1b00017 [0048.822] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x2) returned 0x1900010 [0048.822] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x7) returned 0xffffffff870509d2 [0048.822] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x6) returned 0x18a002e [0048.822] SaveDC (hdc=0xffffffffb80109c0) returned 1 [0048.822] GetTextAlign (hdc=0xffffffffb80109c0) returned 0x0 [0048.822] GetTextColor (hdc=0xffffffffb80109c0) returned 0x0 [0048.822] SetTextColor (hdc=0xffffffffb80109c0, color=0xf0f0f0) returned 0x0 [0048.822] GetCurrentObject (hdc=0xffffffffb80109c0, type=0x6) returned 0x18a002e [0048.822] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0048.822] SelectObject (hdc=0xffffffffb80109c0, h=0x260a09ba) returned 0x18a002e [0048.822] GetBkMode (hdc=0xffffffffb80109c0) returned 2 [0048.822] SetBkMode (hdc=0xffffffffb80109c0, mode=1) returned 2 [0048.822] DrawTextExW (in: hdc=0xffffffffb80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26f2038 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0048.822] DrawTextExW (in: hdc=0xffffffffb80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26f2038 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0048.823] RestoreDC (hdc=0xffffffffb80109c0, nSavedDC=-1) returned 1 [0048.823] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb80109c0) returned 0x0 [0048.823] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0048.823] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffb80109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0048.823] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb80109c0) returned 0x0 [0048.823] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0048.823] SelectObject (hdc=0xffffffffb80109c0, h=0x185000f) returned 0xffffffff870509d2 [0048.823] DeleteDC (hdc=0xffffffffb80109c0) returned 1 [0048.823] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0048.823] DeleteObject (ho=0xffffffff870509d2) returned 1 [0048.827] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0048.827] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.827] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.827] WaitMessage () returned 1 [0048.966] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.967] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.967] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.967] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.967] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.967] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0048.967] GetCurrentThreadId () returned 0xa28 [0048.967] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0048.967] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.967] IsWindowUnicode (hWnd=0x3015e) returned 1 [0048.967] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0048.967] TranslateMessage (lpMsg=0x26ee10) returned 0 [0048.967] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0048.967] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0048.967] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0048.967] CreateCompatibleDC (hdc=0x60109d6) returned 0x7c0109d7 [0048.967] GetObjectType (h=0x60109d6) returned 0x3 [0048.967] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff880509d2 [0048.967] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff880509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.967] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff880509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0048.968] DeleteObject (ho=0xffffffff880509d2) returned 1 [0048.968] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffb90509c0 [0048.968] SelectObject (hdc=0x7c0109d7, h=0xffffffffb90509c0) returned 0x185000f [0048.968] GdipCreateFromHDC (hdc=0x7c0109d7, graphics=0x26e408) returned 0x0 [0048.968] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0048.968] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0048.968] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0048.968] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0048.968] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0048.968] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.968] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0048.968] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.968] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0048.968] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0048.968] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0048.968] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0048.968] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0048.968] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.968] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.968] GetSystemMetrics (nIndex=42) returned 0 [0048.968] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.968] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.968] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0048.968] IsAppThemed () returned 0x1 [0048.968] GetThemeAppProperties () returned 0x3 [0048.969] GetThemeAppProperties () returned 0x3 [0048.969] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0048.969] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0048.969] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0048.969] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0048.969] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0048.969] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.969] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0048.969] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.969] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0048.969] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0048.969] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0048.969] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0048.969] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0048.969] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0048.969] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0048.969] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0048.969] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0048.969] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0048.969] GetCurrentObject (hdc=0x7c0109d7, type=0x1) returned 0x1b00017 [0048.969] GetCurrentObject (hdc=0x7c0109d7, type=0x2) returned 0x1900010 [0048.969] GetCurrentObject (hdc=0x7c0109d7, type=0x7) returned 0xffffffffb90509c0 [0048.969] GetCurrentObject (hdc=0x7c0109d7, type=0x6) returned 0x18a002e [0048.969] SaveDC (hdc=0x7c0109d7) returned 1 [0048.969] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe00409ff [0048.969] GetClipRgn (hdc=0x7c0109d7, hrgn=0xffffffffe00409ff) returned 0 [0048.969] SelectClipRgn (hdc=0x7c0109d7, hrgn=0xffffffffba0409f1) returned 2 [0048.969] DeleteObject (ho=0xffffffffe00409ff) returned 1 [0048.969] DeleteObject (ho=0xffffffffba0409f1) returned 1 [0048.969] OffsetViewportOrgEx (in: hdc=0x7c0109d7, x=0, y=0, lppt=0x29582b8 | out: lppt=0x29582b8) returned 1 [0048.969] OffsetViewportOrgEx (in: hdc=0x7c0109d7, x=-417, y=-278, lppt=0x29582d0 | out: lppt=0x29582d0) returned 1 [0048.969] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0048.969] GetCurrentObject (hdc=0x7c0109d7, type=0x1) returned 0x1b00017 [0048.970] GetCurrentObject (hdc=0x7c0109d7, type=0x2) returned 0x1900010 [0048.970] GetCurrentObject (hdc=0x7c0109d7, type=0x7) returned 0xffffffffb90509c0 [0048.970] GetCurrentObject (hdc=0x7c0109d7, type=0x6) returned 0x18a002e [0048.970] SaveDC (hdc=0x7c0109d7) returned 2 [0048.970] GetNearestColor (hdc=0x7c0109d7, color=0x6c4607) returned 0x6c4607 [0048.970] CreateSolidBrush (color=0x6c4607) returned 0xffffffff95100276 [0048.970] FillRect (hDC=0x7c0109d7, lprc=0x26de08, hbr=0xffffffff95100276) returned 1 [0048.976] DeleteObject (ho=0xffffffff95100276) returned 1 [0048.976] RestoreDC (hdc=0x7c0109d7, nSavedDC=-1) returned 1 [0048.976] RestoreDC (hdc=0x7c0109d7, nSavedDC=-1) returned 1 [0048.976] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7c0109d7) returned 0x0 [0048.976] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd0c0dbd) returned 0x0 [0048.976] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0048.976] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0048.976] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0048.976] GetSystemMetrics (nIndex=42) returned 0 [0048.976] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0048.976] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0048.976] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xb) returned 0x0 [0048.977] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0048.977] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0048.977] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0048.977] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0048.977] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0048.977] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0048.977] GetCurrentObject (hdc=0x7c0109d7, type=0x1) returned 0x1b00017 [0048.977] GetCurrentObject (hdc=0x7c0109d7, type=0x2) returned 0x1900010 [0048.977] GetCurrentObject (hdc=0x7c0109d7, type=0x7) returned 0xffffffffb90509c0 [0048.977] GetCurrentObject (hdc=0x7c0109d7, type=0x6) returned 0x18a002e [0048.977] SaveDC (hdc=0x7c0109d7) returned 1 [0048.977] GetNearestColor (hdc=0x7c0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0048.977] RestoreDC (hdc=0x7c0109d7, nSavedDC=-1) returned 1 [0048.977] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7c0109d7) returned 0x0 [0048.978] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0048.978] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0048.978] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0048.978] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0048.978] GetCurrentObject (hdc=0x7c0109d7, type=0x1) returned 0x1b00017 [0048.978] GetCurrentObject (hdc=0x7c0109d7, type=0x2) returned 0x1900010 [0048.978] GetCurrentObject (hdc=0x7c0109d7, type=0x7) returned 0xffffffffb90509c0 [0048.978] GetCurrentObject (hdc=0x7c0109d7, type=0x6) returned 0x18a002e [0048.978] SaveDC (hdc=0x7c0109d7) returned 1 [0048.978] GetTextAlign (hdc=0x7c0109d7) returned 0x0 [0048.978] GetTextColor (hdc=0x7c0109d7) returned 0x0 [0048.978] SetTextColor (hdc=0x7c0109d7, color=0xf0f0f0) returned 0x0 [0048.978] GetCurrentObject (hdc=0x7c0109d7, type=0x6) returned 0x18a002e [0048.978] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0048.978] SelectObject (hdc=0x7c0109d7, h=0x260a09ba) returned 0x18a002e [0048.978] GetBkMode (hdc=0x7c0109d7) returned 2 [0048.978] SetBkMode (hdc=0x7c0109d7, mode=1) returned 2 [0048.978] DrawTextExW (in: hdc=0x7c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2959150 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0048.979] DrawTextExW (in: hdc=0x7c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2959150 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0048.979] RestoreDC (hdc=0x7c0109d7, nSavedDC=-1) returned 1 [0048.979] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7c0109d7) returned 0x0 [0048.979] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0048.979] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x7c0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0048.979] GdipReleaseDC (graphics=0x1b86d040, hdc=0x7c0109d7) returned 0x0 [0048.979] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0048.979] SelectObject (hdc=0x7c0109d7, h=0x185000f) returned 0xffffffffb90509c0 [0048.979] DeleteDC (hdc=0x7c0109d7) returned 1 [0048.980] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0048.980] DeleteObject (ho=0xffffffffb90509c0) returned 1 [0048.983] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0048.983] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.983] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0048.983] WaitMessage () returned 1 [0049.139] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.139] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.139] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.140] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.140] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.140] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0049.140] GetCurrentThreadId () returned 0xa28 [0049.140] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0049.140] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.140] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.140] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.140] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.140] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.140] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0049.140] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0049.140] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff8a0109d2 [0049.140] GetObjectType (h=0x60109d6) returned 0x3 [0049.140] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffba0509c0 [0049.140] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffba0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.141] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffba0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.141] DeleteObject (ho=0xffffffffba0509c0) returned 1 [0049.141] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x7d0509d7 [0049.141] SelectObject (hdc=0xffffffff8a0109d2, h=0x7d0509d7) returned 0x185000f [0049.141] GdipCreateFromHDC (hdc=0xffffffff8a0109d2, graphics=0x26e408) returned 0x0 [0049.141] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0049.141] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0049.141] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0049.141] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0049.141] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0049.141] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.141] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0049.141] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.141] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0049.141] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0049.141] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0049.141] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0049.141] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0049.141] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.141] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.142] GetSystemMetrics (nIndex=42) returned 0 [0049.142] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.142] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.142] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0049.142] IsAppThemed () returned 0x1 [0049.142] GetThemeAppProperties () returned 0x3 [0049.142] GetThemeAppProperties () returned 0x3 [0049.142] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0049.142] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0049.142] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0049.142] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0049.142] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0049.142] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.142] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.142] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.142] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0049.142] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.142] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.142] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.142] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0049.142] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0049.142] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0049.142] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0049.142] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0049.142] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0049.142] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x1) returned 0x1b00017 [0049.142] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x2) returned 0x1900010 [0049.142] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x7) returned 0x7d0509d7 [0049.142] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x6) returned 0x18a002e [0049.142] SaveDC (hdc=0xffffffff8a0109d2) returned 1 [0049.142] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffbb0409f1 [0049.143] GetClipRgn (hdc=0xffffffff8a0109d2, hrgn=0xffffffffbb0409f1) returned 0 [0049.143] SelectClipRgn (hdc=0xffffffff8a0109d2, hrgn=0xffffffffe30409ff) returned 2 [0049.143] DeleteObject (ho=0xffffffffbb0409f1) returned 1 [0049.143] DeleteObject (ho=0xffffffffe30409ff) returned 1 [0049.143] OffsetViewportOrgEx (in: hdc=0xffffffff8a0109d2, x=0, y=0, lppt=0x274eed0 | out: lppt=0x274eed0) returned 1 [0049.143] OffsetViewportOrgEx (in: hdc=0xffffffff8a0109d2, x=-417, y=-278, lppt=0x274eee8 | out: lppt=0x274eee8) returned 1 [0049.143] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0049.143] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x1) returned 0x1b00017 [0049.143] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x2) returned 0x1900010 [0049.143] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x7) returned 0x7d0509d7 [0049.143] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x6) returned 0x18a002e [0049.143] SaveDC (hdc=0xffffffff8a0109d2) returned 2 [0049.143] GetNearestColor (hdc=0xffffffff8a0109d2, color=0x6c4607) returned 0x6c4607 [0049.143] CreateSolidBrush (color=0x6c4607) returned 0xffffffff96100276 [0049.143] FillRect (hDC=0xffffffff8a0109d2, lprc=0x26de08, hbr=0xffffffff96100276) returned 1 [0049.149] DeleteObject (ho=0xffffffff96100276) returned 1 [0049.149] RestoreDC (hdc=0xffffffff8a0109d2, nSavedDC=-1) returned 1 [0049.150] RestoreDC (hdc=0xffffffff8a0109d2, nSavedDC=-1) returned 1 [0049.150] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8a0109d2) returned 0x0 [0049.150] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd0a0dbd) returned 0x0 [0049.150] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0049.150] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.150] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.150] GetSystemMetrics (nIndex=42) returned 0 [0049.150] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.150] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.150] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0049.150] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0049.150] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0049.150] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0049.150] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0049.150] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0049.150] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x1) returned 0x1b00017 [0049.150] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x2) returned 0x1900010 [0049.150] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x7) returned 0x7d0509d7 [0049.150] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x6) returned 0x18a002e [0049.150] SaveDC (hdc=0xffffffff8a0109d2) returned 1 [0049.150] GetNearestColor (hdc=0xffffffff8a0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0049.150] RestoreDC (hdc=0xffffffff8a0109d2, nSavedDC=-1) returned 1 [0049.150] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8a0109d2) returned 0x0 [0049.151] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0049.151] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0049.151] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0049.151] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0049.151] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x1) returned 0x1b00017 [0049.151] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x2) returned 0x1900010 [0049.151] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x7) returned 0x7d0509d7 [0049.151] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x6) returned 0x18a002e [0049.151] SaveDC (hdc=0xffffffff8a0109d2) returned 1 [0049.151] GetTextAlign (hdc=0xffffffff8a0109d2) returned 0x0 [0049.151] GetTextColor (hdc=0xffffffff8a0109d2) returned 0x0 [0049.151] SetTextColor (hdc=0xffffffff8a0109d2, color=0xf0f0f0) returned 0x0 [0049.151] GetCurrentObject (hdc=0xffffffff8a0109d2, type=0x6) returned 0x18a002e [0049.151] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0049.151] SelectObject (hdc=0xffffffff8a0109d2, h=0x260a09ba) returned 0x18a002e [0049.151] GetBkMode (hdc=0xffffffff8a0109d2) returned 2 [0049.151] SetBkMode (hdc=0xffffffff8a0109d2, mode=1) returned 2 [0049.151] DrawTextExW (in: hdc=0xffffffff8a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x274fb98 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0049.151] DrawTextExW (in: hdc=0xffffffff8a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x274fb98 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0049.152] RestoreDC (hdc=0xffffffff8a0109d2, nSavedDC=-1) returned 1 [0049.152] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8a0109d2) returned 0x0 [0049.152] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0049.152] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff8a0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0049.152] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8a0109d2) returned 0x0 [0049.152] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0049.152] SelectObject (hdc=0xffffffff8a0109d2, h=0x185000f) returned 0x7d0509d7 [0049.152] DeleteDC (hdc=0xffffffff8a0109d2) returned 1 [0049.152] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0049.152] DeleteObject (ho=0x7d0509d7) returned 1 [0049.159] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0049.159] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.159] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.159] WaitMessage () returned 1 [0049.417] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.417] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.417] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.417] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.417] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.417] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0049.417] GetCurrentThreadId () returned 0xa28 [0049.417] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0049.417] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.417] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.417] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.417] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.417] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.417] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0049.418] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0049.418] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffbc0109c0 [0049.418] GetObjectType (h=0x60109d6) returned 0x3 [0049.418] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x7e0509d7 [0049.418] GetDIBits (in: hdc=0x60109d6, hbm=0x7e0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.418] GetDIBits (in: hdc=0x60109d6, hbm=0x7e0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.418] DeleteObject (ho=0x7e0509d7) returned 1 [0049.418] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff8b0509d2 [0049.419] SelectObject (hdc=0xffffffffbc0109c0, h=0xffffffff8b0509d2) returned 0x185000f [0049.419] GdipCreateFromHDC (hdc=0xffffffffbc0109c0, graphics=0x26e408) returned 0x0 [0049.419] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0049.419] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0049.419] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0049.419] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0049.419] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0049.419] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.419] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0049.419] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.419] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0049.419] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0049.419] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0049.419] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0049.419] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0049.419] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.419] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.420] GetSystemMetrics (nIndex=42) returned 0 [0049.420] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.420] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.420] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0049.420] IsAppThemed () returned 0x1 [0049.420] GetThemeAppProperties () returned 0x3 [0049.420] GetThemeAppProperties () returned 0x3 [0049.420] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0049.420] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0049.420] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0049.420] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0049.420] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0049.420] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.420] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.420] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.420] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0049.420] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.420] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.420] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.420] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0049.420] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0049.420] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0049.420] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0049.420] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0049.420] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0049.420] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x1) returned 0x1b00017 [0049.420] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x2) returned 0x1900010 [0049.420] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x7) returned 0xffffffff8b0509d2 [0049.420] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x6) returned 0x18a002e [0049.420] SaveDC (hdc=0xffffffffbc0109c0) returned 1 [0049.421] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe40409ff [0049.421] GetClipRgn (hdc=0xffffffffbc0109c0, hrgn=0xffffffffe40409ff) returned 0 [0049.421] SelectClipRgn (hdc=0xffffffffbc0109c0, hrgn=0xffffffffbe0409f1) returned 2 [0049.421] DeleteObject (ho=0xffffffffe40409ff) returned 1 [0049.421] DeleteObject (ho=0xffffffffbe0409f1) returned 1 [0049.421] OffsetViewportOrgEx (in: hdc=0xffffffffbc0109c0, x=0, y=0, lppt=0x26df030 | out: lppt=0x26df030) returned 1 [0049.421] OffsetViewportOrgEx (in: hdc=0xffffffffbc0109c0, x=-417, y=-278, lppt=0x26df048 | out: lppt=0x26df048) returned 1 [0049.421] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0049.421] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x1) returned 0x1b00017 [0049.421] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x2) returned 0x1900010 [0049.421] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x7) returned 0xffffffff8b0509d2 [0049.421] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x6) returned 0x18a002e [0049.421] SaveDC (hdc=0xffffffffbc0109c0) returned 2 [0049.421] GetNearestColor (hdc=0xffffffffbc0109c0, color=0x6c4607) returned 0x6c4607 [0049.421] CreateSolidBrush (color=0x6c4607) returned 0xffffffff97100276 [0049.421] FillRect (hDC=0xffffffffbc0109c0, lprc=0x26de08, hbr=0xffffffff97100276) returned 1 [0049.428] DeleteObject (ho=0xffffffff97100276) returned 1 [0049.428] RestoreDC (hdc=0xffffffffbc0109c0, nSavedDC=-1) returned 1 [0049.428] RestoreDC (hdc=0xffffffffbc0109c0, nSavedDC=-1) returned 1 [0049.428] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbc0109c0) returned 0x0 [0049.428] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd080dbd) returned 0x0 [0049.428] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0049.428] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.428] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.428] GetSystemMetrics (nIndex=42) returned 0 [0049.428] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.428] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.428] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xd) returned 0x0 [0049.432] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0049.432] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0049.432] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0049.432] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0049.432] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0049.432] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0049.432] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x1) returned 0x1b00017 [0049.432] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x2) returned 0x1900010 [0049.432] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x7) returned 0xffffffff8b0509d2 [0049.432] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x6) returned 0x18a002e [0049.432] SaveDC (hdc=0xffffffffbc0109c0) returned 1 [0049.432] GetNearestColor (hdc=0xffffffffbc0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0049.432] RestoreDC (hdc=0xffffffffbc0109c0, nSavedDC=-1) returned 1 [0049.432] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbc0109c0) returned 0x0 [0049.432] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0049.432] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0049.432] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0049.433] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0049.433] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x1) returned 0x1b00017 [0049.433] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x2) returned 0x1900010 [0049.433] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x7) returned 0xffffffff8b0509d2 [0049.433] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x6) returned 0x18a002e [0049.433] SaveDC (hdc=0xffffffffbc0109c0) returned 1 [0049.433] GetTextAlign (hdc=0xffffffffbc0109c0) returned 0x0 [0049.433] GetTextColor (hdc=0xffffffffbc0109c0) returned 0x0 [0049.433] SetTextColor (hdc=0xffffffffbc0109c0, color=0xf0f0f0) returned 0x0 [0049.433] GetCurrentObject (hdc=0xffffffffbc0109c0, type=0x6) returned 0x18a002e [0049.433] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0049.433] SelectObject (hdc=0xffffffffbc0109c0, h=0x260a09ba) returned 0x18a002e [0049.433] GetBkMode (hdc=0xffffffffbc0109c0) returned 2 [0049.433] SetBkMode (hdc=0xffffffffbc0109c0, mode=1) returned 2 [0049.433] DrawTextExW (in: hdc=0xffffffffbc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26dff08 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0049.433] DrawTextExW (in: hdc=0xffffffffbc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26dff08 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0049.434] RestoreDC (hdc=0xffffffffbc0109c0, nSavedDC=-1) returned 1 [0049.434] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbc0109c0) returned 0x0 [0049.434] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0049.434] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffbc0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0049.439] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbc0109c0) returned 0x0 [0049.439] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0049.439] SelectObject (hdc=0xffffffffbc0109c0, h=0x185000f) returned 0xffffffff8b0509d2 [0049.439] DeleteDC (hdc=0xffffffffbc0109c0) returned 1 [0049.439] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0049.439] DeleteObject (ho=0xffffffff8b0509d2) returned 1 [0049.442] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0049.442] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.442] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.442] WaitMessage () returned 1 [0049.590] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.590] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.590] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.590] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.590] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.590] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0049.590] GetCurrentThreadId () returned 0xa28 [0049.590] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0049.591] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.591] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.591] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.591] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.591] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.591] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0049.591] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0049.591] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff800109d7 [0049.591] GetObjectType (h=0x60109d6) returned 0x3 [0049.591] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff8c0509d2 [0049.591] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8c0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.591] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8c0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.591] DeleteObject (ho=0xffffffff8c0509d2) returned 1 [0049.591] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffbd0509c0 [0049.591] SelectObject (hdc=0xffffffff800109d7, h=0xffffffffbd0509c0) returned 0x185000f [0049.591] GdipCreateFromHDC (hdc=0xffffffff800109d7, graphics=0x26e408) returned 0x0 [0049.592] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0049.592] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0049.592] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0049.592] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0049.592] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0049.592] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.592] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0049.592] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.592] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0049.592] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0049.592] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0049.592] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0049.592] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0049.592] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.592] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.592] GetSystemMetrics (nIndex=42) returned 0 [0049.592] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.592] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.592] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0049.592] IsAppThemed () returned 0x1 [0049.592] GetThemeAppProperties () returned 0x3 [0049.592] GetThemeAppProperties () returned 0x3 [0049.592] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0049.592] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0049.592] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0049.592] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0049.592] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0049.592] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.592] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.592] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.593] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0049.593] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.593] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.593] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.593] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0049.593] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0049.593] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0049.593] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0049.593] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0049.593] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0049.593] GetCurrentObject (hdc=0xffffffff800109d7, type=0x1) returned 0x1b00017 [0049.593] GetCurrentObject (hdc=0xffffffff800109d7, type=0x2) returned 0x1900010 [0049.593] GetCurrentObject (hdc=0xffffffff800109d7, type=0x7) returned 0xffffffffbd0509c0 [0049.593] GetCurrentObject (hdc=0xffffffff800109d7, type=0x6) returned 0x18a002e [0049.593] SaveDC (hdc=0xffffffff800109d7) returned 1 [0049.593] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffbf0409f1 [0049.593] GetClipRgn (hdc=0xffffffff800109d7, hrgn=0xffffffffbf0409f1) returned 0 [0049.593] SelectClipRgn (hdc=0xffffffff800109d7, hrgn=0xffffffffe70409ff) returned 2 [0049.593] DeleteObject (ho=0xffffffffbf0409f1) returned 1 [0049.593] DeleteObject (ho=0xffffffffe70409ff) returned 1 [0049.593] OffsetViewportOrgEx (in: hdc=0xffffffff800109d7, x=0, y=0, lppt=0x2753510 | out: lppt=0x2753510) returned 1 [0049.593] OffsetViewportOrgEx (in: hdc=0xffffffff800109d7, x=-417, y=-278, lppt=0x2753528 | out: lppt=0x2753528) returned 1 [0049.593] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0049.593] GetCurrentObject (hdc=0xffffffff800109d7, type=0x1) returned 0x1b00017 [0049.593] GetCurrentObject (hdc=0xffffffff800109d7, type=0x2) returned 0x1900010 [0049.593] GetCurrentObject (hdc=0xffffffff800109d7, type=0x7) returned 0xffffffffbd0509c0 [0049.593] GetCurrentObject (hdc=0xffffffff800109d7, type=0x6) returned 0x18a002e [0049.593] SaveDC (hdc=0xffffffff800109d7) returned 2 [0049.593] GetNearestColor (hdc=0xffffffff800109d7, color=0x6c4607) returned 0x6c4607 [0049.594] CreateSolidBrush (color=0x6c4607) returned 0xffffffff98100276 [0049.594] FillRect (hDC=0xffffffff800109d7, lprc=0x26de08, hbr=0xffffffff98100276) returned 1 [0049.600] DeleteObject (ho=0xffffffff98100276) returned 1 [0049.600] RestoreDC (hdc=0xffffffff800109d7, nSavedDC=-1) returned 1 [0049.600] RestoreDC (hdc=0xffffffff800109d7, nSavedDC=-1) returned 1 [0049.600] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff800109d7) returned 0x0 [0049.600] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd060dbd) returned 0x0 [0049.600] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0049.600] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.600] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.600] GetSystemMetrics (nIndex=42) returned 0 [0049.600] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.600] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.600] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0049.600] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0049.600] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0049.600] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0049.600] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0049.600] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0049.600] GetCurrentObject (hdc=0xffffffff800109d7, type=0x1) returned 0x1b00017 [0049.600] GetCurrentObject (hdc=0xffffffff800109d7, type=0x2) returned 0x1900010 [0049.600] GetCurrentObject (hdc=0xffffffff800109d7, type=0x7) returned 0xffffffffbd0509c0 [0049.600] GetCurrentObject (hdc=0xffffffff800109d7, type=0x6) returned 0x18a002e [0049.601] SaveDC (hdc=0xffffffff800109d7) returned 1 [0049.601] GetNearestColor (hdc=0xffffffff800109d7, color=0xf0f0f0) returned 0xf0f0f0 [0049.601] RestoreDC (hdc=0xffffffff800109d7, nSavedDC=-1) returned 1 [0049.601] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff800109d7) returned 0x0 [0049.601] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0049.601] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0049.601] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0049.601] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0049.601] GetCurrentObject (hdc=0xffffffff800109d7, type=0x1) returned 0x1b00017 [0049.601] GetCurrentObject (hdc=0xffffffff800109d7, type=0x2) returned 0x1900010 [0049.601] GetCurrentObject (hdc=0xffffffff800109d7, type=0x7) returned 0xffffffffbd0509c0 [0049.601] GetCurrentObject (hdc=0xffffffff800109d7, type=0x6) returned 0x18a002e [0049.601] SaveDC (hdc=0xffffffff800109d7) returned 1 [0049.601] GetTextAlign (hdc=0xffffffff800109d7) returned 0x0 [0049.601] GetTextColor (hdc=0xffffffff800109d7) returned 0x0 [0049.601] SetTextColor (hdc=0xffffffff800109d7, color=0xf0f0f0) returned 0x0 [0049.601] GetCurrentObject (hdc=0xffffffff800109d7, type=0x6) returned 0x18a002e [0049.601] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0049.601] SelectObject (hdc=0xffffffff800109d7, h=0x260a09ba) returned 0x18a002e [0049.601] GetBkMode (hdc=0xffffffff800109d7) returned 2 [0049.601] SetBkMode (hdc=0xffffffff800109d7, mode=1) returned 2 [0049.601] DrawTextExW (in: hdc=0xffffffff800109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27541d8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0049.602] DrawTextExW (in: hdc=0xffffffff800109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27541d8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0049.602] RestoreDC (hdc=0xffffffff800109d7, nSavedDC=-1) returned 1 [0049.602] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff800109d7) returned 0x0 [0049.602] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0049.602] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff800109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0049.602] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff800109d7) returned 0x0 [0049.602] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0049.603] SelectObject (hdc=0xffffffff800109d7, h=0x185000f) returned 0xffffffffbd0509c0 [0049.603] DeleteDC (hdc=0xffffffff800109d7) returned 1 [0049.603] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0049.603] DeleteObject (ho=0xffffffffbd0509c0) returned 1 [0049.606] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0049.606] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.606] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.606] WaitMessage () returned 1 [0049.731] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.731] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.731] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.731] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.731] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.731] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0049.731] GetCurrentThreadId () returned 0xa28 [0049.731] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0049.731] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.731] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.731] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.731] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.731] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.731] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0049.731] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0049.731] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff8e0109d2 [0049.732] GetObjectType (h=0x60109d6) returned 0x3 [0049.732] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffbe0509c0 [0049.732] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffbe0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.732] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffbe0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.732] DeleteObject (ho=0xffffffffbe0509c0) returned 1 [0049.732] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff810509d7 [0049.732] SelectObject (hdc=0xffffffff8e0109d2, h=0xffffffff810509d7) returned 0x185000f [0049.732] GdipCreateFromHDC (hdc=0xffffffff8e0109d2, graphics=0x26e408) returned 0x0 [0049.732] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0049.732] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0049.732] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0049.732] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0049.732] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0049.732] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.732] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0049.732] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.732] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0049.732] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0049.732] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0049.732] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0049.733] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0049.733] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.733] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.733] GetSystemMetrics (nIndex=42) returned 0 [0049.733] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.733] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.733] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0049.733] IsAppThemed () returned 0x1 [0049.733] GetThemeAppProperties () returned 0x3 [0049.733] GetThemeAppProperties () returned 0x3 [0049.733] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0049.733] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0049.733] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0049.733] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0049.733] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0049.733] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.733] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.733] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.733] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0049.733] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.733] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.733] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.733] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0049.733] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0049.733] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0049.733] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0049.733] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0049.733] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0049.733] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x1) returned 0x1b00017 [0049.733] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x2) returned 0x1900010 [0049.733] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x7) returned 0xffffffff810509d7 [0049.734] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x6) returned 0x18a002e [0049.734] SaveDC (hdc=0xffffffff8e0109d2) returned 1 [0049.734] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe80409ff [0049.734] GetClipRgn (hdc=0xffffffff8e0109d2, hrgn=0xffffffffe80409ff) returned 0 [0049.734] SelectClipRgn (hdc=0xffffffff8e0109d2, hrgn=0xffffffffc20409f1) returned 2 [0049.734] DeleteObject (ho=0xffffffffe80409ff) returned 1 [0049.734] DeleteObject (ho=0xffffffffc20409f1) returned 1 [0049.734] OffsetViewportOrgEx (in: hdc=0xffffffff8e0109d2, x=0, y=0, lppt=0x27a2620 | out: lppt=0x27a2620) returned 1 [0049.734] OffsetViewportOrgEx (in: hdc=0xffffffff8e0109d2, x=-417, y=-278, lppt=0x27a2638 | out: lppt=0x27a2638) returned 1 [0049.734] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0049.734] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x1) returned 0x1b00017 [0049.734] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x2) returned 0x1900010 [0049.734] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x7) returned 0xffffffff810509d7 [0049.734] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x6) returned 0x18a002e [0049.734] SaveDC (hdc=0xffffffff8e0109d2) returned 2 [0049.734] GetNearestColor (hdc=0xffffffff8e0109d2, color=0x6c4607) returned 0x6c4607 [0049.734] CreateSolidBrush (color=0x6c4607) returned 0xffffffff99100276 [0049.734] FillRect (hDC=0xffffffff8e0109d2, lprc=0x26de08, hbr=0xffffffff99100276) returned 1 [0049.741] DeleteObject (ho=0xffffffff99100276) returned 1 [0049.741] RestoreDC (hdc=0xffffffff8e0109d2, nSavedDC=-1) returned 1 [0049.741] RestoreDC (hdc=0xffffffff8e0109d2, nSavedDC=-1) returned 1 [0049.741] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8e0109d2) returned 0x0 [0049.741] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd040dbd) returned 0x0 [0049.741] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0049.741] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.741] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.741] GetSystemMetrics (nIndex=42) returned 0 [0049.741] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.741] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.741] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xf) returned 0x0 [0049.742] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0049.742] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0049.742] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0049.742] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0049.742] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0049.742] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0049.742] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x1) returned 0x1b00017 [0049.742] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x2) returned 0x1900010 [0049.742] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x7) returned 0xffffffff810509d7 [0049.742] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x6) returned 0x18a002e [0049.742] SaveDC (hdc=0xffffffff8e0109d2) returned 1 [0049.742] GetNearestColor (hdc=0xffffffff8e0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0049.742] RestoreDC (hdc=0xffffffff8e0109d2, nSavedDC=-1) returned 1 [0049.742] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8e0109d2) returned 0x0 [0049.742] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0049.742] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0049.742] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0049.742] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0049.742] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x1) returned 0x1b00017 [0049.742] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x2) returned 0x1900010 [0049.743] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x7) returned 0xffffffff810509d7 [0049.743] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x6) returned 0x18a002e [0049.743] SaveDC (hdc=0xffffffff8e0109d2) returned 1 [0049.743] GetTextAlign (hdc=0xffffffff8e0109d2) returned 0x0 [0049.743] GetTextColor (hdc=0xffffffff8e0109d2) returned 0x0 [0049.743] SetTextColor (hdc=0xffffffff8e0109d2, color=0xf0f0f0) returned 0x0 [0049.743] GetCurrentObject (hdc=0xffffffff8e0109d2, type=0x6) returned 0x18a002e [0049.743] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0049.743] SelectObject (hdc=0xffffffff8e0109d2, h=0x260a09ba) returned 0x18a002e [0049.743] GetBkMode (hdc=0xffffffff8e0109d2) returned 2 [0049.743] SetBkMode (hdc=0xffffffff8e0109d2, mode=1) returned 2 [0049.743] DrawTextExW (in: hdc=0xffffffff8e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27a34e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0049.743] DrawTextExW (in: hdc=0xffffffff8e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27a34e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0049.744] RestoreDC (hdc=0xffffffff8e0109d2, nSavedDC=-1) returned 1 [0049.744] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8e0109d2) returned 0x0 [0049.744] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0049.744] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff8e0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0049.744] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8e0109d2) returned 0x0 [0049.744] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0049.744] SelectObject (hdc=0xffffffff8e0109d2, h=0x185000f) returned 0xffffffff810509d7 [0049.744] DeleteDC (hdc=0xffffffff8e0109d2) returned 1 [0049.744] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0049.744] DeleteObject (ho=0xffffffff810509d7) returned 1 [0049.747] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0049.747] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.747] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.747] WaitMessage () returned 1 [0049.924] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.924] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.924] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.924] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.924] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.924] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0049.924] GetCurrentThreadId () returned 0xa28 [0049.924] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0049.924] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.924] IsWindowUnicode (hWnd=0x3015e) returned 1 [0049.924] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0049.924] TranslateMessage (lpMsg=0x26ee10) returned 0 [0049.924] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0049.924] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0049.924] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0049.924] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffc00109c0 [0049.924] GetObjectType (h=0x60109d6) returned 0x3 [0049.924] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff820509d7 [0049.924] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff820509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.924] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff820509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0049.924] DeleteObject (ho=0xffffffff820509d7) returned 1 [0049.925] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff8f0509d2 [0049.925] SelectObject (hdc=0xffffffffc00109c0, h=0xffffffff8f0509d2) returned 0x185000f [0049.925] GdipCreateFromHDC (hdc=0xffffffffc00109c0, graphics=0x26e408) returned 0x0 [0049.925] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0049.925] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0049.925] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0049.925] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0049.925] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0049.925] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.925] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0049.925] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.925] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0049.925] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0049.925] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0049.925] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0049.925] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0049.925] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.925] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.925] GetSystemMetrics (nIndex=42) returned 0 [0049.925] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.925] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.925] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0049.925] IsAppThemed () returned 0x1 [0049.926] GetThemeAppProperties () returned 0x3 [0049.926] GetThemeAppProperties () returned 0x3 [0049.926] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0049.926] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0049.926] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0049.926] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0049.926] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0049.926] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.926] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.926] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.926] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0049.926] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0049.926] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0049.926] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0049.926] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0049.926] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0049.926] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0049.926] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0049.926] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0049.926] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0049.926] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x1) returned 0x1b00017 [0049.926] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x2) returned 0x1900010 [0049.926] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x7) returned 0xffffffff8f0509d2 [0049.926] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x6) returned 0x18a002e [0049.926] SaveDC (hdc=0xffffffffc00109c0) returned 1 [0049.926] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc30409f1 [0049.926] GetClipRgn (hdc=0xffffffffc00109c0, hrgn=0xffffffffc30409f1) returned 0 [0049.926] SelectClipRgn (hdc=0xffffffffc00109c0, hrgn=0xffffffffeb0409ff) returned 2 [0049.926] DeleteObject (ho=0xffffffffc30409f1) returned 1 [0049.926] DeleteObject (ho=0xffffffffeb0409ff) returned 1 [0049.927] OffsetViewportOrgEx (in: hdc=0xffffffffc00109c0, x=0, y=0, lppt=0x28b8d60 | out: lppt=0x28b8d60) returned 1 [0049.927] OffsetViewportOrgEx (in: hdc=0xffffffffc00109c0, x=-417, y=-278, lppt=0x28b8d78 | out: lppt=0x28b8d78) returned 1 [0049.927] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0049.927] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x1) returned 0x1b00017 [0049.927] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x2) returned 0x1900010 [0049.927] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x7) returned 0xffffffff8f0509d2 [0049.927] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x6) returned 0x18a002e [0049.927] SaveDC (hdc=0xffffffffc00109c0) returned 2 [0049.927] GetNearestColor (hdc=0xffffffffc00109c0, color=0x6c4607) returned 0x6c4607 [0049.927] CreateSolidBrush (color=0x6c4607) returned 0xffffffff9a100276 [0049.927] FillRect (hDC=0xffffffffc00109c0, lprc=0x26de08, hbr=0xffffffff9a100276) returned 1 [0049.933] DeleteObject (ho=0xffffffff9a100276) returned 1 [0049.933] RestoreDC (hdc=0xffffffffc00109c0, nSavedDC=-1) returned 1 [0049.933] RestoreDC (hdc=0xffffffffc00109c0, nSavedDC=-1) returned 1 [0049.933] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc00109c0) returned 0x0 [0049.933] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd020dbd) returned 0x0 [0049.933] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0049.933] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0049.933] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0049.933] GetSystemMetrics (nIndex=42) returned 0 [0049.933] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0049.933] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0049.933] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0049.934] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0049.934] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0049.934] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0049.934] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0049.934] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0049.934] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x1) returned 0x1b00017 [0049.934] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x2) returned 0x1900010 [0049.934] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x7) returned 0xffffffff8f0509d2 [0049.934] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x6) returned 0x18a002e [0049.934] SaveDC (hdc=0xffffffffc00109c0) returned 1 [0049.934] GetNearestColor (hdc=0xffffffffc00109c0, color=0xf0f0f0) returned 0xf0f0f0 [0049.934] RestoreDC (hdc=0xffffffffc00109c0, nSavedDC=-1) returned 1 [0049.934] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc00109c0) returned 0x0 [0049.934] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0049.934] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0049.934] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0049.934] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0049.934] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x1) returned 0x1b00017 [0049.934] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x2) returned 0x1900010 [0049.934] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x7) returned 0xffffffff8f0509d2 [0049.934] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x6) returned 0x18a002e [0049.934] SaveDC (hdc=0xffffffffc00109c0) returned 1 [0049.935] GetTextAlign (hdc=0xffffffffc00109c0) returned 0x0 [0049.935] GetTextColor (hdc=0xffffffffc00109c0) returned 0x0 [0049.935] SetTextColor (hdc=0xffffffffc00109c0, color=0xf0f0f0) returned 0x0 [0049.935] GetCurrentObject (hdc=0xffffffffc00109c0, type=0x6) returned 0x18a002e [0049.935] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0049.935] SelectObject (hdc=0xffffffffc00109c0, h=0x260a09ba) returned 0x18a002e [0049.935] GetBkMode (hdc=0xffffffffc00109c0) returned 2 [0049.935] SetBkMode (hdc=0xffffffffc00109c0, mode=1) returned 2 [0049.935] DrawTextExW (in: hdc=0xffffffffc00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x28b9a28 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0049.935] DrawTextExW (in: hdc=0xffffffffc00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x28b9a28 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0049.935] RestoreDC (hdc=0xffffffffc00109c0, nSavedDC=-1) returned 1 [0049.935] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc00109c0) returned 0x0 [0049.935] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0049.936] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffc00109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0049.936] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc00109c0) returned 0x0 [0049.936] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0049.936] SelectObject (hdc=0xffffffffc00109c0, h=0x185000f) returned 0xffffffff8f0509d2 [0049.936] DeleteDC (hdc=0xffffffffc00109c0) returned 1 [0049.936] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0049.936] DeleteObject (ho=0xffffffff8f0509d2) returned 1 [0049.939] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0049.939] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0049.939] WaitMessage () returned 1 [0050.106] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.106] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.106] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.106] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.106] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.106] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0050.106] GetCurrentThreadId () returned 0xa28 [0050.106] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0050.106] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.106] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.106] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.106] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.106] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.106] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0050.107] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0050.107] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff840109d7 [0050.107] GetObjectType (h=0x60109d6) returned 0x3 [0050.107] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff900509d2 [0050.107] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff900509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.107] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff900509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.107] DeleteObject (ho=0xffffffff900509d2) returned 1 [0050.107] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffc10509c0 [0050.107] SelectObject (hdc=0xffffffff840109d7, h=0xffffffffc10509c0) returned 0x185000f [0050.107] GdipCreateFromHDC (hdc=0xffffffff840109d7, graphics=0x26e408) returned 0x0 [0050.107] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0050.107] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0050.107] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0050.107] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0050.107] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0050.107] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.107] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0050.107] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.108] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0050.108] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0050.108] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0050.108] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0050.108] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0050.108] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.108] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.108] GetSystemMetrics (nIndex=42) returned 0 [0050.108] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.108] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.108] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0050.108] IsAppThemed () returned 0x1 [0050.108] GetThemeAppProperties () returned 0x3 [0050.108] GetThemeAppProperties () returned 0x3 [0050.108] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0050.108] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0050.108] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0050.108] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0050.108] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0050.108] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.108] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.108] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.108] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0050.108] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.108] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.108] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.108] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0050.108] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0050.108] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0050.108] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0050.108] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0050.109] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0050.109] GetCurrentObject (hdc=0xffffffff840109d7, type=0x1) returned 0x1b00017 [0050.109] GetCurrentObject (hdc=0xffffffff840109d7, type=0x2) returned 0x1900010 [0050.109] GetCurrentObject (hdc=0xffffffff840109d7, type=0x7) returned 0xffffffffc10509c0 [0050.109] GetCurrentObject (hdc=0xffffffff840109d7, type=0x6) returned 0x18a002e [0050.109] SaveDC (hdc=0xffffffff840109d7) returned 1 [0050.109] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffec0409ff [0050.109] GetClipRgn (hdc=0xffffffff840109d7, hrgn=0xffffffffec0409ff) returned 0 [0050.109] SelectClipRgn (hdc=0xffffffff840109d7, hrgn=0xffffffffc60409f1) returned 2 [0050.109] DeleteObject (ho=0xffffffffec0409ff) returned 1 [0050.109] DeleteObject (ho=0xffffffffc60409f1) returned 1 [0050.109] OffsetViewportOrgEx (in: hdc=0xffffffff840109d7, x=0, y=0, lppt=0x28737e8 | out: lppt=0x28737e8) returned 1 [0050.109] OffsetViewportOrgEx (in: hdc=0xffffffff840109d7, x=-417, y=-278, lppt=0x2873800 | out: lppt=0x2873800) returned 1 [0050.109] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0050.109] GetCurrentObject (hdc=0xffffffff840109d7, type=0x1) returned 0x1b00017 [0050.109] GetCurrentObject (hdc=0xffffffff840109d7, type=0x2) returned 0x1900010 [0050.109] GetCurrentObject (hdc=0xffffffff840109d7, type=0x7) returned 0xffffffffc10509c0 [0050.109] GetCurrentObject (hdc=0xffffffff840109d7, type=0x6) returned 0x18a002e [0050.109] SaveDC (hdc=0xffffffff840109d7) returned 2 [0050.109] GetNearestColor (hdc=0xffffffff840109d7, color=0x6c4607) returned 0x6c4607 [0050.109] CreateSolidBrush (color=0x6c4607) returned 0xffffffff9b100276 [0050.109] FillRect (hDC=0xffffffff840109d7, lprc=0x26de08, hbr=0xffffffff9b100276) returned 1 [0050.115] DeleteObject (ho=0xffffffff9b100276) returned 1 [0050.115] RestoreDC (hdc=0xffffffff840109d7, nSavedDC=-1) returned 1 [0050.115] RestoreDC (hdc=0xffffffff840109d7, nSavedDC=-1) returned 1 [0050.116] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff840109d7) returned 0x0 [0050.116] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffd000dbd) returned 0x0 [0050.116] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0050.116] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.116] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.116] GetSystemMetrics (nIndex=42) returned 0 [0050.116] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.116] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.116] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x11) returned 0x0 [0050.117] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0050.117] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0050.117] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0050.117] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0050.117] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0050.117] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0050.117] GetCurrentObject (hdc=0xffffffff840109d7, type=0x1) returned 0x1b00017 [0050.117] GetCurrentObject (hdc=0xffffffff840109d7, type=0x2) returned 0x1900010 [0050.117] GetCurrentObject (hdc=0xffffffff840109d7, type=0x7) returned 0xffffffffc10509c0 [0050.117] GetCurrentObject (hdc=0xffffffff840109d7, type=0x6) returned 0x18a002e [0050.117] SaveDC (hdc=0xffffffff840109d7) returned 1 [0050.117] GetNearestColor (hdc=0xffffffff840109d7, color=0xf0f0f0) returned 0xf0f0f0 [0050.117] RestoreDC (hdc=0xffffffff840109d7, nSavedDC=-1) returned 1 [0050.117] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff840109d7) returned 0x0 [0050.117] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0050.117] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0050.117] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0050.117] GetCurrentObject (hdc=0xffffffff840109d7, type=0x1) returned 0x1b00017 [0050.117] GetCurrentObject (hdc=0xffffffff840109d7, type=0x2) returned 0x1900010 [0050.117] GetCurrentObject (hdc=0xffffffff840109d7, type=0x7) returned 0xffffffffc10509c0 [0050.117] GetCurrentObject (hdc=0xffffffff840109d7, type=0x6) returned 0x18a002e [0050.117] SaveDC (hdc=0xffffffff840109d7) returned 1 [0050.118] GetTextAlign (hdc=0xffffffff840109d7) returned 0x0 [0050.118] GetTextColor (hdc=0xffffffff840109d7) returned 0x0 [0050.118] SetTextColor (hdc=0xffffffff840109d7, color=0xf0f0f0) returned 0x0 [0050.118] GetCurrentObject (hdc=0xffffffff840109d7, type=0x6) returned 0x18a002e [0050.118] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0050.118] SelectObject (hdc=0xffffffff840109d7, h=0x260a09ba) returned 0x18a002e [0050.118] GetBkMode (hdc=0xffffffff840109d7) returned 2 [0050.118] SetBkMode (hdc=0xffffffff840109d7, mode=1) returned 2 [0050.118] DrawTextExW (in: hdc=0xffffffff840109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x28746b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0050.118] DrawTextExW (in: hdc=0xffffffff840109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x28746b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0050.118] RestoreDC (hdc=0xffffffff840109d7, nSavedDC=-1) returned 1 [0050.118] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff840109d7) returned 0x0 [0050.119] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0050.119] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff840109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0050.119] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff840109d7) returned 0x0 [0050.119] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0050.119] SelectObject (hdc=0xffffffff840109d7, h=0x185000f) returned 0xffffffffc10509c0 [0050.119] DeleteDC (hdc=0xffffffff840109d7) returned 1 [0050.119] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0050.119] DeleteObject (ho=0xffffffffc10509c0) returned 1 [0050.122] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0050.122] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.122] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.122] WaitMessage () returned 1 [0050.292] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.292] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.292] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.292] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.293] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.293] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0050.293] GetCurrentThreadId () returned 0xa28 [0050.293] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0050.293] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.293] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.293] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.293] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.293] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.293] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0050.293] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0050.293] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff920109d2 [0050.293] GetObjectType (h=0x60109d6) returned 0x3 [0050.293] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffc20509c0 [0050.293] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc20509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.293] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc20509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.293] DeleteObject (ho=0xffffffffc20509c0) returned 1 [0050.293] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff850509d7 [0050.293] SelectObject (hdc=0xffffffff920109d2, h=0xffffffff850509d7) returned 0x185000f [0050.293] GdipCreateFromHDC (hdc=0xffffffff920109d2, graphics=0x26e408) returned 0x0 [0050.294] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0050.294] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0050.294] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0050.294] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0050.294] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0050.294] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.294] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0050.294] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.294] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0050.294] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0050.294] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0050.294] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0050.294] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0050.294] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.294] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.294] GetSystemMetrics (nIndex=42) returned 0 [0050.294] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.294] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.294] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0050.294] IsAppThemed () returned 0x1 [0050.294] GetThemeAppProperties () returned 0x3 [0050.294] GetThemeAppProperties () returned 0x3 [0050.294] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0050.294] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0050.294] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0050.294] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0050.295] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0050.295] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.295] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.295] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.295] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0050.295] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.295] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.295] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.295] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0050.295] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0050.295] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0050.295] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0050.295] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0050.295] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0050.295] GetCurrentObject (hdc=0xffffffff920109d2, type=0x1) returned 0x1b00017 [0050.295] GetCurrentObject (hdc=0xffffffff920109d2, type=0x2) returned 0x1900010 [0050.295] GetCurrentObject (hdc=0xffffffff920109d2, type=0x7) returned 0xffffffff850509d7 [0050.295] GetCurrentObject (hdc=0xffffffff920109d2, type=0x6) returned 0x18a002e [0050.295] SaveDC (hdc=0xffffffff920109d2) returned 1 [0050.295] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc70409f1 [0050.295] GetClipRgn (hdc=0xffffffff920109d2, hrgn=0xffffffffc70409f1) returned 0 [0050.295] SelectClipRgn (hdc=0xffffffff920109d2, hrgn=0xffffffffef0409ff) returned 2 [0050.295] DeleteObject (ho=0xffffffffc70409f1) returned 1 [0050.295] DeleteObject (ho=0xffffffffef0409ff) returned 1 [0050.295] OffsetViewportOrgEx (in: hdc=0xffffffff920109d2, x=0, y=0, lppt=0x27915b8 | out: lppt=0x27915b8) returned 1 [0050.295] OffsetViewportOrgEx (in: hdc=0xffffffff920109d2, x=-417, y=-278, lppt=0x27915d0 | out: lppt=0x27915d0) returned 1 [0050.295] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0050.296] GetCurrentObject (hdc=0xffffffff920109d2, type=0x1) returned 0x1b00017 [0050.296] GetCurrentObject (hdc=0xffffffff920109d2, type=0x2) returned 0x1900010 [0050.296] GetCurrentObject (hdc=0xffffffff920109d2, type=0x7) returned 0xffffffff850509d7 [0050.296] GetCurrentObject (hdc=0xffffffff920109d2, type=0x6) returned 0x18a002e [0050.296] SaveDC (hdc=0xffffffff920109d2) returned 2 [0050.296] GetNearestColor (hdc=0xffffffff920109d2, color=0x6c4607) returned 0x6c4607 [0050.296] CreateSolidBrush (color=0x6c4607) returned 0xffffffff9c100276 [0050.296] FillRect (hDC=0xffffffff920109d2, lprc=0x26de08, hbr=0xffffffff9c100276) returned 1 [0050.302] DeleteObject (ho=0xffffffff9c100276) returned 1 [0050.302] RestoreDC (hdc=0xffffffff920109d2, nSavedDC=-1) returned 1 [0050.302] RestoreDC (hdc=0xffffffff920109d2, nSavedDC=-1) returned 1 [0050.302] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff920109d2) returned 0x0 [0050.302] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcfe0dbd) returned 0x0 [0050.302] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0050.302] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.302] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.302] GetSystemMetrics (nIndex=42) returned 0 [0050.302] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.302] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.303] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0050.303] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0050.303] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0050.303] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0050.303] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0050.303] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0050.303] GetCurrentObject (hdc=0xffffffff920109d2, type=0x1) returned 0x1b00017 [0050.303] GetCurrentObject (hdc=0xffffffff920109d2, type=0x2) returned 0x1900010 [0050.303] GetCurrentObject (hdc=0xffffffff920109d2, type=0x7) returned 0xffffffff850509d7 [0050.303] GetCurrentObject (hdc=0xffffffff920109d2, type=0x6) returned 0x18a002e [0050.303] SaveDC (hdc=0xffffffff920109d2) returned 1 [0050.303] GetNearestColor (hdc=0xffffffff920109d2, color=0xf0f0f0) returned 0xf0f0f0 [0050.303] RestoreDC (hdc=0xffffffff920109d2, nSavedDC=-1) returned 1 [0050.303] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff920109d2) returned 0x0 [0050.303] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0050.303] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0050.303] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0050.303] GetCurrentObject (hdc=0xffffffff920109d2, type=0x1) returned 0x1b00017 [0050.303] GetCurrentObject (hdc=0xffffffff920109d2, type=0x2) returned 0x1900010 [0050.303] GetCurrentObject (hdc=0xffffffff920109d2, type=0x7) returned 0xffffffff850509d7 [0050.304] GetCurrentObject (hdc=0xffffffff920109d2, type=0x6) returned 0x18a002e [0050.304] SaveDC (hdc=0xffffffff920109d2) returned 1 [0050.304] GetTextAlign (hdc=0xffffffff920109d2) returned 0x0 [0050.304] GetTextColor (hdc=0xffffffff920109d2) returned 0x0 [0050.304] SetTextColor (hdc=0xffffffff920109d2, color=0xf0f0f0) returned 0x0 [0050.304] GetCurrentObject (hdc=0xffffffff920109d2, type=0x6) returned 0x18a002e [0050.304] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0050.304] SelectObject (hdc=0xffffffff920109d2, h=0x260a09ba) returned 0x18a002e [0050.304] GetBkMode (hdc=0xffffffff920109d2) returned 2 [0050.304] SetBkMode (hdc=0xffffffff920109d2, mode=1) returned 2 [0050.304] DrawTextExW (in: hdc=0xffffffff920109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2792280 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0050.304] DrawTextExW (in: hdc=0xffffffff920109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2792280 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0050.305] RestoreDC (hdc=0xffffffff920109d2, nSavedDC=-1) returned 1 [0050.305] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff920109d2) returned 0x0 [0050.305] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0050.305] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff920109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0050.305] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff920109d2) returned 0x0 [0050.305] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0050.305] SelectObject (hdc=0xffffffff920109d2, h=0x185000f) returned 0xffffffff850509d7 [0050.305] DeleteDC (hdc=0xffffffff920109d2) returned 1 [0050.305] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0050.305] DeleteObject (ho=0xffffffff850509d7) returned 1 [0050.309] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0050.309] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.309] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.309] WaitMessage () returned 1 [0050.605] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.605] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.605] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.605] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.605] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.605] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0050.606] GetCurrentThreadId () returned 0xa28 [0050.606] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0050.606] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.606] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.606] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.606] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.606] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.606] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0050.606] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0050.606] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffc40109c0 [0050.606] GetObjectType (h=0x60109d6) returned 0x3 [0050.606] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff860509d7 [0050.606] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff860509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.606] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff860509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.606] DeleteObject (ho=0xffffffff860509d7) returned 1 [0050.606] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff930509d2 [0050.606] SelectObject (hdc=0xffffffffc40109c0, h=0xffffffff930509d2) returned 0x185000f [0050.606] GdipCreateFromHDC (hdc=0xffffffffc40109c0, graphics=0x26e408) returned 0x0 [0050.607] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0050.607] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0050.607] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0050.607] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0050.607] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0050.607] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.607] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0050.607] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.607] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0050.607] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0050.607] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0050.607] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0050.607] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0050.607] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.607] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.607] GetSystemMetrics (nIndex=42) returned 0 [0050.607] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.607] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.607] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0050.607] IsAppThemed () returned 0x1 [0050.607] GetThemeAppProperties () returned 0x3 [0050.607] GetThemeAppProperties () returned 0x3 [0050.607] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0050.607] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0050.608] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0050.608] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0050.608] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0050.608] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.608] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.608] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.608] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0050.608] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.608] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.608] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.608] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0050.608] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0050.608] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0050.608] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0050.608] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0050.608] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0050.608] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x1) returned 0x1b00017 [0050.608] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x2) returned 0x1900010 [0050.608] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x7) returned 0xffffffff930509d2 [0050.608] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x6) returned 0x18a002e [0050.608] SaveDC (hdc=0xffffffffc40109c0) returned 1 [0050.608] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffff00409ff [0050.608] GetClipRgn (hdc=0xffffffffc40109c0, hrgn=0xfffffffff00409ff) returned 0 [0050.608] SelectClipRgn (hdc=0xffffffffc40109c0, hrgn=0xffffffffca0409f1) returned 2 [0050.608] DeleteObject (ho=0xfffffffff00409ff) returned 1 [0050.608] DeleteObject (ho=0xffffffffca0409f1) returned 1 [0050.608] OffsetViewportOrgEx (in: hdc=0xffffffffc40109c0, x=0, y=0, lppt=0x2713cd8 | out: lppt=0x2713cd8) returned 1 [0050.608] OffsetViewportOrgEx (in: hdc=0xffffffffc40109c0, x=-417, y=-278, lppt=0x2713cf0 | out: lppt=0x2713cf0) returned 1 [0050.608] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0050.608] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x1) returned 0x1b00017 [0050.609] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x2) returned 0x1900010 [0050.609] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x7) returned 0xffffffff930509d2 [0050.609] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x6) returned 0x18a002e [0050.609] SaveDC (hdc=0xffffffffc40109c0) returned 2 [0050.609] GetNearestColor (hdc=0xffffffffc40109c0, color=0x6c4607) returned 0x6c4607 [0050.609] CreateSolidBrush (color=0x6c4607) returned 0xffffffff9d100276 [0050.609] FillRect (hDC=0xffffffffc40109c0, lprc=0x26de08, hbr=0xffffffff9d100276) returned 1 [0050.615] DeleteObject (ho=0xffffffff9d100276) returned 1 [0050.615] RestoreDC (hdc=0xffffffffc40109c0, nSavedDC=-1) returned 1 [0050.615] RestoreDC (hdc=0xffffffffc40109c0, nSavedDC=-1) returned 1 [0050.615] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc40109c0) returned 0x0 [0050.615] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcfc0dbd) returned 0x0 [0050.615] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0050.615] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.615] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.615] GetSystemMetrics (nIndex=42) returned 0 [0050.615] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.615] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.615] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x13) returned 0x0 [0050.616] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0050.616] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0050.616] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0050.616] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0050.616] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0050.616] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0050.616] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x1) returned 0x1b00017 [0050.616] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x2) returned 0x1900010 [0050.616] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x7) returned 0xffffffff930509d2 [0050.616] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x6) returned 0x18a002e [0050.617] SaveDC (hdc=0xffffffffc40109c0) returned 1 [0050.617] GetNearestColor (hdc=0xffffffffc40109c0, color=0xf0f0f0) returned 0xf0f0f0 [0050.617] RestoreDC (hdc=0xffffffffc40109c0, nSavedDC=-1) returned 1 [0050.617] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc40109c0) returned 0x0 [0050.617] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0050.617] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0050.617] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0050.617] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0050.617] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x1) returned 0x1b00017 [0050.617] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x2) returned 0x1900010 [0050.617] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x7) returned 0xffffffff930509d2 [0050.617] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x6) returned 0x18a002e [0050.617] SaveDC (hdc=0xffffffffc40109c0) returned 1 [0050.617] GetTextAlign (hdc=0xffffffffc40109c0) returned 0x0 [0050.617] GetTextColor (hdc=0xffffffffc40109c0) returned 0x0 [0050.617] SetTextColor (hdc=0xffffffffc40109c0, color=0xf0f0f0) returned 0x0 [0050.617] GetCurrentObject (hdc=0xffffffffc40109c0, type=0x6) returned 0x18a002e [0050.617] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0050.617] SelectObject (hdc=0xffffffffc40109c0, h=0x260a09ba) returned 0x18a002e [0050.617] GetBkMode (hdc=0xffffffffc40109c0) returned 2 [0050.618] SetBkMode (hdc=0xffffffffc40109c0, mode=1) returned 2 [0050.618] DrawTextExW (in: hdc=0xffffffffc40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2714ba8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0050.618] DrawTextExW (in: hdc=0xffffffffc40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2714ba8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0050.618] RestoreDC (hdc=0xffffffffc40109c0, nSavedDC=-1) returned 1 [0050.618] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc40109c0) returned 0x0 [0050.618] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0050.618] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffc40109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0050.618] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc40109c0) returned 0x0 [0050.619] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0050.619] SelectObject (hdc=0xffffffffc40109c0, h=0x185000f) returned 0xffffffff930509d2 [0050.619] DeleteDC (hdc=0xffffffffc40109c0) returned 1 [0050.619] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0050.619] DeleteObject (ho=0xffffffff930509d2) returned 1 [0050.622] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0050.622] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.622] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.622] WaitMessage () returned 1 [0050.807] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.807] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.807] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.807] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.807] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.807] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0050.808] GetCurrentThreadId () returned 0xa28 [0050.808] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0050.808] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.808] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.808] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.808] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.808] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.808] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0050.808] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0050.808] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff880109d7 [0050.808] GetObjectType (h=0x60109d6) returned 0x3 [0050.808] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff940509d2 [0050.808] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff940509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.808] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff940509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.808] DeleteObject (ho=0xffffffff940509d2) returned 1 [0050.808] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffc50509c0 [0050.808] SelectObject (hdc=0xffffffff880109d7, h=0xffffffffc50509c0) returned 0x185000f [0050.809] GdipCreateFromHDC (hdc=0xffffffff880109d7, graphics=0x26e408) returned 0x0 [0050.809] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0050.809] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0050.809] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0050.809] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0050.809] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0050.809] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.809] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0050.809] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.809] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0050.809] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0050.809] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0050.809] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0050.809] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0050.809] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.809] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.809] GetSystemMetrics (nIndex=42) returned 0 [0050.809] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.809] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.809] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0050.809] IsAppThemed () returned 0x1 [0050.809] GetThemeAppProperties () returned 0x3 [0050.809] GetThemeAppProperties () returned 0x3 [0050.809] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0050.809] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0050.810] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0050.810] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0050.810] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0050.810] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.810] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.810] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.810] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0050.810] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.810] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.810] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.810] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0050.810] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0050.810] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0050.810] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0050.810] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0050.810] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0050.810] GetCurrentObject (hdc=0xffffffff880109d7, type=0x1) returned 0x1b00017 [0050.810] GetCurrentObject (hdc=0xffffffff880109d7, type=0x2) returned 0x1900010 [0050.810] GetCurrentObject (hdc=0xffffffff880109d7, type=0x7) returned 0xffffffffc50509c0 [0050.810] GetCurrentObject (hdc=0xffffffff880109d7, type=0x6) returned 0x18a002e [0050.810] SaveDC (hdc=0xffffffff880109d7) returned 1 [0050.810] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffcb0409f1 [0050.810] GetClipRgn (hdc=0xffffffff880109d7, hrgn=0xffffffffcb0409f1) returned 0 [0050.810] SelectClipRgn (hdc=0xffffffff880109d7, hrgn=0xfffffffff30409ff) returned 2 [0050.810] DeleteObject (ho=0xffffffffcb0409f1) returned 1 [0050.810] DeleteObject (ho=0xfffffffff30409ff) returned 1 [0050.810] OffsetViewportOrgEx (in: hdc=0xffffffff880109d7, x=0, y=0, lppt=0x2801fd0 | out: lppt=0x2801fd0) returned 1 [0050.810] OffsetViewportOrgEx (in: hdc=0xffffffff880109d7, x=-417, y=-278, lppt=0x2801fe8 | out: lppt=0x2801fe8) returned 1 [0050.811] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0050.811] GetCurrentObject (hdc=0xffffffff880109d7, type=0x1) returned 0x1b00017 [0050.811] GetCurrentObject (hdc=0xffffffff880109d7, type=0x2) returned 0x1900010 [0050.811] GetCurrentObject (hdc=0xffffffff880109d7, type=0x7) returned 0xffffffffc50509c0 [0050.811] GetCurrentObject (hdc=0xffffffff880109d7, type=0x6) returned 0x18a002e [0050.811] SaveDC (hdc=0xffffffff880109d7) returned 2 [0050.811] GetNearestColor (hdc=0xffffffff880109d7, color=0x6c4607) returned 0x6c4607 [0050.811] CreateSolidBrush (color=0x6c4607) returned 0xffffffff9e100276 [0050.811] FillRect (hDC=0xffffffff880109d7, lprc=0x26de08, hbr=0xffffffff9e100276) returned 1 [0050.817] DeleteObject (ho=0xffffffff9e100276) returned 1 [0050.817] RestoreDC (hdc=0xffffffff880109d7, nSavedDC=-1) returned 1 [0050.817] RestoreDC (hdc=0xffffffff880109d7, nSavedDC=-1) returned 1 [0050.817] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff880109d7) returned 0x0 [0050.817] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcfa0dbd) returned 0x0 [0050.817] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0050.817] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.817] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.817] GetSystemMetrics (nIndex=42) returned 0 [0050.817] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.817] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.818] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x14) returned 0x0 [0050.818] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0050.818] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0050.818] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0050.818] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0050.818] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0050.818] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0050.818] GetCurrentObject (hdc=0xffffffff880109d7, type=0x1) returned 0x1b00017 [0050.818] GetCurrentObject (hdc=0xffffffff880109d7, type=0x2) returned 0x1900010 [0050.818] GetCurrentObject (hdc=0xffffffff880109d7, type=0x7) returned 0xffffffffc50509c0 [0050.818] GetCurrentObject (hdc=0xffffffff880109d7, type=0x6) returned 0x18a002e [0050.818] SaveDC (hdc=0xffffffff880109d7) returned 1 [0050.818] GetNearestColor (hdc=0xffffffff880109d7, color=0xf0f0f0) returned 0xf0f0f0 [0050.818] RestoreDC (hdc=0xffffffff880109d7, nSavedDC=-1) returned 1 [0050.818] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff880109d7) returned 0x0 [0050.819] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0050.819] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0050.819] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0050.819] GetCurrentObject (hdc=0xffffffff880109d7, type=0x1) returned 0x1b00017 [0050.819] GetCurrentObject (hdc=0xffffffff880109d7, type=0x2) returned 0x1900010 [0050.819] GetCurrentObject (hdc=0xffffffff880109d7, type=0x7) returned 0xffffffffc50509c0 [0050.819] GetCurrentObject (hdc=0xffffffff880109d7, type=0x6) returned 0x18a002e [0050.819] SaveDC (hdc=0xffffffff880109d7) returned 1 [0050.819] GetTextAlign (hdc=0xffffffff880109d7) returned 0x0 [0050.819] GetTextColor (hdc=0xffffffff880109d7) returned 0x0 [0050.819] SetTextColor (hdc=0xffffffff880109d7, color=0xf0f0f0) returned 0x0 [0050.819] GetCurrentObject (hdc=0xffffffff880109d7, type=0x6) returned 0x18a002e [0050.819] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0050.819] SelectObject (hdc=0xffffffff880109d7, h=0x260a09ba) returned 0x18a002e [0050.819] GetBkMode (hdc=0xffffffff880109d7) returned 2 [0050.819] SetBkMode (hdc=0xffffffff880109d7, mode=1) returned 2 [0050.819] DrawTextExW (in: hdc=0xffffffff880109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2802da8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0050.819] DrawTextExW (in: hdc=0xffffffff880109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2802da8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0050.820] RestoreDC (hdc=0xffffffff880109d7, nSavedDC=-1) returned 1 [0050.820] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff880109d7) returned 0x0 [0050.820] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0050.820] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff880109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0050.820] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff880109d7) returned 0x0 [0050.820] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0050.820] SelectObject (hdc=0xffffffff880109d7, h=0x185000f) returned 0xffffffffc50509c0 [0050.820] DeleteDC (hdc=0xffffffff880109d7) returned 1 [0050.820] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0050.820] DeleteObject (ho=0xffffffffc50509c0) returned 1 [0050.823] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0050.824] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.824] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.824] WaitMessage () returned 1 [0050.963] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.963] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.963] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.963] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.963] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.963] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0050.963] GetCurrentThreadId () returned 0xa28 [0050.964] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0050.964] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.964] IsWindowUnicode (hWnd=0x3015e) returned 1 [0050.964] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0050.964] TranslateMessage (lpMsg=0x26ee10) returned 0 [0050.964] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0050.964] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0050.964] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0050.964] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff960109d2 [0050.964] GetObjectType (h=0x60109d6) returned 0x3 [0050.964] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffc60509c0 [0050.964] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc60509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.964] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc60509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0050.964] DeleteObject (ho=0xffffffffc60509c0) returned 1 [0050.964] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff890509d7 [0050.964] SelectObject (hdc=0xffffffff960109d2, h=0xffffffff890509d7) returned 0x185000f [0050.964] GdipCreateFromHDC (hdc=0xffffffff960109d2, graphics=0x26e408) returned 0x0 [0050.965] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0050.965] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0050.965] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0050.965] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0050.965] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0050.965] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.965] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0050.965] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.965] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0050.965] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0050.965] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0050.965] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0050.965] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0050.965] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.965] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.965] GetSystemMetrics (nIndex=42) returned 0 [0050.965] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.965] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.965] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0050.965] IsAppThemed () returned 0x1 [0050.965] GetThemeAppProperties () returned 0x3 [0050.965] GetThemeAppProperties () returned 0x3 [0050.965] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0050.965] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0050.965] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0050.965] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0050.966] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0050.966] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.966] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.966] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.966] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0050.966] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0050.966] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0050.966] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0050.966] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0050.966] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0050.966] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0050.966] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0050.966] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0050.966] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0050.966] GetCurrentObject (hdc=0xffffffff960109d2, type=0x1) returned 0x1b00017 [0050.966] GetCurrentObject (hdc=0xffffffff960109d2, type=0x2) returned 0x1900010 [0050.966] GetCurrentObject (hdc=0xffffffff960109d2, type=0x7) returned 0xffffffff890509d7 [0050.966] GetCurrentObject (hdc=0xffffffff960109d2, type=0x6) returned 0x18a002e [0050.966] SaveDC (hdc=0xffffffff960109d2) returned 1 [0050.966] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffff40409ff [0050.966] GetClipRgn (hdc=0xffffffff960109d2, hrgn=0xfffffffff40409ff) returned 0 [0050.966] SelectClipRgn (hdc=0xffffffff960109d2, hrgn=0xffffffffce0409f1) returned 2 [0050.966] DeleteObject (ho=0xfffffffff40409ff) returned 1 [0050.966] DeleteObject (ho=0xffffffffce0409f1) returned 1 [0050.966] OffsetViewportOrgEx (in: hdc=0xffffffff960109d2, x=0, y=0, lppt=0x26a6540 | out: lppt=0x26a6540) returned 1 [0050.966] OffsetViewportOrgEx (in: hdc=0xffffffff960109d2, x=-417, y=-278, lppt=0x26a6558 | out: lppt=0x26a6558) returned 1 [0050.966] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0050.966] GetCurrentObject (hdc=0xffffffff960109d2, type=0x1) returned 0x1b00017 [0050.966] GetCurrentObject (hdc=0xffffffff960109d2, type=0x2) returned 0x1900010 [0050.966] GetCurrentObject (hdc=0xffffffff960109d2, type=0x7) returned 0xffffffff890509d7 [0050.967] GetCurrentObject (hdc=0xffffffff960109d2, type=0x6) returned 0x18a002e [0050.967] SaveDC (hdc=0xffffffff960109d2) returned 2 [0050.967] GetNearestColor (hdc=0xffffffff960109d2, color=0x6c4607) returned 0x6c4607 [0050.967] CreateSolidBrush (color=0x6c4607) returned 0xffffffff9f100276 [0050.967] FillRect (hDC=0xffffffff960109d2, lprc=0x26de08, hbr=0xffffffff9f100276) returned 1 [0050.973] DeleteObject (ho=0xffffffff9f100276) returned 1 [0050.973] RestoreDC (hdc=0xffffffff960109d2, nSavedDC=-1) returned 1 [0050.973] RestoreDC (hdc=0xffffffff960109d2, nSavedDC=-1) returned 1 [0050.973] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff960109d2) returned 0x0 [0050.973] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcf80dbd) returned 0x0 [0050.973] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0050.973] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0050.973] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0050.973] GetSystemMetrics (nIndex=42) returned 0 [0050.973] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0050.973] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0050.973] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0050.973] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0050.973] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0050.973] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0050.974] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0050.974] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0050.974] GetCurrentObject (hdc=0xffffffff960109d2, type=0x1) returned 0x1b00017 [0050.974] GetCurrentObject (hdc=0xffffffff960109d2, type=0x2) returned 0x1900010 [0050.974] GetCurrentObject (hdc=0xffffffff960109d2, type=0x7) returned 0xffffffff890509d7 [0050.974] GetCurrentObject (hdc=0xffffffff960109d2, type=0x6) returned 0x18a002e [0050.974] SaveDC (hdc=0xffffffff960109d2) returned 1 [0050.974] GetNearestColor (hdc=0xffffffff960109d2, color=0xf0f0f0) returned 0xf0f0f0 [0050.974] RestoreDC (hdc=0xffffffff960109d2, nSavedDC=-1) returned 1 [0050.974] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff960109d2) returned 0x0 [0050.974] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0050.974] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0050.974] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0050.974] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0050.974] GetCurrentObject (hdc=0xffffffff960109d2, type=0x1) returned 0x1b00017 [0050.974] GetCurrentObject (hdc=0xffffffff960109d2, type=0x2) returned 0x1900010 [0050.974] GetCurrentObject (hdc=0xffffffff960109d2, type=0x7) returned 0xffffffff890509d7 [0050.974] GetCurrentObject (hdc=0xffffffff960109d2, type=0x6) returned 0x18a002e [0050.974] SaveDC (hdc=0xffffffff960109d2) returned 1 [0050.975] GetTextAlign (hdc=0xffffffff960109d2) returned 0x0 [0050.975] GetTextColor (hdc=0xffffffff960109d2) returned 0x0 [0050.975] SetTextColor (hdc=0xffffffff960109d2, color=0xf0f0f0) returned 0x0 [0050.975] GetCurrentObject (hdc=0xffffffff960109d2, type=0x6) returned 0x18a002e [0050.975] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0050.975] SelectObject (hdc=0xffffffff960109d2, h=0x260a09ba) returned 0x18a002e [0050.975] GetBkMode (hdc=0xffffffff960109d2) returned 2 [0050.975] SetBkMode (hdc=0xffffffff960109d2, mode=1) returned 2 [0050.975] DrawTextExW (in: hdc=0xffffffff960109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a7208 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0050.975] DrawTextExW (in: hdc=0xffffffff960109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a7208 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0050.976] RestoreDC (hdc=0xffffffff960109d2, nSavedDC=-1) returned 1 [0050.976] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff960109d2) returned 0x0 [0050.976] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0050.976] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff960109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0050.976] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff960109d2) returned 0x0 [0050.976] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0050.976] SelectObject (hdc=0xffffffff960109d2, h=0x185000f) returned 0xffffffff890509d7 [0050.976] DeleteDC (hdc=0xffffffff960109d2) returned 1 [0050.976] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0050.976] DeleteObject (ho=0xffffffff890509d7) returned 1 [0050.979] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0050.979] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.979] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0050.979] WaitMessage () returned 1 [0051.228] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.228] IsWindowUnicode (hWnd=0x3015e) returned 1 [0051.228] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.229] TranslateMessage (lpMsg=0x26ee10) returned 0 [0051.229] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0051.229] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0051.229] GetCurrentThreadId () returned 0xa28 [0051.229] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0051.229] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.229] IsWindowUnicode (hWnd=0x3015e) returned 1 [0051.229] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.229] TranslateMessage (lpMsg=0x26ee10) returned 0 [0051.229] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0051.230] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0051.230] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0051.230] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffc80109c0 [0051.230] GetObjectType (h=0x60109d6) returned 0x3 [0051.230] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff8a0509d7 [0051.230] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8a0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0051.231] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8a0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0051.231] DeleteObject (ho=0xffffffff8a0509d7) returned 1 [0051.231] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff970509d2 [0051.231] SelectObject (hdc=0xffffffffc80109c0, h=0xffffffff970509d2) returned 0x185000f [0051.231] GdipCreateFromHDC (hdc=0xffffffffc80109c0, graphics=0x26e408) returned 0x0 [0051.231] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0051.231] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0051.232] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0051.232] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0051.232] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0051.232] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.232] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0051.232] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.232] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0051.232] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0051.232] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0051.232] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0051.232] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0051.232] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0051.232] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0051.232] GetSystemMetrics (nIndex=42) returned 0 [0051.233] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0051.233] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0051.233] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0051.233] IsAppThemed () returned 0x1 [0051.233] GetThemeAppProperties () returned 0x3 [0051.233] GetThemeAppProperties () returned 0x3 [0051.233] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0051.233] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0051.233] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0051.233] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0051.233] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0051.233] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.233] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0051.233] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.234] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0051.234] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.234] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0051.234] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.234] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0051.234] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0051.234] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0051.234] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0051.234] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0051.234] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0051.234] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x1) returned 0x1b00017 [0051.234] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x2) returned 0x1900010 [0051.234] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x7) returned 0xffffffff970509d2 [0051.234] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x6) returned 0x18a002e [0051.234] SaveDC (hdc=0xffffffffc80109c0) returned 1 [0051.234] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffcf0409f1 [0051.234] GetClipRgn (hdc=0xffffffffc80109c0, hrgn=0xffffffffcf0409f1) returned 0 [0051.234] SelectClipRgn (hdc=0xffffffffc80109c0, hrgn=0xfffffffff70409ff) returned 2 [0051.234] DeleteObject (ho=0xffffffffcf0409f1) returned 1 [0051.234] DeleteObject (ho=0xfffffffff70409ff) returned 1 [0051.234] OffsetViewportOrgEx (in: hdc=0xffffffffc80109c0, x=0, y=0, lppt=0x26a8de8 | out: lppt=0x26a8de8) returned 1 [0051.235] OffsetViewportOrgEx (in: hdc=0xffffffffc80109c0, x=-417, y=-278, lppt=0x26a8e00 | out: lppt=0x26a8e00) returned 1 [0051.235] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0051.235] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x1) returned 0x1b00017 [0051.235] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x2) returned 0x1900010 [0051.235] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x7) returned 0xffffffff970509d2 [0051.235] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x6) returned 0x18a002e [0051.235] SaveDC (hdc=0xffffffffc80109c0) returned 2 [0051.235] GetNearestColor (hdc=0xffffffffc80109c0, color=0x6c4607) returned 0x6c4607 [0051.235] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa0100276 [0051.235] FillRect (hDC=0xffffffffc80109c0, lprc=0x26de08, hbr=0xffffffffa0100276) returned 1 [0051.241] DeleteObject (ho=0xffffffffa0100276) returned 1 [0051.241] RestoreDC (hdc=0xffffffffc80109c0, nSavedDC=-1) returned 1 [0051.241] RestoreDC (hdc=0xffffffffc80109c0, nSavedDC=-1) returned 1 [0051.241] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc80109c0) returned 0x0 [0051.241] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcf60dbd) returned 0x0 [0051.241] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0051.241] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0051.241] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0051.241] GetSystemMetrics (nIndex=42) returned 0 [0051.242] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0051.242] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0051.242] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x16) returned 0x0 [0051.243] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0051.243] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0051.243] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0051.243] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0051.244] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0051.244] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0051.244] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x1) returned 0x1b00017 [0051.244] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x2) returned 0x1900010 [0051.244] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x7) returned 0xffffffff970509d2 [0051.244] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x6) returned 0x18a002e [0051.244] SaveDC (hdc=0xffffffffc80109c0) returned 1 [0051.244] GetNearestColor (hdc=0xffffffffc80109c0, color=0xf0f0f0) returned 0xf0f0f0 [0051.244] RestoreDC (hdc=0xffffffffc80109c0, nSavedDC=-1) returned 1 [0051.244] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc80109c0) returned 0x0 [0051.244] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0051.244] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0051.245] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0051.245] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0051.245] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x1) returned 0x1b00017 [0051.245] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x2) returned 0x1900010 [0051.245] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x7) returned 0xffffffff970509d2 [0051.245] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x6) returned 0x18a002e [0051.245] SaveDC (hdc=0xffffffffc80109c0) returned 1 [0051.246] GetTextAlign (hdc=0xffffffffc80109c0) returned 0x0 [0051.246] GetTextColor (hdc=0xffffffffc80109c0) returned 0x0 [0051.246] SetTextColor (hdc=0xffffffffc80109c0, color=0xf0f0f0) returned 0x0 [0051.246] GetCurrentObject (hdc=0xffffffffc80109c0, type=0x6) returned 0x18a002e [0051.246] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0051.246] SelectObject (hdc=0xffffffffc80109c0, h=0x260a09ba) returned 0x18a002e [0051.246] GetBkMode (hdc=0xffffffffc80109c0) returned 2 [0051.246] SetBkMode (hdc=0xffffffffc80109c0, mode=1) returned 2 [0051.246] DrawTextExW (in: hdc=0xffffffffc80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a9cc0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0051.247] DrawTextExW (in: hdc=0xffffffffc80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a9cc0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0051.247] RestoreDC (hdc=0xffffffffc80109c0, nSavedDC=-1) returned 1 [0051.247] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc80109c0) returned 0x0 [0051.247] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0051.247] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffc80109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0051.248] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc80109c0) returned 0x0 [0051.248] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0051.248] SelectObject (hdc=0xffffffffc80109c0, h=0x185000f) returned 0xffffffff970509d2 [0051.248] DeleteDC (hdc=0xffffffffc80109c0) returned 1 [0051.248] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0051.248] DeleteObject (ho=0xffffffff970509d2) returned 1 [0051.251] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0051.251] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0051.251] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0051.251] WaitMessage () returned 1 [0051.432] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.432] IsWindowUnicode (hWnd=0x3015e) returned 1 [0051.432] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.432] TranslateMessage (lpMsg=0x26ee10) returned 0 [0051.432] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0051.432] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0051.432] GetCurrentThreadId () returned 0xa28 [0051.432] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0051.432] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.432] IsWindowUnicode (hWnd=0x3015e) returned 1 [0051.432] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.432] TranslateMessage (lpMsg=0x26ee10) returned 0 [0051.432] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0051.432] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0051.433] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0051.433] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff8c0109d7 [0051.433] GetObjectType (h=0x60109d6) returned 0x3 [0051.433] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff980509d2 [0051.433] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff980509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0051.433] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff980509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0051.433] DeleteObject (ho=0xffffffff980509d2) returned 1 [0051.433] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffc90509c0 [0051.433] SelectObject (hdc=0xffffffff8c0109d7, h=0xffffffffc90509c0) returned 0x185000f [0051.433] GdipCreateFromHDC (hdc=0xffffffff8c0109d7, graphics=0x26e408) returned 0x0 [0051.433] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0051.433] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0051.433] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0051.433] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0051.433] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0051.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.434] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0051.434] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.434] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0051.434] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0051.434] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0051.434] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0051.434] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0051.434] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0051.434] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0051.434] GetSystemMetrics (nIndex=42) returned 0 [0051.434] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0051.434] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0051.434] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0051.434] IsAppThemed () returned 0x1 [0051.434] GetThemeAppProperties () returned 0x3 [0051.434] GetThemeAppProperties () returned 0x3 [0051.434] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0051.434] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0051.434] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0051.434] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0051.434] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0051.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.434] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0051.434] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.434] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0051.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.434] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0051.434] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.435] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0051.435] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0051.435] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0051.435] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0051.435] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0051.435] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0051.435] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x1) returned 0x1b00017 [0051.435] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x2) returned 0x1900010 [0051.435] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x7) returned 0xffffffffc90509c0 [0051.435] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x6) returned 0x18a002e [0051.435] SaveDC (hdc=0xffffffff8c0109d7) returned 1 [0051.435] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffff80409ff [0051.435] GetClipRgn (hdc=0xffffffff8c0109d7, hrgn=0xfffffffff80409ff) returned 0 [0051.435] SelectClipRgn (hdc=0xffffffff8c0109d7, hrgn=0xffffffffd20409f1) returned 2 [0051.435] DeleteObject (ho=0xfffffffff80409ff) returned 1 [0051.435] DeleteObject (ho=0xffffffffd20409f1) returned 1 [0051.435] OffsetViewportOrgEx (in: hdc=0xffffffff8c0109d7, x=0, y=0, lppt=0x26ad568 | out: lppt=0x26ad568) returned 1 [0051.435] OffsetViewportOrgEx (in: hdc=0xffffffff8c0109d7, x=-417, y=-278, lppt=0x26ad580 | out: lppt=0x26ad580) returned 1 [0051.435] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0051.435] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x1) returned 0x1b00017 [0051.435] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x2) returned 0x1900010 [0051.435] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x7) returned 0xffffffffc90509c0 [0051.435] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x6) returned 0x18a002e [0051.435] SaveDC (hdc=0xffffffff8c0109d7) returned 2 [0051.435] GetNearestColor (hdc=0xffffffff8c0109d7, color=0x6c4607) returned 0x6c4607 [0051.435] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa1100276 [0051.435] FillRect (hDC=0xffffffff8c0109d7, lprc=0x26de08, hbr=0xffffffffa1100276) returned 1 [0051.442] DeleteObject (ho=0xffffffffa1100276) returned 1 [0051.442] RestoreDC (hdc=0xffffffff8c0109d7, nSavedDC=-1) returned 1 [0051.442] RestoreDC (hdc=0xffffffff8c0109d7, nSavedDC=-1) returned 1 [0051.442] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8c0109d7) returned 0x0 [0051.442] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcf40dbd) returned 0x0 [0051.442] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0051.442] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0051.442] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0051.442] GetSystemMetrics (nIndex=42) returned 0 [0051.442] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0051.442] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0051.442] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0051.442] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0051.442] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0051.442] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0051.442] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0051.442] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0051.442] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x1) returned 0x1b00017 [0051.442] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x2) returned 0x1900010 [0051.443] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x7) returned 0xffffffffc90509c0 [0051.443] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x6) returned 0x18a002e [0051.443] SaveDC (hdc=0xffffffff8c0109d7) returned 1 [0051.443] GetNearestColor (hdc=0xffffffff8c0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0051.443] RestoreDC (hdc=0xffffffff8c0109d7, nSavedDC=-1) returned 1 [0051.443] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8c0109d7) returned 0x0 [0051.443] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0051.443] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0051.443] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0051.443] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0051.443] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x1) returned 0x1b00017 [0051.443] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x2) returned 0x1900010 [0051.443] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x7) returned 0xffffffffc90509c0 [0051.443] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x6) returned 0x18a002e [0051.443] SaveDC (hdc=0xffffffff8c0109d7) returned 1 [0051.443] GetTextAlign (hdc=0xffffffff8c0109d7) returned 0x0 [0051.443] GetTextColor (hdc=0xffffffff8c0109d7) returned 0x0 [0051.443] SetTextColor (hdc=0xffffffff8c0109d7, color=0xf0f0f0) returned 0x0 [0051.443] GetCurrentObject (hdc=0xffffffff8c0109d7, type=0x6) returned 0x18a002e [0051.443] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0051.444] SelectObject (hdc=0xffffffff8c0109d7, h=0x260a09ba) returned 0x18a002e [0051.444] GetBkMode (hdc=0xffffffff8c0109d7) returned 2 [0051.444] SetBkMode (hdc=0xffffffff8c0109d7, mode=1) returned 2 [0051.444] DrawTextExW (in: hdc=0xffffffff8c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26ae230 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0051.444] DrawTextExW (in: hdc=0xffffffff8c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26ae230 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0051.444] RestoreDC (hdc=0xffffffff8c0109d7, nSavedDC=-1) returned 1 [0051.444] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8c0109d7) returned 0x0 [0051.444] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0051.444] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff8c0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0051.445] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff8c0109d7) returned 0x0 [0051.445] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0051.445] SelectObject (hdc=0xffffffff8c0109d7, h=0x185000f) returned 0xffffffffc90509c0 [0051.445] DeleteDC (hdc=0xffffffff8c0109d7) returned 1 [0051.445] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0051.445] DeleteObject (ho=0xffffffffc90509c0) returned 1 [0051.448] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0051.448] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0051.448] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0051.448] WaitMessage () returned 1 [0051.675] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.675] IsWindowUnicode (hWnd=0x3015e) returned 1 [0051.675] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.675] TranslateMessage (lpMsg=0x26ee10) returned 0 [0051.675] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0051.675] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0051.675] GetCurrentThreadId () returned 0xa28 [0051.675] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0051.675] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.675] IsWindowUnicode (hWnd=0x3015e) returned 1 [0051.675] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.675] TranslateMessage (lpMsg=0x26ee10) returned 0 [0051.675] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0051.675] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0051.675] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0051.675] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff9a0109d2 [0051.675] GetObjectType (h=0x60109d6) returned 0x3 [0051.675] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffca0509c0 [0051.675] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffca0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0051.676] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffca0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0051.676] DeleteObject (ho=0xffffffffca0509c0) returned 1 [0051.676] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff8d0509d7 [0051.676] SelectObject (hdc=0xffffffff9a0109d2, h=0xffffffff8d0509d7) returned 0x185000f [0051.676] GdipCreateFromHDC (hdc=0xffffffff9a0109d2, graphics=0x26e408) returned 0x0 [0051.676] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0051.676] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0051.676] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0051.676] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0051.676] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0051.676] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.676] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0051.676] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.676] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0051.676] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0051.676] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0051.676] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0051.676] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0051.676] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0051.676] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0051.677] GetSystemMetrics (nIndex=42) returned 0 [0051.677] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0051.677] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0051.677] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0051.677] IsAppThemed () returned 0x1 [0051.677] GetThemeAppProperties () returned 0x3 [0051.677] GetThemeAppProperties () returned 0x3 [0051.677] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0051.677] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0051.677] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0051.677] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0051.677] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0051.677] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.677] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0051.677] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.677] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0051.677] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.677] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0051.677] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.677] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0051.677] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0051.677] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0051.677] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0051.677] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0051.677] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0051.677] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x1) returned 0x1b00017 [0051.677] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x2) returned 0x1900010 [0051.677] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x7) returned 0xffffffff8d0509d7 [0051.677] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x6) returned 0x18a002e [0051.678] SaveDC (hdc=0xffffffff9a0109d2) returned 1 [0051.678] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd30409f1 [0051.678] GetClipRgn (hdc=0xffffffff9a0109d2, hrgn=0xffffffffd30409f1) returned 0 [0051.678] SelectClipRgn (hdc=0xffffffff9a0109d2, hrgn=0xfffffffffb0409ff) returned 2 [0051.678] DeleteObject (ho=0xffffffffd30409f1) returned 1 [0051.678] DeleteObject (ho=0xfffffffffb0409ff) returned 1 [0051.678] OffsetViewportOrgEx (in: hdc=0xffffffff9a0109d2, x=0, y=0, lppt=0x26b0068 | out: lppt=0x26b0068) returned 1 [0051.678] OffsetViewportOrgEx (in: hdc=0xffffffff9a0109d2, x=-417, y=-278, lppt=0x26b0080 | out: lppt=0x26b0080) returned 1 [0051.678] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0051.678] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x1) returned 0x1b00017 [0051.678] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x2) returned 0x1900010 [0051.678] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x7) returned 0xffffffff8d0509d7 [0051.678] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x6) returned 0x18a002e [0051.678] SaveDC (hdc=0xffffffff9a0109d2) returned 2 [0051.678] GetNearestColor (hdc=0xffffffff9a0109d2, color=0x6c4607) returned 0x6c4607 [0051.678] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa2100276 [0051.678] FillRect (hDC=0xffffffff9a0109d2, lprc=0x26de08, hbr=0xffffffffa2100276) returned 1 [0051.684] DeleteObject (ho=0xffffffffa2100276) returned 1 [0051.685] RestoreDC (hdc=0xffffffff9a0109d2, nSavedDC=-1) returned 1 [0051.685] RestoreDC (hdc=0xffffffff9a0109d2, nSavedDC=-1) returned 1 [0051.685] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9a0109d2) returned 0x0 [0051.685] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcf20dbd) returned 0x0 [0051.685] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0051.685] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0051.685] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0051.685] GetSystemMetrics (nIndex=42) returned 0 [0051.685] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0051.685] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0051.685] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x18) returned 0x0 [0051.686] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0051.686] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0051.686] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0051.686] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0051.686] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0051.686] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0051.686] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x1) returned 0x1b00017 [0051.686] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x2) returned 0x1900010 [0051.686] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x7) returned 0xffffffff8d0509d7 [0051.686] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x6) returned 0x18a002e [0051.686] SaveDC (hdc=0xffffffff9a0109d2) returned 1 [0051.686] GetNearestColor (hdc=0xffffffff9a0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0051.686] RestoreDC (hdc=0xffffffff9a0109d2, nSavedDC=-1) returned 1 [0051.686] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9a0109d2) returned 0x0 [0051.686] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0051.686] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0051.687] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0051.687] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0051.687] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x1) returned 0x1b00017 [0051.687] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x2) returned 0x1900010 [0051.687] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x7) returned 0xffffffff8d0509d7 [0051.687] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x6) returned 0x18a002e [0051.687] SaveDC (hdc=0xffffffff9a0109d2) returned 1 [0051.687] GetTextAlign (hdc=0xffffffff9a0109d2) returned 0x0 [0051.687] GetTextColor (hdc=0xffffffff9a0109d2) returned 0x0 [0051.687] SetTextColor (hdc=0xffffffff9a0109d2, color=0xf0f0f0) returned 0x0 [0051.687] GetCurrentObject (hdc=0xffffffff9a0109d2, type=0x6) returned 0x18a002e [0051.687] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0051.687] SelectObject (hdc=0xffffffff9a0109d2, h=0x260a09ba) returned 0x18a002e [0051.687] GetBkMode (hdc=0xffffffff9a0109d2) returned 2 [0051.687] SetBkMode (hdc=0xffffffff9a0109d2, mode=1) returned 2 [0051.687] DrawTextExW (in: hdc=0xffffffff9a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26b0f30 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0051.687] DrawTextExW (in: hdc=0xffffffff9a0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26b0f30 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0051.688] RestoreDC (hdc=0xffffffff9a0109d2, nSavedDC=-1) returned 1 [0051.688] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9a0109d2) returned 0x0 [0051.688] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0051.688] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff9a0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0051.688] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9a0109d2) returned 0x0 [0051.688] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0051.688] SelectObject (hdc=0xffffffff9a0109d2, h=0x185000f) returned 0xffffffff8d0509d7 [0051.688] DeleteDC (hdc=0xffffffff9a0109d2) returned 1 [0051.688] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0051.688] DeleteObject (ho=0xffffffff8d0509d7) returned 1 [0051.691] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0051.692] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0051.692] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0051.692] WaitMessage () returned 1 [0051.872] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.872] IsWindowUnicode (hWnd=0x3015e) returned 1 [0051.872] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.872] TranslateMessage (lpMsg=0x26ee10) returned 0 [0051.872] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0051.872] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0051.872] GetCurrentThreadId () returned 0xa28 [0051.872] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0051.872] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.872] IsWindowUnicode (hWnd=0x3015e) returned 1 [0051.872] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0051.872] TranslateMessage (lpMsg=0x26ee10) returned 0 [0051.872] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0051.872] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0051.872] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0051.872] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffcc0109c0 [0051.873] GetObjectType (h=0x60109d6) returned 0x3 [0051.873] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff8e0509d7 [0051.873] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8e0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0051.873] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8e0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0051.873] DeleteObject (ho=0xffffffff8e0509d7) returned 1 [0051.873] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff9b0509d2 [0051.873] SelectObject (hdc=0xffffffffcc0109c0, h=0xffffffff9b0509d2) returned 0x185000f [0051.873] GdipCreateFromHDC (hdc=0xffffffffcc0109c0, graphics=0x26e408) returned 0x0 [0051.873] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0051.873] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0051.873] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0051.873] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0051.873] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0051.873] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.873] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0051.873] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.873] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0051.873] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0051.873] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0051.874] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0051.874] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0051.874] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0051.874] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0051.874] GetSystemMetrics (nIndex=42) returned 0 [0051.874] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0051.874] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0051.874] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0051.874] IsAppThemed () returned 0x1 [0051.874] GetThemeAppProperties () returned 0x3 [0051.874] GetThemeAppProperties () returned 0x3 [0051.874] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0051.874] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0051.874] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0051.874] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0051.874] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0051.874] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.874] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0051.874] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.874] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0051.874] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0051.874] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0051.874] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0051.874] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0051.874] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0051.874] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0051.874] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0051.874] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0051.874] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0051.874] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x1) returned 0x1b00017 [0051.875] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x2) returned 0x1900010 [0051.875] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x7) returned 0xffffffff9b0509d2 [0051.875] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x6) returned 0x18a002e [0051.875] SaveDC (hdc=0xffffffffcc0109c0) returned 1 [0051.875] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffffc0409ff [0051.875] GetClipRgn (hdc=0xffffffffcc0109c0, hrgn=0xfffffffffc0409ff) returned 0 [0051.875] SelectClipRgn (hdc=0xffffffffcc0109c0, hrgn=0xffffffffd60409f1) returned 2 [0051.875] DeleteObject (ho=0xfffffffffc0409ff) returned 1 [0051.875] DeleteObject (ho=0xffffffffd60409f1) returned 1 [0051.875] OffsetViewportOrgEx (in: hdc=0xffffffffcc0109c0, x=0, y=0, lppt=0x2793418 | out: lppt=0x2793418) returned 1 [0051.875] OffsetViewportOrgEx (in: hdc=0xffffffffcc0109c0, x=-417, y=-278, lppt=0x2793430 | out: lppt=0x2793430) returned 1 [0051.875] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0051.875] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x1) returned 0x1b00017 [0051.875] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x2) returned 0x1900010 [0051.875] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x7) returned 0xffffffff9b0509d2 [0051.875] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x6) returned 0x18a002e [0051.875] SaveDC (hdc=0xffffffffcc0109c0) returned 2 [0051.875] GetNearestColor (hdc=0xffffffffcc0109c0, color=0x6c4607) returned 0x6c4607 [0051.875] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa3100276 [0051.875] FillRect (hDC=0xffffffffcc0109c0, lprc=0x26de08, hbr=0xffffffffa3100276) returned 1 [0051.881] DeleteObject (ho=0xffffffffa3100276) returned 1 [0051.881] RestoreDC (hdc=0xffffffffcc0109c0, nSavedDC=-1) returned 1 [0051.881] RestoreDC (hdc=0xffffffffcc0109c0, nSavedDC=-1) returned 1 [0051.882] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffcc0109c0) returned 0x0 [0051.882] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcf00dbd) returned 0x0 [0051.882] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0051.882] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0051.882] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0051.882] GetSystemMetrics (nIndex=42) returned 0 [0051.882] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0051.882] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0051.882] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0051.882] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0051.882] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0051.882] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0051.882] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0051.882] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0051.882] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x1) returned 0x1b00017 [0051.882] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x2) returned 0x1900010 [0051.882] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x7) returned 0xffffffff9b0509d2 [0051.882] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x6) returned 0x18a002e [0051.882] SaveDC (hdc=0xffffffffcc0109c0) returned 1 [0051.882] GetNearestColor (hdc=0xffffffffcc0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0051.882] RestoreDC (hdc=0xffffffffcc0109c0, nSavedDC=-1) returned 1 [0051.882] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffcc0109c0) returned 0x0 [0051.883] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0051.883] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0051.883] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0051.883] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x1) returned 0x1b00017 [0051.883] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x2) returned 0x1900010 [0051.883] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x7) returned 0xffffffff9b0509d2 [0051.883] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x6) returned 0x18a002e [0051.883] SaveDC (hdc=0xffffffffcc0109c0) returned 1 [0051.883] GetTextAlign (hdc=0xffffffffcc0109c0) returned 0x0 [0051.883] GetTextColor (hdc=0xffffffffcc0109c0) returned 0x0 [0051.883] SetTextColor (hdc=0xffffffffcc0109c0, color=0xf0f0f0) returned 0x0 [0051.883] GetCurrentObject (hdc=0xffffffffcc0109c0, type=0x6) returned 0x18a002e [0051.883] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0051.883] SelectObject (hdc=0xffffffffcc0109c0, h=0x260a09ba) returned 0x18a002e [0051.883] GetBkMode (hdc=0xffffffffcc0109c0) returned 2 [0051.883] SetBkMode (hdc=0xffffffffcc0109c0, mode=1) returned 2 [0051.883] DrawTextExW (in: hdc=0xffffffffcc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27940e0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0051.884] DrawTextExW (in: hdc=0xffffffffcc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27940e0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0051.884] RestoreDC (hdc=0xffffffffcc0109c0, nSavedDC=-1) returned 1 [0051.884] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffcc0109c0) returned 0x0 [0051.884] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0051.884] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffcc0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0051.884] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffcc0109c0) returned 0x0 [0051.884] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0051.884] SelectObject (hdc=0xffffffffcc0109c0, h=0x185000f) returned 0xffffffff9b0509d2 [0051.885] DeleteDC (hdc=0xffffffffcc0109c0) returned 1 [0051.885] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0051.885] DeleteObject (ho=0xffffffff9b0509d2) returned 1 [0051.888] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0051.888] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0051.888] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0051.888] WaitMessage () returned 1 [0052.062] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.062] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.062] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.062] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.062] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.062] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0052.062] GetCurrentThreadId () returned 0xa28 [0052.062] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0052.062] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.062] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.062] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.062] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.062] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.062] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0052.063] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0052.063] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff900109d7 [0052.063] GetObjectType (h=0x60109d6) returned 0x3 [0052.063] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff9c0509d2 [0052.063] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9c0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.063] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9c0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.063] DeleteObject (ho=0xffffffff9c0509d2) returned 1 [0052.063] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffcd0509c0 [0052.063] SelectObject (hdc=0xffffffff900109d7, h=0xffffffffcd0509c0) returned 0x185000f [0052.063] GdipCreateFromHDC (hdc=0xffffffff900109d7, graphics=0x26e408) returned 0x0 [0052.063] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0052.063] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0052.063] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0052.063] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0052.063] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0052.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.064] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0052.064] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.064] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0052.064] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0052.064] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0052.064] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0052.064] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0052.064] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.064] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.064] GetSystemMetrics (nIndex=42) returned 0 [0052.064] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.064] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.064] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0052.064] IsAppThemed () returned 0x1 [0052.064] GetThemeAppProperties () returned 0x3 [0052.064] GetThemeAppProperties () returned 0x3 [0052.064] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0052.064] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0052.064] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0052.064] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0052.064] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0052.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.064] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.064] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.064] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0052.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.064] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.064] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.064] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0052.065] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0052.065] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0052.065] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0052.065] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0052.065] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0052.065] GetCurrentObject (hdc=0xffffffff900109d7, type=0x1) returned 0x1b00017 [0052.065] GetCurrentObject (hdc=0xffffffff900109d7, type=0x2) returned 0x1900010 [0052.065] GetCurrentObject (hdc=0xffffffff900109d7, type=0x7) returned 0xffffffffcd0509c0 [0052.065] GetCurrentObject (hdc=0xffffffff900109d7, type=0x6) returned 0x18a002e [0052.065] SaveDC (hdc=0xffffffff900109d7) returned 1 [0052.065] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffd70409f1 [0052.065] GetClipRgn (hdc=0xffffffff900109d7, hrgn=0xffffffffd70409f1) returned 0 [0052.065] SelectClipRgn (hdc=0xffffffff900109d7, hrgn=0xffffffffff0409ff) returned 2 [0052.065] DeleteObject (ho=0xffffffffd70409f1) returned 1 [0052.065] DeleteObject (ho=0xffffffffff0409ff) returned 1 [0052.065] OffsetViewportOrgEx (in: hdc=0xffffffff900109d7, x=0, y=0, lppt=0x26aafc8 | out: lppt=0x26aafc8) returned 1 [0052.065] OffsetViewportOrgEx (in: hdc=0xffffffff900109d7, x=-417, y=-278, lppt=0x26aafe0 | out: lppt=0x26aafe0) returned 1 [0052.065] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0052.065] GetCurrentObject (hdc=0xffffffff900109d7, type=0x1) returned 0x1b00017 [0052.065] GetCurrentObject (hdc=0xffffffff900109d7, type=0x2) returned 0x1900010 [0052.065] GetCurrentObject (hdc=0xffffffff900109d7, type=0x7) returned 0xffffffffcd0509c0 [0052.065] GetCurrentObject (hdc=0xffffffff900109d7, type=0x6) returned 0x18a002e [0052.065] SaveDC (hdc=0xffffffff900109d7) returned 2 [0052.065] GetNearestColor (hdc=0xffffffff900109d7, color=0x6c4607) returned 0x6c4607 [0052.065] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa4100276 [0052.065] FillRect (hDC=0xffffffff900109d7, lprc=0x26de08, hbr=0xffffffffa4100276) returned 1 [0052.071] DeleteObject (ho=0xffffffffa4100276) returned 1 [0052.071] RestoreDC (hdc=0xffffffff900109d7, nSavedDC=-1) returned 1 [0052.072] RestoreDC (hdc=0xffffffff900109d7, nSavedDC=-1) returned 1 [0052.072] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff900109d7) returned 0x0 [0052.072] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcee0dbd) returned 0x0 [0052.072] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0052.072] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.072] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.072] GetSystemMetrics (nIndex=42) returned 0 [0052.072] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.072] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.072] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1a) returned 0x0 [0052.073] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0052.073] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0052.073] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0052.073] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0052.073] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0052.073] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0052.073] GetCurrentObject (hdc=0xffffffff900109d7, type=0x1) returned 0x1b00017 [0052.073] GetCurrentObject (hdc=0xffffffff900109d7, type=0x2) returned 0x1900010 [0052.073] GetCurrentObject (hdc=0xffffffff900109d7, type=0x7) returned 0xffffffffcd0509c0 [0052.073] GetCurrentObject (hdc=0xffffffff900109d7, type=0x6) returned 0x18a002e [0052.073] SaveDC (hdc=0xffffffff900109d7) returned 1 [0052.073] GetNearestColor (hdc=0xffffffff900109d7, color=0xf0f0f0) returned 0xf0f0f0 [0052.073] RestoreDC (hdc=0xffffffff900109d7, nSavedDC=-1) returned 1 [0052.073] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff900109d7) returned 0x0 [0052.073] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0052.073] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0052.073] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0052.073] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0052.073] GetCurrentObject (hdc=0xffffffff900109d7, type=0x1) returned 0x1b00017 [0052.073] GetCurrentObject (hdc=0xffffffff900109d7, type=0x2) returned 0x1900010 [0052.073] GetCurrentObject (hdc=0xffffffff900109d7, type=0x7) returned 0xffffffffcd0509c0 [0052.074] GetCurrentObject (hdc=0xffffffff900109d7, type=0x6) returned 0x18a002e [0052.074] SaveDC (hdc=0xffffffff900109d7) returned 1 [0052.074] GetTextAlign (hdc=0xffffffff900109d7) returned 0x0 [0052.074] GetTextColor (hdc=0xffffffff900109d7) returned 0x0 [0052.074] SetTextColor (hdc=0xffffffff900109d7, color=0xf0f0f0) returned 0x0 [0052.074] GetCurrentObject (hdc=0xffffffff900109d7, type=0x6) returned 0x18a002e [0052.074] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0052.074] SelectObject (hdc=0xffffffff900109d7, h=0x260a09ba) returned 0x18a002e [0052.074] GetBkMode (hdc=0xffffffff900109d7) returned 2 [0052.074] SetBkMode (hdc=0xffffffff900109d7, mode=1) returned 2 [0052.074] DrawTextExW (in: hdc=0xffffffff900109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26ac028 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0052.074] DrawTextExW (in: hdc=0xffffffff900109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26ac028 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0052.075] RestoreDC (hdc=0xffffffff900109d7, nSavedDC=-1) returned 1 [0052.075] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff900109d7) returned 0x0 [0052.075] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0052.075] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff900109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0052.075] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff900109d7) returned 0x0 [0052.075] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0052.075] SelectObject (hdc=0xffffffff900109d7, h=0x185000f) returned 0xffffffffcd0509c0 [0052.075] DeleteDC (hdc=0xffffffff900109d7) returned 1 [0052.075] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0052.075] DeleteObject (ho=0xffffffffcd0509c0) returned 1 [0052.078] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0052.078] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.078] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.078] WaitMessage () returned 1 [0052.207] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.207] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.207] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.207] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.207] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.207] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0052.207] GetCurrentThreadId () returned 0xa28 [0052.207] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0052.207] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.207] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.207] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.207] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.207] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.207] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0052.207] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0052.208] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff9e0109d2 [0052.208] GetObjectType (h=0x60109d6) returned 0x3 [0052.208] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffce0509c0 [0052.208] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffce0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.208] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffce0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.208] DeleteObject (ho=0xffffffffce0509c0) returned 1 [0052.208] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff910509d7 [0052.208] SelectObject (hdc=0xffffffff9e0109d2, h=0xffffffff910509d7) returned 0x185000f [0052.208] GdipCreateFromHDC (hdc=0xffffffff9e0109d2, graphics=0x26e408) returned 0x0 [0052.208] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0052.208] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0052.208] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0052.208] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0052.208] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0052.208] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.208] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0052.208] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.208] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0052.208] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0052.208] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0052.208] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0052.209] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0052.209] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.209] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.209] GetSystemMetrics (nIndex=42) returned 0 [0052.209] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.209] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.209] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0052.209] IsAppThemed () returned 0x1 [0052.209] GetThemeAppProperties () returned 0x3 [0052.209] GetThemeAppProperties () returned 0x3 [0052.209] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0052.209] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0052.209] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0052.209] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0052.209] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0052.209] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.209] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.209] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.209] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0052.209] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.209] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.209] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.209] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0052.209] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0052.209] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0052.209] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0052.209] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0052.209] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0052.209] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x1) returned 0x1b00017 [0052.209] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x2) returned 0x1900010 [0052.209] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x7) returned 0xffffffff910509d7 [0052.209] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x6) returned 0x18a002e [0052.210] SaveDC (hdc=0xffffffff9e0109d2) returned 1 [0052.210] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x409ff [0052.210] GetClipRgn (hdc=0xffffffff9e0109d2, hrgn=0x409ff) returned 0 [0052.210] SelectClipRgn (hdc=0xffffffff9e0109d2, hrgn=0xffffffffda0409f1) returned 2 [0052.210] DeleteObject (ho=0x409ff) returned 1 [0052.210] DeleteObject (ho=0xffffffffda0409f1) returned 1 [0052.210] OffsetViewportOrgEx (in: hdc=0xffffffff9e0109d2, x=0, y=0, lppt=0x2713fe0 | out: lppt=0x2713fe0) returned 1 [0052.210] OffsetViewportOrgEx (in: hdc=0xffffffff9e0109d2, x=-417, y=-278, lppt=0x2713ff8 | out: lppt=0x2713ff8) returned 1 [0052.210] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0052.210] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x1) returned 0x1b00017 [0052.210] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x2) returned 0x1900010 [0052.210] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x7) returned 0xffffffff910509d7 [0052.210] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x6) returned 0x18a002e [0052.210] SaveDC (hdc=0xffffffff9e0109d2) returned 2 [0052.210] GetNearestColor (hdc=0xffffffff9e0109d2, color=0x6c4607) returned 0x6c4607 [0052.210] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa5100276 [0052.210] FillRect (hDC=0xffffffff9e0109d2, lprc=0x26de08, hbr=0xffffffffa5100276) returned 1 [0052.216] DeleteObject (ho=0xffffffffa5100276) returned 1 [0052.216] RestoreDC (hdc=0xffffffff9e0109d2, nSavedDC=-1) returned 1 [0052.217] RestoreDC (hdc=0xffffffff9e0109d2, nSavedDC=-1) returned 1 [0052.217] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9e0109d2) returned 0x0 [0052.217] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcec0dbd) returned 0x0 [0052.217] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0052.217] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.217] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.217] GetSystemMetrics (nIndex=42) returned 0 [0052.217] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.217] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.217] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0052.217] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0052.217] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0052.217] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0052.217] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0052.217] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0052.217] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x1) returned 0x1b00017 [0052.217] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x2) returned 0x1900010 [0052.217] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x7) returned 0xffffffff910509d7 [0052.217] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x6) returned 0x18a002e [0052.217] SaveDC (hdc=0xffffffff9e0109d2) returned 1 [0052.217] GetNearestColor (hdc=0xffffffff9e0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0052.217] RestoreDC (hdc=0xffffffff9e0109d2, nSavedDC=-1) returned 1 [0052.217] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9e0109d2) returned 0x0 [0052.218] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0052.218] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0052.218] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0052.218] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x1) returned 0x1b00017 [0052.218] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x2) returned 0x1900010 [0052.218] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x7) returned 0xffffffff910509d7 [0052.218] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x6) returned 0x18a002e [0052.218] SaveDC (hdc=0xffffffff9e0109d2) returned 1 [0052.218] GetTextAlign (hdc=0xffffffff9e0109d2) returned 0x0 [0052.218] GetTextColor (hdc=0xffffffff9e0109d2) returned 0x0 [0052.218] SetTextColor (hdc=0xffffffff9e0109d2, color=0xf0f0f0) returned 0x0 [0052.218] GetCurrentObject (hdc=0xffffffff9e0109d2, type=0x6) returned 0x18a002e [0052.218] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0052.218] SelectObject (hdc=0xffffffff9e0109d2, h=0x260a09ba) returned 0x18a002e [0052.218] GetBkMode (hdc=0xffffffff9e0109d2) returned 2 [0052.218] SetBkMode (hdc=0xffffffff9e0109d2, mode=1) returned 2 [0052.218] DrawTextExW (in: hdc=0xffffffff9e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2714ca8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0052.218] DrawTextExW (in: hdc=0xffffffff9e0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2714ca8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0052.219] RestoreDC (hdc=0xffffffff9e0109d2, nSavedDC=-1) returned 1 [0052.219] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9e0109d2) returned 0x0 [0052.219] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0052.219] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff9e0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0052.219] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9e0109d2) returned 0x0 [0052.219] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0052.219] SelectObject (hdc=0xffffffff9e0109d2, h=0x185000f) returned 0xffffffff910509d7 [0052.219] DeleteDC (hdc=0xffffffff9e0109d2) returned 1 [0052.219] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0052.219] DeleteObject (ho=0xffffffff910509d7) returned 1 [0052.222] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0052.222] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.222] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.222] WaitMessage () returned 1 [0052.389] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.389] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.389] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.389] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.389] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.389] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0052.389] GetCurrentThreadId () returned 0xa28 [0052.389] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0052.389] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.389] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.389] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.389] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.389] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.390] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0052.390] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0052.390] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffd00109c0 [0052.390] GetObjectType (h=0x60109d6) returned 0x3 [0052.390] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff920509d7 [0052.390] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff920509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.390] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff920509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.390] DeleteObject (ho=0xffffffff920509d7) returned 1 [0052.390] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff9f0509d2 [0052.390] SelectObject (hdc=0xffffffffd00109c0, h=0xffffffff9f0509d2) returned 0x185000f [0052.390] GdipCreateFromHDC (hdc=0xffffffffd00109c0, graphics=0x26e408) returned 0x0 [0052.390] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0052.390] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0052.391] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0052.391] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0052.391] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0052.391] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.391] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0052.391] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.391] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0052.391] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0052.391] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0052.391] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0052.391] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0052.391] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.391] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.391] GetSystemMetrics (nIndex=42) returned 0 [0052.391] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.391] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.391] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0052.391] IsAppThemed () returned 0x1 [0052.391] GetThemeAppProperties () returned 0x3 [0052.391] GetThemeAppProperties () returned 0x3 [0052.391] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0052.391] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0052.391] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0052.391] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0052.391] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0052.391] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.391] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.391] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.391] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0052.392] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.392] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.392] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.392] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0052.392] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0052.392] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0052.392] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0052.392] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0052.392] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0052.392] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x1) returned 0x1b00017 [0052.392] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x2) returned 0x1900010 [0052.392] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x7) returned 0xffffffff9f0509d2 [0052.392] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x6) returned 0x18a002e [0052.392] SaveDC (hdc=0xffffffffd00109c0) returned 1 [0052.392] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffdb0409f1 [0052.392] GetClipRgn (hdc=0xffffffffd00109c0, hrgn=0xffffffffdb0409f1) returned 0 [0052.392] SelectClipRgn (hdc=0xffffffffd00109c0, hrgn=0x30409ff) returned 2 [0052.392] DeleteObject (ho=0xffffffffdb0409f1) returned 1 [0052.392] DeleteObject (ho=0x30409ff) returned 1 [0052.392] OffsetViewportOrgEx (in: hdc=0xffffffffd00109c0, x=0, y=0, lppt=0x26ba318 | out: lppt=0x26ba318) returned 1 [0052.392] OffsetViewportOrgEx (in: hdc=0xffffffffd00109c0, x=-417, y=-278, lppt=0x26ba330 | out: lppt=0x26ba330) returned 1 [0052.392] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0052.392] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x1) returned 0x1b00017 [0052.392] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x2) returned 0x1900010 [0052.392] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x7) returned 0xffffffff9f0509d2 [0052.392] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x6) returned 0x18a002e [0052.392] SaveDC (hdc=0xffffffffd00109c0) returned 2 [0052.392] GetNearestColor (hdc=0xffffffffd00109c0, color=0x6c4607) returned 0x6c4607 [0052.393] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa6100276 [0052.393] FillRect (hDC=0xffffffffd00109c0, lprc=0x26de08, hbr=0xffffffffa6100276) returned 1 [0052.399] DeleteObject (ho=0xffffffffa6100276) returned 1 [0052.399] RestoreDC (hdc=0xffffffffd00109c0, nSavedDC=-1) returned 1 [0052.399] RestoreDC (hdc=0xffffffffd00109c0, nSavedDC=-1) returned 1 [0052.399] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd00109c0) returned 0x0 [0052.399] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcea0dbd) returned 0x0 [0052.399] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0052.399] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.399] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.399] GetSystemMetrics (nIndex=42) returned 0 [0052.399] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.399] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.399] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1c) returned 0x0 [0052.400] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0052.400] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0052.400] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0052.400] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0052.400] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0052.400] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0052.400] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x1) returned 0x1b00017 [0052.400] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x2) returned 0x1900010 [0052.400] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x7) returned 0xffffffff9f0509d2 [0052.400] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x6) returned 0x18a002e [0052.400] SaveDC (hdc=0xffffffffd00109c0) returned 1 [0052.401] GetNearestColor (hdc=0xffffffffd00109c0, color=0xf0f0f0) returned 0xf0f0f0 [0052.401] RestoreDC (hdc=0xffffffffd00109c0, nSavedDC=-1) returned 1 [0052.401] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd00109c0) returned 0x0 [0052.401] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0052.401] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0052.401] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0052.401] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x1) returned 0x1b00017 [0052.401] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x2) returned 0x1900010 [0052.401] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x7) returned 0xffffffff9f0509d2 [0052.401] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x6) returned 0x18a002e [0052.401] SaveDC (hdc=0xffffffffd00109c0) returned 1 [0052.401] GetTextAlign (hdc=0xffffffffd00109c0) returned 0x0 [0052.401] GetTextColor (hdc=0xffffffffd00109c0) returned 0x0 [0052.401] SetTextColor (hdc=0xffffffffd00109c0, color=0xf0f0f0) returned 0x0 [0052.401] GetCurrentObject (hdc=0xffffffffd00109c0, type=0x6) returned 0x18a002e [0052.401] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0052.401] SelectObject (hdc=0xffffffffd00109c0, h=0x260a09ba) returned 0x18a002e [0052.401] GetBkMode (hdc=0xffffffffd00109c0) returned 2 [0052.401] SetBkMode (hdc=0xffffffffd00109c0, mode=1) returned 2 [0052.401] DrawTextExW (in: hdc=0xffffffffd00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26bb1f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0052.402] DrawTextExW (in: hdc=0xffffffffd00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26bb1f0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0052.402] RestoreDC (hdc=0xffffffffd00109c0, nSavedDC=-1) returned 1 [0052.402] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd00109c0) returned 0x0 [0052.402] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0052.402] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffd00109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0052.402] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd00109c0) returned 0x0 [0052.402] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0052.403] SelectObject (hdc=0xffffffffd00109c0, h=0x185000f) returned 0xffffffff9f0509d2 [0052.403] DeleteDC (hdc=0xffffffffd00109c0) returned 1 [0052.403] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0052.403] DeleteObject (ho=0xffffffff9f0509d2) returned 1 [0052.406] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0052.406] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.406] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.406] WaitMessage () returned 1 [0052.571] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.571] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.571] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.572] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.572] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.572] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0052.572] GetCurrentThreadId () returned 0xa28 [0052.572] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0052.572] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.572] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.572] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.572] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.572] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.572] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0052.572] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0052.572] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff940109d7 [0052.572] GetObjectType (h=0x60109d6) returned 0x3 [0052.572] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffa00509d2 [0052.572] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa00509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.572] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa00509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.572] DeleteObject (ho=0xffffffffa00509d2) returned 1 [0052.572] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffd10509c0 [0052.573] SelectObject (hdc=0xffffffff940109d7, h=0xffffffffd10509c0) returned 0x185000f [0052.573] GdipCreateFromHDC (hdc=0xffffffff940109d7, graphics=0x26e408) returned 0x0 [0052.573] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0052.573] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0052.573] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0052.573] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0052.573] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0052.573] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.573] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0052.573] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.573] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0052.573] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0052.573] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0052.573] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0052.573] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0052.573] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.573] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.573] GetSystemMetrics (nIndex=42) returned 0 [0052.573] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.573] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.573] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0052.573] IsAppThemed () returned 0x1 [0052.573] GetThemeAppProperties () returned 0x3 [0052.573] GetThemeAppProperties () returned 0x3 [0052.573] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0052.574] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0052.574] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0052.574] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0052.574] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0052.574] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.574] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.574] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.574] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0052.574] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.574] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.574] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.574] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0052.574] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0052.574] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0052.574] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0052.574] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0052.574] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0052.574] GetCurrentObject (hdc=0xffffffff940109d7, type=0x1) returned 0x1b00017 [0052.574] GetCurrentObject (hdc=0xffffffff940109d7, type=0x2) returned 0x1900010 [0052.574] GetCurrentObject (hdc=0xffffffff940109d7, type=0x7) returned 0xffffffffd10509c0 [0052.574] GetCurrentObject (hdc=0xffffffff940109d7, type=0x6) returned 0x18a002e [0052.574] SaveDC (hdc=0xffffffff940109d7) returned 1 [0052.574] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x40409ff [0052.574] GetClipRgn (hdc=0xffffffff940109d7, hrgn=0x40409ff) returned 0 [0052.574] SelectClipRgn (hdc=0xffffffff940109d7, hrgn=0xffffffffde0409f1) returned 2 [0052.574] DeleteObject (ho=0x40409ff) returned 1 [0052.574] DeleteObject (ho=0xffffffffde0409f1) returned 1 [0052.574] OffsetViewportOrgEx (in: hdc=0xffffffff940109d7, x=0, y=0, lppt=0x27c6060 | out: lppt=0x27c6060) returned 1 [0052.574] OffsetViewportOrgEx (in: hdc=0xffffffff940109d7, x=-417, y=-278, lppt=0x27c6078 | out: lppt=0x27c6078) returned 1 [0052.574] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0052.574] GetCurrentObject (hdc=0xffffffff940109d7, type=0x1) returned 0x1b00017 [0052.575] GetCurrentObject (hdc=0xffffffff940109d7, type=0x2) returned 0x1900010 [0052.575] GetCurrentObject (hdc=0xffffffff940109d7, type=0x7) returned 0xffffffffd10509c0 [0052.575] GetCurrentObject (hdc=0xffffffff940109d7, type=0x6) returned 0x18a002e [0052.575] SaveDC (hdc=0xffffffff940109d7) returned 2 [0052.575] GetNearestColor (hdc=0xffffffff940109d7, color=0x6c4607) returned 0x6c4607 [0052.575] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa7100276 [0052.575] FillRect (hDC=0xffffffff940109d7, lprc=0x26de08, hbr=0xffffffffa7100276) returned 1 [0052.581] DeleteObject (ho=0xffffffffa7100276) returned 1 [0052.581] RestoreDC (hdc=0xffffffff940109d7, nSavedDC=-1) returned 1 [0052.581] RestoreDC (hdc=0xffffffff940109d7, nSavedDC=-1) returned 1 [0052.581] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff940109d7) returned 0x0 [0052.581] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffce80dbd) returned 0x0 [0052.581] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0052.581] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.581] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.581] GetSystemMetrics (nIndex=42) returned 0 [0052.581] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.581] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.581] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0052.581] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0052.581] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0052.581] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0052.581] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0052.582] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0052.582] GetCurrentObject (hdc=0xffffffff940109d7, type=0x1) returned 0x1b00017 [0052.582] GetCurrentObject (hdc=0xffffffff940109d7, type=0x2) returned 0x1900010 [0052.582] GetCurrentObject (hdc=0xffffffff940109d7, type=0x7) returned 0xffffffffd10509c0 [0052.582] GetCurrentObject (hdc=0xffffffff940109d7, type=0x6) returned 0x18a002e [0052.582] SaveDC (hdc=0xffffffff940109d7) returned 1 [0052.582] GetNearestColor (hdc=0xffffffff940109d7, color=0xf0f0f0) returned 0xf0f0f0 [0052.582] RestoreDC (hdc=0xffffffff940109d7, nSavedDC=-1) returned 1 [0052.582] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff940109d7) returned 0x0 [0052.582] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0052.582] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0052.582] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0052.582] GetCurrentObject (hdc=0xffffffff940109d7, type=0x1) returned 0x1b00017 [0052.582] GetCurrentObject (hdc=0xffffffff940109d7, type=0x2) returned 0x1900010 [0052.582] GetCurrentObject (hdc=0xffffffff940109d7, type=0x7) returned 0xffffffffd10509c0 [0052.582] GetCurrentObject (hdc=0xffffffff940109d7, type=0x6) returned 0x18a002e [0052.582] SaveDC (hdc=0xffffffff940109d7) returned 1 [0052.582] GetTextAlign (hdc=0xffffffff940109d7) returned 0x0 [0052.582] GetTextColor (hdc=0xffffffff940109d7) returned 0x0 [0052.582] SetTextColor (hdc=0xffffffff940109d7, color=0xf0f0f0) returned 0x0 [0052.582] GetCurrentObject (hdc=0xffffffff940109d7, type=0x6) returned 0x18a002e [0052.582] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0052.583] SelectObject (hdc=0xffffffff940109d7, h=0x260a09ba) returned 0x18a002e [0052.583] GetBkMode (hdc=0xffffffff940109d7) returned 2 [0052.583] SetBkMode (hdc=0xffffffff940109d7, mode=1) returned 2 [0052.583] DrawTextExW (in: hdc=0xffffffff940109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27c6d28 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0052.583] DrawTextExW (in: hdc=0xffffffff940109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27c6d28 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0052.583] RestoreDC (hdc=0xffffffff940109d7, nSavedDC=-1) returned 1 [0052.583] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff940109d7) returned 0x0 [0052.583] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0052.583] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff940109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0052.584] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff940109d7) returned 0x0 [0052.584] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0052.584] SelectObject (hdc=0xffffffff940109d7, h=0x185000f) returned 0xffffffffd10509c0 [0052.584] DeleteDC (hdc=0xffffffff940109d7) returned 1 [0052.584] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0052.584] DeleteObject (ho=0xffffffffd10509c0) returned 1 [0052.587] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0052.587] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.587] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.587] WaitMessage () returned 1 [0052.773] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.773] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.773] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.773] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.773] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.773] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0052.773] GetCurrentThreadId () returned 0xa28 [0052.773] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0052.773] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.773] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.773] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.773] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.773] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.773] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0052.773] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0052.774] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffa20109d2 [0052.774] GetObjectType (h=0x60109d6) returned 0x3 [0052.774] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffd20509c0 [0052.774] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd20509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.774] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd20509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.774] DeleteObject (ho=0xffffffffd20509c0) returned 1 [0052.774] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff950509d7 [0052.774] SelectObject (hdc=0xffffffffa20109d2, h=0xffffffff950509d7) returned 0x185000f [0052.774] GdipCreateFromHDC (hdc=0xffffffffa20109d2, graphics=0x26e408) returned 0x0 [0052.774] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0052.774] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0052.774] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0052.774] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0052.774] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0052.774] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.774] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0052.774] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.774] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0052.774] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0052.775] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0052.775] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0052.775] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0052.775] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.775] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.775] GetSystemMetrics (nIndex=42) returned 0 [0052.775] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.775] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.775] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0052.775] IsAppThemed () returned 0x1 [0052.775] GetThemeAppProperties () returned 0x3 [0052.775] GetThemeAppProperties () returned 0x3 [0052.775] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0052.775] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0052.775] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0052.775] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0052.775] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0052.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.775] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.775] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.775] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0052.775] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.775] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.775] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.775] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0052.775] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0052.775] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0052.775] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0052.775] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0052.775] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0052.776] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x1) returned 0x1b00017 [0052.776] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x2) returned 0x1900010 [0052.776] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x7) returned 0xffffffff950509d7 [0052.776] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x6) returned 0x18a002e [0052.776] SaveDC (hdc=0xffffffffa20109d2) returned 1 [0052.776] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffdf0409f1 [0052.776] GetClipRgn (hdc=0xffffffffa20109d2, hrgn=0xffffffffdf0409f1) returned 0 [0052.776] SelectClipRgn (hdc=0xffffffffa20109d2, hrgn=0x70409ff) returned 2 [0052.776] DeleteObject (ho=0xffffffffdf0409f1) returned 1 [0052.776] DeleteObject (ho=0x70409ff) returned 1 [0052.776] OffsetViewportOrgEx (in: hdc=0xffffffffa20109d2, x=0, y=0, lppt=0x26ba838 | out: lppt=0x26ba838) returned 1 [0052.776] OffsetViewportOrgEx (in: hdc=0xffffffffa20109d2, x=-417, y=-278, lppt=0x26ba850 | out: lppt=0x26ba850) returned 1 [0052.776] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0052.776] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x1) returned 0x1b00017 [0052.776] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x2) returned 0x1900010 [0052.776] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x7) returned 0xffffffff950509d7 [0052.776] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x6) returned 0x18a002e [0052.776] SaveDC (hdc=0xffffffffa20109d2) returned 2 [0052.776] GetNearestColor (hdc=0xffffffffa20109d2, color=0x6c4607) returned 0x6c4607 [0052.776] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa8100276 [0052.776] FillRect (hDC=0xffffffffa20109d2, lprc=0x26de08, hbr=0xffffffffa8100276) returned 1 [0052.783] DeleteObject (ho=0xffffffffa8100276) returned 1 [0052.783] RestoreDC (hdc=0xffffffffa20109d2, nSavedDC=-1) returned 1 [0052.783] RestoreDC (hdc=0xffffffffa20109d2, nSavedDC=-1) returned 1 [0052.783] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa20109d2) returned 0x0 [0052.783] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffce60dbd) returned 0x0 [0052.783] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0052.783] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.783] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.783] GetSystemMetrics (nIndex=42) returned 0 [0052.783] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.783] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.783] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1e) returned 0x0 [0052.784] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0052.784] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0052.784] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0052.784] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0052.784] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0052.784] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0052.784] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x1) returned 0x1b00017 [0052.784] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x2) returned 0x1900010 [0052.784] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x7) returned 0xffffffff950509d7 [0052.784] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x6) returned 0x18a002e [0052.784] SaveDC (hdc=0xffffffffa20109d2) returned 1 [0052.784] GetNearestColor (hdc=0xffffffffa20109d2, color=0xf0f0f0) returned 0xf0f0f0 [0052.784] RestoreDC (hdc=0xffffffffa20109d2, nSavedDC=-1) returned 1 [0052.784] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa20109d2) returned 0x0 [0052.784] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0052.784] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0052.785] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0052.785] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x1) returned 0x1b00017 [0052.785] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x2) returned 0x1900010 [0052.785] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x7) returned 0xffffffff950509d7 [0052.785] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x6) returned 0x18a002e [0052.785] SaveDC (hdc=0xffffffffa20109d2) returned 1 [0052.785] GetTextAlign (hdc=0xffffffffa20109d2) returned 0x0 [0052.785] GetTextColor (hdc=0xffffffffa20109d2) returned 0x0 [0052.785] SetTextColor (hdc=0xffffffffa20109d2, color=0xf0f0f0) returned 0x0 [0052.785] GetCurrentObject (hdc=0xffffffffa20109d2, type=0x6) returned 0x18a002e [0052.785] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0052.785] SelectObject (hdc=0xffffffffa20109d2, h=0x260a09ba) returned 0x18a002e [0052.785] GetBkMode (hdc=0xffffffffa20109d2) returned 2 [0052.785] SetBkMode (hdc=0xffffffffa20109d2, mode=1) returned 2 [0052.785] DrawTextExW (in: hdc=0xffffffffa20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26bb708 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0052.785] DrawTextExW (in: hdc=0xffffffffa20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26bb708 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0052.786] RestoreDC (hdc=0xffffffffa20109d2, nSavedDC=-1) returned 1 [0052.786] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa20109d2) returned 0x0 [0052.786] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0052.786] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffa20109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0052.786] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa20109d2) returned 0x0 [0052.786] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0052.786] SelectObject (hdc=0xffffffffa20109d2, h=0x185000f) returned 0xffffffff950509d7 [0052.786] DeleteDC (hdc=0xffffffffa20109d2) returned 1 [0052.786] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0052.786] DeleteObject (ho=0xffffffff950509d7) returned 1 [0052.789] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0052.790] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.790] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.790] WaitMessage () returned 1 [0052.930] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.930] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.930] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.930] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.930] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.930] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0052.930] GetCurrentThreadId () returned 0xa28 [0052.930] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0052.930] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.930] IsWindowUnicode (hWnd=0x3015e) returned 1 [0052.930] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0052.930] TranslateMessage (lpMsg=0x26ee10) returned 0 [0052.930] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0052.930] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0052.930] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0052.931] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffd40109c0 [0052.931] GetObjectType (h=0x60109d6) returned 0x3 [0052.931] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff960509d7 [0052.931] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff960509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.931] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff960509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0052.931] DeleteObject (ho=0xffffffff960509d7) returned 1 [0052.931] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffa30509d2 [0052.931] SelectObject (hdc=0xffffffffd40109c0, h=0xffffffffa30509d2) returned 0x185000f [0052.931] GdipCreateFromHDC (hdc=0xffffffffd40109c0, graphics=0x26e408) returned 0x0 [0052.931] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0052.931] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0052.931] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0052.931] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0052.931] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0052.931] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.931] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0052.931] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.931] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0052.931] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0052.932] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0052.932] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0052.932] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0052.932] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.932] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.932] GetSystemMetrics (nIndex=42) returned 0 [0052.932] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.932] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.932] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0052.932] IsAppThemed () returned 0x1 [0052.932] GetThemeAppProperties () returned 0x3 [0052.932] GetThemeAppProperties () returned 0x3 [0052.932] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0052.932] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0052.932] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0052.932] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0052.932] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0052.932] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.932] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.932] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.932] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0052.932] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0052.932] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0052.932] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0052.932] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0052.932] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0052.932] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0052.932] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0052.932] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0052.933] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0052.933] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x1) returned 0x1b00017 [0052.933] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x2) returned 0x1900010 [0052.933] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x7) returned 0xffffffffa30509d2 [0052.933] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x6) returned 0x18a002e [0052.933] SaveDC (hdc=0xffffffffd40109c0) returned 1 [0052.933] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x80409ff [0052.933] GetClipRgn (hdc=0xffffffffd40109c0, hrgn=0x80409ff) returned 0 [0052.933] SelectClipRgn (hdc=0xffffffffd40109c0, hrgn=0xffffffffe20409f1) returned 2 [0052.933] DeleteObject (ho=0x80409ff) returned 1 [0052.933] DeleteObject (ho=0xffffffffe20409f1) returned 1 [0052.933] OffsetViewportOrgEx (in: hdc=0xffffffffd40109c0, x=0, y=0, lppt=0x26bd2e8 | out: lppt=0x26bd2e8) returned 1 [0052.933] OffsetViewportOrgEx (in: hdc=0xffffffffd40109c0, x=-417, y=-278, lppt=0x26bd300 | out: lppt=0x26bd300) returned 1 [0052.933] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0052.933] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x1) returned 0x1b00017 [0052.933] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x2) returned 0x1900010 [0052.933] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x7) returned 0xffffffffa30509d2 [0052.933] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x6) returned 0x18a002e [0052.933] SaveDC (hdc=0xffffffffd40109c0) returned 2 [0052.933] GetNearestColor (hdc=0xffffffffd40109c0, color=0x6c4607) returned 0x6c4607 [0052.933] CreateSolidBrush (color=0x6c4607) returned 0xffffffffa9100276 [0052.933] FillRect (hDC=0xffffffffd40109c0, lprc=0x26de08, hbr=0xffffffffa9100276) returned 1 [0052.939] DeleteObject (ho=0xffffffffa9100276) returned 1 [0052.939] RestoreDC (hdc=0xffffffffd40109c0, nSavedDC=-1) returned 1 [0052.939] RestoreDC (hdc=0xffffffffd40109c0, nSavedDC=-1) returned 1 [0052.940] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd40109c0) returned 0x0 [0052.940] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffce40dbd) returned 0x0 [0052.940] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0052.940] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0052.940] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0052.940] GetSystemMetrics (nIndex=42) returned 0 [0052.940] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0052.940] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0052.940] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0052.940] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0052.940] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0052.940] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0052.940] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0052.940] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0052.940] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x1) returned 0x1b00017 [0052.940] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x2) returned 0x1900010 [0052.940] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x7) returned 0xffffffffa30509d2 [0052.940] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x6) returned 0x18a002e [0052.940] SaveDC (hdc=0xffffffffd40109c0) returned 1 [0052.940] GetNearestColor (hdc=0xffffffffd40109c0, color=0xf0f0f0) returned 0xf0f0f0 [0052.940] RestoreDC (hdc=0xffffffffd40109c0, nSavedDC=-1) returned 1 [0052.940] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd40109c0) returned 0x0 [0052.940] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0052.940] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0052.940] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0052.940] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x1) returned 0x1b00017 [0052.941] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x2) returned 0x1900010 [0052.941] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x7) returned 0xffffffffa30509d2 [0052.941] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x6) returned 0x18a002e [0052.941] SaveDC (hdc=0xffffffffd40109c0) returned 1 [0052.941] GetTextAlign (hdc=0xffffffffd40109c0) returned 0x0 [0052.941] GetTextColor (hdc=0xffffffffd40109c0) returned 0x0 [0052.941] SetTextColor (hdc=0xffffffffd40109c0, color=0xf0f0f0) returned 0x0 [0052.941] GetCurrentObject (hdc=0xffffffffd40109c0, type=0x6) returned 0x18a002e [0052.941] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0052.941] SelectObject (hdc=0xffffffffd40109c0, h=0x260a09ba) returned 0x18a002e [0052.941] GetBkMode (hdc=0xffffffffd40109c0) returned 2 [0052.941] SetBkMode (hdc=0xffffffffd40109c0, mode=1) returned 2 [0052.941] DrawTextExW (in: hdc=0xffffffffd40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26bdfb0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0052.941] DrawTextExW (in: hdc=0xffffffffd40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26bdfb0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0052.942] RestoreDC (hdc=0xffffffffd40109c0, nSavedDC=-1) returned 1 [0052.942] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd40109c0) returned 0x0 [0052.942] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0052.942] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffd40109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0052.942] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd40109c0) returned 0x0 [0052.942] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0052.942] SelectObject (hdc=0xffffffffd40109c0, h=0x185000f) returned 0xffffffffa30509d2 [0052.942] DeleteDC (hdc=0xffffffffd40109c0) returned 1 [0052.942] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0052.942] DeleteObject (ho=0xffffffffa30509d2) returned 1 [0052.945] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0052.945] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.945] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0052.945] WaitMessage () returned 1 [0053.179] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.179] IsWindowUnicode (hWnd=0x3015e) returned 1 [0053.179] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.179] TranslateMessage (lpMsg=0x26ee10) returned 0 [0053.179] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0053.179] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0053.179] GetCurrentThreadId () returned 0xa28 [0053.179] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0053.179] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.179] IsWindowUnicode (hWnd=0x3015e) returned 1 [0053.179] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.179] TranslateMessage (lpMsg=0x26ee10) returned 0 [0053.179] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0053.179] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0053.179] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0053.179] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff980109d7 [0053.180] GetObjectType (h=0x60109d6) returned 0x3 [0053.180] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffa40509d2 [0053.180] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa40509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0053.180] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa40509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0053.180] DeleteObject (ho=0xffffffffa40509d2) returned 1 [0053.180] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffd50509c0 [0053.180] SelectObject (hdc=0xffffffff980109d7, h=0xffffffffd50509c0) returned 0x185000f [0053.180] GdipCreateFromHDC (hdc=0xffffffff980109d7, graphics=0x26e408) returned 0x0 [0053.180] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0053.180] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0053.180] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0053.180] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0053.180] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0053.180] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.180] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0053.181] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.181] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0053.181] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0053.181] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0053.181] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0053.181] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0053.181] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0053.181] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0053.181] GetSystemMetrics (nIndex=42) returned 0 [0053.181] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0053.181] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0053.181] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0053.181] IsAppThemed () returned 0x1 [0053.181] GetThemeAppProperties () returned 0x3 [0053.181] GetThemeAppProperties () returned 0x3 [0053.181] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0053.181] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0053.181] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0053.181] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0053.181] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0053.181] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.181] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0053.181] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.181] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0053.181] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.181] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0053.181] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.181] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0053.181] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0053.181] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0053.182] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0053.182] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0053.182] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0053.182] GetCurrentObject (hdc=0xffffffff980109d7, type=0x1) returned 0x1b00017 [0053.182] GetCurrentObject (hdc=0xffffffff980109d7, type=0x2) returned 0x1900010 [0053.182] GetCurrentObject (hdc=0xffffffff980109d7, type=0x7) returned 0xffffffffd50509c0 [0053.182] GetCurrentObject (hdc=0xffffffff980109d7, type=0x6) returned 0x18a002e [0053.182] SaveDC (hdc=0xffffffff980109d7) returned 1 [0053.182] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe30409f1 [0053.182] GetClipRgn (hdc=0xffffffff980109d7, hrgn=0xffffffffe30409f1) returned 0 [0053.182] SelectClipRgn (hdc=0xffffffff980109d7, hrgn=0xb0409ff) returned 2 [0053.182] DeleteObject (ho=0xffffffffe30409f1) returned 1 [0053.182] DeleteObject (ho=0xb0409ff) returned 1 [0053.182] OffsetViewportOrgEx (in: hdc=0xffffffff980109d7, x=0, y=0, lppt=0x26c1850 | out: lppt=0x26c1850) returned 1 [0053.182] OffsetViewportOrgEx (in: hdc=0xffffffff980109d7, x=-417, y=-278, lppt=0x26c1868 | out: lppt=0x26c1868) returned 1 [0053.182] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0053.182] GetCurrentObject (hdc=0xffffffff980109d7, type=0x1) returned 0x1b00017 [0053.182] GetCurrentObject (hdc=0xffffffff980109d7, type=0x2) returned 0x1900010 [0053.182] GetCurrentObject (hdc=0xffffffff980109d7, type=0x7) returned 0xffffffffd50509c0 [0053.182] GetCurrentObject (hdc=0xffffffff980109d7, type=0x6) returned 0x18a002e [0053.182] SaveDC (hdc=0xffffffff980109d7) returned 2 [0053.182] GetNearestColor (hdc=0xffffffff980109d7, color=0x6c4607) returned 0x6c4607 [0053.182] CreateSolidBrush (color=0x6c4607) returned 0xffffffffaa100276 [0053.182] FillRect (hDC=0xffffffff980109d7, lprc=0x26de08, hbr=0xffffffffaa100276) returned 1 [0053.189] DeleteObject (ho=0xffffffffaa100276) returned 1 [0053.189] RestoreDC (hdc=0xffffffff980109d7, nSavedDC=-1) returned 1 [0053.189] RestoreDC (hdc=0xffffffff980109d7, nSavedDC=-1) returned 1 [0053.189] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff980109d7) returned 0x0 [0053.189] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffce20dbd) returned 0x0 [0053.189] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0053.189] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0053.189] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0053.191] GetSystemMetrics (nIndex=42) returned 0 [0053.191] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0053.191] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0053.191] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x20) returned 0x0 [0053.191] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0053.191] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0053.191] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0053.191] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0053.191] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0053.192] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0053.192] GetCurrentObject (hdc=0xffffffff980109d7, type=0x1) returned 0x1b00017 [0053.192] GetCurrentObject (hdc=0xffffffff980109d7, type=0x2) returned 0x1900010 [0053.192] GetCurrentObject (hdc=0xffffffff980109d7, type=0x7) returned 0xffffffffd50509c0 [0053.192] GetCurrentObject (hdc=0xffffffff980109d7, type=0x6) returned 0x18a002e [0053.192] SaveDC (hdc=0xffffffff980109d7) returned 1 [0053.192] GetNearestColor (hdc=0xffffffff980109d7, color=0xf0f0f0) returned 0xf0f0f0 [0053.192] RestoreDC (hdc=0xffffffff980109d7, nSavedDC=-1) returned 1 [0053.192] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff980109d7) returned 0x0 [0053.192] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0053.192] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0053.192] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0053.192] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0053.192] GetCurrentObject (hdc=0xffffffff980109d7, type=0x1) returned 0x1b00017 [0053.192] GetCurrentObject (hdc=0xffffffff980109d7, type=0x2) returned 0x1900010 [0053.192] GetCurrentObject (hdc=0xffffffff980109d7, type=0x7) returned 0xffffffffd50509c0 [0053.192] GetCurrentObject (hdc=0xffffffff980109d7, type=0x6) returned 0x18a002e [0053.192] SaveDC (hdc=0xffffffff980109d7) returned 1 [0053.192] GetTextAlign (hdc=0xffffffff980109d7) returned 0x0 [0053.193] GetTextColor (hdc=0xffffffff980109d7) returned 0x0 [0053.193] SetTextColor (hdc=0xffffffff980109d7, color=0xf0f0f0) returned 0x0 [0053.193] GetCurrentObject (hdc=0xffffffff980109d7, type=0x6) returned 0x18a002e [0053.193] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0053.193] SelectObject (hdc=0xffffffff980109d7, h=0x260a09ba) returned 0x18a002e [0053.193] GetBkMode (hdc=0xffffffff980109d7) returned 2 [0053.193] SetBkMode (hdc=0xffffffff980109d7, mode=1) returned 2 [0053.193] DrawTextExW (in: hdc=0xffffffff980109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c2710 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0053.193] DrawTextExW (in: hdc=0xffffffff980109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c2710 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0053.193] RestoreDC (hdc=0xffffffff980109d7, nSavedDC=-1) returned 1 [0053.193] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff980109d7) returned 0x0 [0053.193] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0053.194] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff980109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0053.194] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff980109d7) returned 0x0 [0053.194] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0053.194] SelectObject (hdc=0xffffffff980109d7, h=0x185000f) returned 0xffffffffd50509c0 [0053.194] DeleteDC (hdc=0xffffffff980109d7) returned 1 [0053.194] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0053.194] DeleteObject (ho=0xffffffffd50509c0) returned 1 [0053.197] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0053.197] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0053.197] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0053.197] WaitMessage () returned 1 [0053.421] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.421] IsWindowUnicode (hWnd=0x3015e) returned 1 [0053.421] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.421] TranslateMessage (lpMsg=0x26ee10) returned 0 [0053.421] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0053.421] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0053.421] GetCurrentThreadId () returned 0xa28 [0053.421] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0053.421] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.421] IsWindowUnicode (hWnd=0x3015e) returned 1 [0053.421] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.421] TranslateMessage (lpMsg=0x26ee10) returned 0 [0053.421] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0053.421] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0053.422] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0053.422] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffa60109d2 [0053.422] GetObjectType (h=0x60109d6) returned 0x3 [0053.422] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffd60509c0 [0053.422] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd60509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0053.422] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd60509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0053.422] DeleteObject (ho=0xffffffffd60509c0) returned 1 [0053.422] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff990509d7 [0053.422] SelectObject (hdc=0xffffffffa60109d2, h=0xffffffff990509d7) returned 0x185000f [0053.422] GdipCreateFromHDC (hdc=0xffffffffa60109d2, graphics=0x26e408) returned 0x0 [0053.422] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0053.422] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0053.422] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0053.423] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0053.423] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0053.423] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.423] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0053.423] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.423] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0053.423] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0053.423] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0053.423] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0053.423] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0053.423] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0053.423] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0053.423] GetSystemMetrics (nIndex=42) returned 0 [0053.423] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0053.423] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0053.423] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0053.423] IsAppThemed () returned 0x1 [0053.423] GetThemeAppProperties () returned 0x3 [0053.423] GetThemeAppProperties () returned 0x3 [0053.423] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0053.423] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0053.423] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0053.423] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0053.423] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0053.423] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.423] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0053.423] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.423] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0053.423] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.423] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0053.424] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.424] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0053.424] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0053.424] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0053.424] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0053.424] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0053.424] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0053.424] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x1) returned 0x1b00017 [0053.424] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x2) returned 0x1900010 [0053.424] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x7) returned 0xffffffff990509d7 [0053.424] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x6) returned 0x18a002e [0053.424] SaveDC (hdc=0xffffffffa60109d2) returned 1 [0053.424] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc0409ff [0053.424] GetClipRgn (hdc=0xffffffffa60109d2, hrgn=0xc0409ff) returned 0 [0053.424] SelectClipRgn (hdc=0xffffffffa60109d2, hrgn=0xffffffffe60409f1) returned 2 [0053.424] DeleteObject (ho=0xc0409ff) returned 1 [0053.424] DeleteObject (ho=0xffffffffe60409f1) returned 1 [0053.424] OffsetViewportOrgEx (in: hdc=0xffffffffa60109d2, x=0, y=0, lppt=0x26c42f0 | out: lppt=0x26c42f0) returned 1 [0053.424] OffsetViewportOrgEx (in: hdc=0xffffffffa60109d2, x=-417, y=-278, lppt=0x26c4308 | out: lppt=0x26c4308) returned 1 [0053.424] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0053.424] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x1) returned 0x1b00017 [0053.424] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x2) returned 0x1900010 [0053.424] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x7) returned 0xffffffff990509d7 [0053.424] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x6) returned 0x18a002e [0053.424] SaveDC (hdc=0xffffffffa60109d2) returned 2 [0053.424] GetNearestColor (hdc=0xffffffffa60109d2, color=0x6c4607) returned 0x6c4607 [0053.424] CreateSolidBrush (color=0x6c4607) returned 0xffffffffab100276 [0053.425] FillRect (hDC=0xffffffffa60109d2, lprc=0x26de08, hbr=0xffffffffab100276) returned 1 [0053.431] DeleteObject (ho=0xffffffffab100276) returned 1 [0053.431] RestoreDC (hdc=0xffffffffa60109d2, nSavedDC=-1) returned 1 [0053.431] RestoreDC (hdc=0xffffffffa60109d2, nSavedDC=-1) returned 1 [0053.431] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa60109d2) returned 0x0 [0053.431] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffce00dbd) returned 0x0 [0053.431] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0053.431] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0053.431] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0053.431] GetSystemMetrics (nIndex=42) returned 0 [0053.431] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0053.431] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0053.431] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0053.431] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0053.431] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0053.431] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0053.431] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0053.431] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0053.431] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x1) returned 0x1b00017 [0053.431] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x2) returned 0x1900010 [0053.431] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x7) returned 0xffffffff990509d7 [0053.431] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x6) returned 0x18a002e [0053.432] SaveDC (hdc=0xffffffffa60109d2) returned 1 [0053.432] GetNearestColor (hdc=0xffffffffa60109d2, color=0xf0f0f0) returned 0xf0f0f0 [0053.432] RestoreDC (hdc=0xffffffffa60109d2, nSavedDC=-1) returned 1 [0053.432] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa60109d2) returned 0x0 [0053.432] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0053.432] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0053.432] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0053.432] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0053.432] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x1) returned 0x1b00017 [0053.432] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x2) returned 0x1900010 [0053.432] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x7) returned 0xffffffff990509d7 [0053.432] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x6) returned 0x18a002e [0053.432] SaveDC (hdc=0xffffffffa60109d2) returned 1 [0053.432] GetTextAlign (hdc=0xffffffffa60109d2) returned 0x0 [0053.432] GetTextColor (hdc=0xffffffffa60109d2) returned 0x0 [0053.432] SetTextColor (hdc=0xffffffffa60109d2, color=0xf0f0f0) returned 0x0 [0053.432] GetCurrentObject (hdc=0xffffffffa60109d2, type=0x6) returned 0x18a002e [0053.432] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0053.433] SelectObject (hdc=0xffffffffa60109d2, h=0x260a09ba) returned 0x18a002e [0053.433] GetBkMode (hdc=0xffffffffa60109d2) returned 2 [0053.433] SetBkMode (hdc=0xffffffffa60109d2, mode=1) returned 2 [0053.433] DrawTextExW (in: hdc=0xffffffffa60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c4fb8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0053.433] DrawTextExW (in: hdc=0xffffffffa60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c4fb8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0053.433] RestoreDC (hdc=0xffffffffa60109d2, nSavedDC=-1) returned 1 [0053.433] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa60109d2) returned 0x0 [0053.433] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0053.433] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffa60109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0053.434] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa60109d2) returned 0x0 [0053.434] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0053.434] SelectObject (hdc=0xffffffffa60109d2, h=0x185000f) returned 0xffffffff990509d7 [0053.434] DeleteDC (hdc=0xffffffffa60109d2) returned 1 [0053.434] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0053.434] DeleteObject (ho=0xffffffff990509d7) returned 1 [0053.437] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0053.437] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0053.437] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0053.437] WaitMessage () returned 1 [0053.590] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.590] IsWindowUnicode (hWnd=0x3015e) returned 1 [0053.590] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.590] TranslateMessage (lpMsg=0x26ee10) returned 0 [0053.590] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0053.590] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0053.590] GetCurrentThreadId () returned 0xa28 [0053.590] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0053.590] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.590] IsWindowUnicode (hWnd=0x3015e) returned 1 [0053.590] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.590] TranslateMessage (lpMsg=0x26ee10) returned 0 [0053.590] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0053.590] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0053.591] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0053.591] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffd80109c0 [0053.591] GetObjectType (h=0x60109d6) returned 0x3 [0053.591] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff9a0509d7 [0053.591] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9a0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0053.591] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9a0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0053.591] DeleteObject (ho=0xffffffff9a0509d7) returned 1 [0053.591] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffa70509d2 [0053.591] SelectObject (hdc=0xffffffffd80109c0, h=0xffffffffa70509d2) returned 0x185000f [0053.591] GdipCreateFromHDC (hdc=0xffffffffd80109c0, graphics=0x26e408) returned 0x0 [0053.591] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0053.591] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0053.591] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0053.591] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0053.591] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0053.592] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.592] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0053.592] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.592] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0053.592] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0053.592] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0053.592] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0053.592] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0053.592] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0053.592] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0053.592] GetSystemMetrics (nIndex=42) returned 0 [0053.592] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0053.592] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0053.592] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0053.592] IsAppThemed () returned 0x1 [0053.592] GetThemeAppProperties () returned 0x3 [0053.592] GetThemeAppProperties () returned 0x3 [0053.592] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0053.592] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0053.592] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0053.592] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0053.592] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0053.592] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.592] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0053.592] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.592] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0053.592] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.592] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0053.592] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.593] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0053.593] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0053.593] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0053.593] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0053.593] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0053.593] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0053.593] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x1) returned 0x1b00017 [0053.593] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x2) returned 0x1900010 [0053.593] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x7) returned 0xffffffffa70509d2 [0053.593] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x6) returned 0x18a002e [0053.593] SaveDC (hdc=0xffffffffd80109c0) returned 1 [0053.593] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffe70409f1 [0053.593] GetClipRgn (hdc=0xffffffffd80109c0, hrgn=0xffffffffe70409f1) returned 0 [0053.593] SelectClipRgn (hdc=0xffffffffd80109c0, hrgn=0xf0409ff) returned 2 [0053.593] DeleteObject (ho=0xffffffffe70409f1) returned 1 [0053.593] DeleteObject (ho=0xf0409ff) returned 1 [0053.593] OffsetViewportOrgEx (in: hdc=0xffffffffd80109c0, x=0, y=0, lppt=0x26d7910 | out: lppt=0x26d7910) returned 1 [0053.593] OffsetViewportOrgEx (in: hdc=0xffffffffd80109c0, x=-417, y=-278, lppt=0x26d7928 | out: lppt=0x26d7928) returned 1 [0053.593] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0053.593] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x1) returned 0x1b00017 [0053.593] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x2) returned 0x1900010 [0053.593] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x7) returned 0xffffffffa70509d2 [0053.593] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x6) returned 0x18a002e [0053.593] SaveDC (hdc=0xffffffffd80109c0) returned 2 [0053.593] GetNearestColor (hdc=0xffffffffd80109c0, color=0x6c4607) returned 0x6c4607 [0053.593] CreateSolidBrush (color=0x6c4607) returned 0xffffffffac100276 [0053.593] FillRect (hDC=0xffffffffd80109c0, lprc=0x26de08, hbr=0xffffffffac100276) returned 1 [0053.600] DeleteObject (ho=0xffffffffac100276) returned 1 [0053.600] RestoreDC (hdc=0xffffffffd80109c0, nSavedDC=-1) returned 1 [0053.600] RestoreDC (hdc=0xffffffffd80109c0, nSavedDC=-1) returned 1 [0053.600] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd80109c0) returned 0x0 [0053.600] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcde0dbd) returned 0x0 [0053.600] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0053.600] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0053.600] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0053.600] GetSystemMetrics (nIndex=42) returned 0 [0053.600] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0053.600] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0053.600] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x22) returned 0x0 [0053.601] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0053.601] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0053.601] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0053.601] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0053.601] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0053.601] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0053.601] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x1) returned 0x1b00017 [0053.601] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x2) returned 0x1900010 [0053.601] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x7) returned 0xffffffffa70509d2 [0053.601] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x6) returned 0x18a002e [0053.601] SaveDC (hdc=0xffffffffd80109c0) returned 1 [0053.601] GetNearestColor (hdc=0xffffffffd80109c0, color=0xf0f0f0) returned 0xf0f0f0 [0053.601] RestoreDC (hdc=0xffffffffd80109c0, nSavedDC=-1) returned 1 [0053.601] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd80109c0) returned 0x0 [0053.602] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0053.602] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0053.602] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0053.602] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0053.602] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x1) returned 0x1b00017 [0053.602] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x2) returned 0x1900010 [0053.602] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x7) returned 0xffffffffa70509d2 [0053.602] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x6) returned 0x18a002e [0053.602] SaveDC (hdc=0xffffffffd80109c0) returned 1 [0053.602] GetTextAlign (hdc=0xffffffffd80109c0) returned 0x0 [0053.602] GetTextColor (hdc=0xffffffffd80109c0) returned 0x0 [0053.602] SetTextColor (hdc=0xffffffffd80109c0, color=0xf0f0f0) returned 0x0 [0053.602] GetCurrentObject (hdc=0xffffffffd80109c0, type=0x6) returned 0x18a002e [0053.602] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0053.602] SelectObject (hdc=0xffffffffd80109c0, h=0x260a09ba) returned 0x18a002e [0053.602] GetBkMode (hdc=0xffffffffd80109c0) returned 2 [0053.602] SetBkMode (hdc=0xffffffffd80109c0, mode=1) returned 2 [0053.602] DrawTextExW (in: hdc=0xffffffffd80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26d87d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0053.602] DrawTextExW (in: hdc=0xffffffffd80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26d87d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0053.603] RestoreDC (hdc=0xffffffffd80109c0, nSavedDC=-1) returned 1 [0053.603] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd80109c0) returned 0x0 [0053.603] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0053.603] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffd80109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0053.603] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd80109c0) returned 0x0 [0053.603] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0053.603] SelectObject (hdc=0xffffffffd80109c0, h=0x185000f) returned 0xffffffffa70509d2 [0053.603] DeleteDC (hdc=0xffffffffd80109c0) returned 1 [0053.603] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0053.603] DeleteObject (ho=0xffffffffa70509d2) returned 1 [0053.606] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0053.606] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0053.606] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0053.606] WaitMessage () returned 1 [0053.771] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.771] IsWindowUnicode (hWnd=0x3015e) returned 1 [0053.771] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.771] TranslateMessage (lpMsg=0x26ee10) returned 0 [0053.772] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0053.772] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0053.772] GetCurrentThreadId () returned 0xa28 [0053.772] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0053.772] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.772] IsWindowUnicode (hWnd=0x3015e) returned 1 [0053.772] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0053.772] TranslateMessage (lpMsg=0x26ee10) returned 0 [0053.772] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0053.772] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0053.772] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0053.772] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffff9c0109d7 [0053.772] GetObjectType (h=0x60109d6) returned 0x3 [0053.772] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffa80509d2 [0053.772] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa80509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0053.772] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa80509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0053.772] DeleteObject (ho=0xffffffffa80509d2) returned 1 [0053.772] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffd90509c0 [0053.772] SelectObject (hdc=0xffffffff9c0109d7, h=0xffffffffd90509c0) returned 0x185000f [0053.772] GdipCreateFromHDC (hdc=0xffffffff9c0109d7, graphics=0x26e408) returned 0x0 [0053.773] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0053.773] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0053.773] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0053.773] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0053.773] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0053.773] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.773] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0053.773] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.773] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0053.773] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0053.773] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0053.773] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0053.773] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0053.773] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0053.773] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0053.773] GetSystemMetrics (nIndex=42) returned 0 [0053.773] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0053.773] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0053.773] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0053.773] IsAppThemed () returned 0x1 [0053.773] GetThemeAppProperties () returned 0x3 [0053.773] GetThemeAppProperties () returned 0x3 [0053.773] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0053.773] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0053.773] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0053.773] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0053.773] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0053.773] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.774] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0053.774] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.774] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0053.774] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0053.774] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0053.774] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0053.774] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0053.774] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0053.774] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0053.774] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0053.774] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0053.774] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0053.774] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x1) returned 0x1b00017 [0053.774] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x2) returned 0x1900010 [0053.774] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x7) returned 0xffffffffd90509c0 [0053.774] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x6) returned 0x18a002e [0053.774] SaveDC (hdc=0xffffffff9c0109d7) returned 1 [0053.774] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x100409ff [0053.774] GetClipRgn (hdc=0xffffffff9c0109d7, hrgn=0x100409ff) returned 0 [0053.774] SelectClipRgn (hdc=0xffffffff9c0109d7, hrgn=0xffffffffea0409f1) returned 2 [0053.774] DeleteObject (ho=0x100409ff) returned 1 [0053.774] DeleteObject (ho=0xffffffffea0409f1) returned 1 [0053.774] OffsetViewportOrgEx (in: hdc=0xffffffff9c0109d7, x=0, y=0, lppt=0x27c0bb0 | out: lppt=0x27c0bb0) returned 1 [0053.774] OffsetViewportOrgEx (in: hdc=0xffffffff9c0109d7, x=-417, y=-278, lppt=0x27c0bc8 | out: lppt=0x27c0bc8) returned 1 [0053.774] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0053.774] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x1) returned 0x1b00017 [0053.774] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x2) returned 0x1900010 [0053.774] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x7) returned 0xffffffffd90509c0 [0053.774] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x6) returned 0x18a002e [0053.775] SaveDC (hdc=0xffffffff9c0109d7) returned 2 [0053.775] GetNearestColor (hdc=0xffffffff9c0109d7, color=0x6c4607) returned 0x6c4607 [0053.775] CreateSolidBrush (color=0x6c4607) returned 0xffffffffad100276 [0053.775] FillRect (hDC=0xffffffff9c0109d7, lprc=0x26de08, hbr=0xffffffffad100276) returned 1 [0053.781] DeleteObject (ho=0xffffffffad100276) returned 1 [0053.781] RestoreDC (hdc=0xffffffff9c0109d7, nSavedDC=-1) returned 1 [0053.781] RestoreDC (hdc=0xffffffff9c0109d7, nSavedDC=-1) returned 1 [0053.781] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9c0109d7) returned 0x0 [0053.781] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcdc0dbd) returned 0x0 [0053.781] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0053.781] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0053.781] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0053.781] GetSystemMetrics (nIndex=42) returned 0 [0053.781] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0053.781] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0053.781] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0053.781] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0053.781] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0053.781] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0053.782] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0053.782] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0053.782] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x1) returned 0x1b00017 [0053.782] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x2) returned 0x1900010 [0053.782] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x7) returned 0xffffffffd90509c0 [0053.782] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x6) returned 0x18a002e [0053.782] SaveDC (hdc=0xffffffff9c0109d7) returned 1 [0053.782] GetNearestColor (hdc=0xffffffff9c0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0053.782] RestoreDC (hdc=0xffffffff9c0109d7, nSavedDC=-1) returned 1 [0053.782] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9c0109d7) returned 0x0 [0053.782] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0053.782] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0053.782] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0053.782] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x1) returned 0x1b00017 [0053.782] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x2) returned 0x1900010 [0053.782] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x7) returned 0xffffffffd90509c0 [0053.782] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x6) returned 0x18a002e [0053.782] SaveDC (hdc=0xffffffff9c0109d7) returned 1 [0053.782] GetTextAlign (hdc=0xffffffff9c0109d7) returned 0x0 [0053.782] GetTextColor (hdc=0xffffffff9c0109d7) returned 0x0 [0053.782] SetTextColor (hdc=0xffffffff9c0109d7, color=0xf0f0f0) returned 0x0 [0053.782] GetCurrentObject (hdc=0xffffffff9c0109d7, type=0x6) returned 0x18a002e [0053.782] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0053.783] SelectObject (hdc=0xffffffff9c0109d7, h=0x260a09ba) returned 0x18a002e [0053.783] GetBkMode (hdc=0xffffffff9c0109d7) returned 2 [0053.783] SetBkMode (hdc=0xffffffff9c0109d7, mode=1) returned 2 [0053.783] DrawTextExW (in: hdc=0xffffffff9c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27c1878 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0053.783] DrawTextExW (in: hdc=0xffffffff9c0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27c1878 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0053.783] RestoreDC (hdc=0xffffffff9c0109d7, nSavedDC=-1) returned 1 [0053.783] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9c0109d7) returned 0x0 [0053.783] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0053.783] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffff9c0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0053.784] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffff9c0109d7) returned 0x0 [0053.784] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0053.784] SelectObject (hdc=0xffffffff9c0109d7, h=0x185000f) returned 0xffffffffd90509c0 [0053.784] DeleteDC (hdc=0xffffffff9c0109d7) returned 1 [0053.784] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0053.784] DeleteObject (ho=0xffffffffd90509c0) returned 1 [0053.787] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0053.787] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0053.787] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0053.787] WaitMessage () returned 1 [0054.005] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.005] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.005] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.005] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.005] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.005] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0054.005] GetCurrentThreadId () returned 0xa28 [0054.006] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0054.006] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.006] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.006] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.006] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.006] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.006] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0054.006] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0054.006] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffaa0109d2 [0054.006] GetObjectType (h=0x60109d6) returned 0x3 [0054.006] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffda0509c0 [0054.006] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffda0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.006] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffda0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.006] DeleteObject (ho=0xffffffffda0509c0) returned 1 [0054.006] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffff9d0509d7 [0054.007] SelectObject (hdc=0xffffffffaa0109d2, h=0xffffffff9d0509d7) returned 0x185000f [0054.007] GdipCreateFromHDC (hdc=0xffffffffaa0109d2, graphics=0x26e408) returned 0x0 [0054.007] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0054.007] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0054.007] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0054.007] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0054.007] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0054.007] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.007] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0054.007] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.007] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0054.007] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0054.007] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0054.007] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0054.007] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0054.007] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.007] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.007] GetSystemMetrics (nIndex=42) returned 0 [0054.007] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.008] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.008] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0054.008] IsAppThemed () returned 0x1 [0054.008] GetThemeAppProperties () returned 0x3 [0054.008] GetThemeAppProperties () returned 0x3 [0054.008] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0054.008] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0054.008] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0054.008] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0054.008] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0054.008] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.008] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.008] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.008] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0054.008] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.008] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.008] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.008] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0054.008] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0054.008] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0054.008] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0054.008] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0054.008] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0054.008] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x1) returned 0x1b00017 [0054.009] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x2) returned 0x1900010 [0054.009] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x7) returned 0xffffffff9d0509d7 [0054.009] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x6) returned 0x18a002e [0054.009] SaveDC (hdc=0xffffffffaa0109d2) returned 1 [0054.009] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffeb0409f1 [0054.009] GetClipRgn (hdc=0xffffffffaa0109d2, hrgn=0xffffffffeb0409f1) returned 0 [0054.009] SelectClipRgn (hdc=0xffffffffaa0109d2, hrgn=0x130409ff) returned 2 [0054.009] DeleteObject (ho=0xffffffffeb0409f1) returned 1 [0054.009] DeleteObject (ho=0x130409ff) returned 1 [0054.009] OffsetViewportOrgEx (in: hdc=0xffffffffaa0109d2, x=0, y=0, lppt=0x2769178 | out: lppt=0x2769178) returned 1 [0054.009] OffsetViewportOrgEx (in: hdc=0xffffffffaa0109d2, x=-417, y=-278, lppt=0x2769190 | out: lppt=0x2769190) returned 1 [0054.009] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0054.009] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x1) returned 0x1b00017 [0054.009] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x2) returned 0x1900010 [0054.009] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x7) returned 0xffffffff9d0509d7 [0054.009] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x6) returned 0x18a002e [0054.009] SaveDC (hdc=0xffffffffaa0109d2) returned 2 [0054.009] GetNearestColor (hdc=0xffffffffaa0109d2, color=0x6c4607) returned 0x6c4607 [0054.009] CreateSolidBrush (color=0x6c4607) returned 0xffffffffae100276 [0054.009] FillRect (hDC=0xffffffffaa0109d2, lprc=0x26de08, hbr=0xffffffffae100276) returned 1 [0054.015] DeleteObject (ho=0xffffffffae100276) returned 1 [0054.015] RestoreDC (hdc=0xffffffffaa0109d2, nSavedDC=-1) returned 1 [0054.016] RestoreDC (hdc=0xffffffffaa0109d2, nSavedDC=-1) returned 1 [0054.016] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffaa0109d2) returned 0x0 [0054.016] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcda0dbd) returned 0x0 [0054.016] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0054.016] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.016] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.016] GetSystemMetrics (nIndex=42) returned 0 [0054.016] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.016] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.016] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x24) returned 0x0 [0054.017] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0054.017] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0054.017] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0054.017] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0054.017] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0054.017] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0054.017] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x1) returned 0x1b00017 [0054.017] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x2) returned 0x1900010 [0054.017] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x7) returned 0xffffffff9d0509d7 [0054.017] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x6) returned 0x18a002e [0054.017] SaveDC (hdc=0xffffffffaa0109d2) returned 1 [0054.017] GetNearestColor (hdc=0xffffffffaa0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0054.017] RestoreDC (hdc=0xffffffffaa0109d2, nSavedDC=-1) returned 1 [0054.017] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffaa0109d2) returned 0x0 [0054.017] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0054.017] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0054.017] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0054.017] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x1) returned 0x1b00017 [0054.017] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x2) returned 0x1900010 [0054.017] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x7) returned 0xffffffff9d0509d7 [0054.017] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x6) returned 0x18a002e [0054.018] SaveDC (hdc=0xffffffffaa0109d2) returned 1 [0054.018] GetTextAlign (hdc=0xffffffffaa0109d2) returned 0x0 [0054.018] GetTextColor (hdc=0xffffffffaa0109d2) returned 0x0 [0054.018] SetTextColor (hdc=0xffffffffaa0109d2, color=0xf0f0f0) returned 0x0 [0054.018] GetCurrentObject (hdc=0xffffffffaa0109d2, type=0x6) returned 0x18a002e [0054.018] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0054.018] SelectObject (hdc=0xffffffffaa0109d2, h=0x260a09ba) returned 0x18a002e [0054.018] GetBkMode (hdc=0xffffffffaa0109d2) returned 2 [0054.018] SetBkMode (hdc=0xffffffffaa0109d2, mode=1) returned 2 [0054.018] DrawTextExW (in: hdc=0xffffffffaa0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x276a038 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0054.018] DrawTextExW (in: hdc=0xffffffffaa0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x276a038 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0054.019] RestoreDC (hdc=0xffffffffaa0109d2, nSavedDC=-1) returned 1 [0054.019] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffaa0109d2) returned 0x0 [0054.019] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0054.019] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffaa0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0054.019] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffaa0109d2) returned 0x0 [0054.019] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0054.019] SelectObject (hdc=0xffffffffaa0109d2, h=0x185000f) returned 0xffffffff9d0509d7 [0054.019] DeleteDC (hdc=0xffffffffaa0109d2) returned 1 [0054.019] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0054.019] DeleteObject (ho=0xffffffff9d0509d7) returned 1 [0054.023] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0054.023] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.023] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.023] WaitMessage () returned 1 [0054.208] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.209] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.209] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.209] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.209] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.209] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0054.209] GetCurrentThreadId () returned 0xa28 [0054.209] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0054.209] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.209] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.209] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.209] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.209] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.209] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0054.209] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0054.209] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffdc0109c0 [0054.209] GetObjectType (h=0x60109d6) returned 0x3 [0054.209] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff9e0509d7 [0054.209] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9e0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.209] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff9e0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.209] DeleteObject (ho=0xffffffff9e0509d7) returned 1 [0054.209] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffab0509d2 [0054.209] SelectObject (hdc=0xffffffffdc0109c0, h=0xffffffffab0509d2) returned 0x185000f [0054.210] GdipCreateFromHDC (hdc=0xffffffffdc0109c0, graphics=0x26e408) returned 0x0 [0054.210] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0054.210] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0054.210] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0054.210] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0054.210] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0054.210] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.210] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0054.210] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.210] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0054.210] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0054.210] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0054.210] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0054.210] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0054.210] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.210] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.210] GetSystemMetrics (nIndex=42) returned 0 [0054.210] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.210] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.210] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0054.210] IsAppThemed () returned 0x1 [0054.210] GetThemeAppProperties () returned 0x3 [0054.210] GetThemeAppProperties () returned 0x3 [0054.211] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0054.211] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0054.211] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0054.211] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0054.211] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0054.211] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.211] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.211] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.211] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0054.211] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.211] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.211] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.211] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0054.211] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0054.211] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0054.211] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0054.211] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0054.211] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0054.211] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x1) returned 0x1b00017 [0054.211] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x2) returned 0x1900010 [0054.211] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x7) returned 0xffffffffab0509d2 [0054.211] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x6) returned 0x18a002e [0054.211] SaveDC (hdc=0xffffffffdc0109c0) returned 1 [0054.211] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x140409ff [0054.211] GetClipRgn (hdc=0xffffffffdc0109c0, hrgn=0x140409ff) returned 0 [0054.211] SelectClipRgn (hdc=0xffffffffdc0109c0, hrgn=0xffffffffee0409f1) returned 2 [0054.211] DeleteObject (ho=0x140409ff) returned 1 [0054.211] DeleteObject (ho=0xffffffffee0409f1) returned 1 [0054.211] OffsetViewportOrgEx (in: hdc=0xffffffffdc0109c0, x=0, y=0, lppt=0x276bc18 | out: lppt=0x276bc18) returned 1 [0054.212] OffsetViewportOrgEx (in: hdc=0xffffffffdc0109c0, x=-417, y=-278, lppt=0x276bc30 | out: lppt=0x276bc30) returned 1 [0054.212] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0054.212] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x1) returned 0x1b00017 [0054.212] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x2) returned 0x1900010 [0054.212] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x7) returned 0xffffffffab0509d2 [0054.212] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x6) returned 0x18a002e [0054.212] SaveDC (hdc=0xffffffffdc0109c0) returned 2 [0054.212] GetNearestColor (hdc=0xffffffffdc0109c0, color=0x6c4607) returned 0x6c4607 [0054.212] CreateSolidBrush (color=0x6c4607) returned 0xffffffffaf100276 [0054.212] FillRect (hDC=0xffffffffdc0109c0, lprc=0x26de08, hbr=0xffffffffaf100276) returned 1 [0054.218] DeleteObject (ho=0xffffffffaf100276) returned 1 [0054.218] RestoreDC (hdc=0xffffffffdc0109c0, nSavedDC=-1) returned 1 [0054.218] RestoreDC (hdc=0xffffffffdc0109c0, nSavedDC=-1) returned 1 [0054.218] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffdc0109c0) returned 0x0 [0054.218] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcd80dbd) returned 0x0 [0054.218] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0054.218] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.218] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.218] GetSystemMetrics (nIndex=42) returned 0 [0054.218] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.218] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.218] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0054.218] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0054.218] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0054.219] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0054.219] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0054.219] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0054.219] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x1) returned 0x1b00017 [0054.219] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x2) returned 0x1900010 [0054.219] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x7) returned 0xffffffffab0509d2 [0054.219] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x6) returned 0x18a002e [0054.219] SaveDC (hdc=0xffffffffdc0109c0) returned 1 [0054.219] GetNearestColor (hdc=0xffffffffdc0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0054.219] RestoreDC (hdc=0xffffffffdc0109c0, nSavedDC=-1) returned 1 [0054.219] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffdc0109c0) returned 0x0 [0054.219] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0054.219] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0054.219] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0054.219] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x1) returned 0x1b00017 [0054.219] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x2) returned 0x1900010 [0054.219] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x7) returned 0xffffffffab0509d2 [0054.219] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x6) returned 0x18a002e [0054.219] SaveDC (hdc=0xffffffffdc0109c0) returned 1 [0054.219] GetTextAlign (hdc=0xffffffffdc0109c0) returned 0x0 [0054.219] GetTextColor (hdc=0xffffffffdc0109c0) returned 0x0 [0054.219] SetTextColor (hdc=0xffffffffdc0109c0, color=0xf0f0f0) returned 0x0 [0054.219] GetCurrentObject (hdc=0xffffffffdc0109c0, type=0x6) returned 0x18a002e [0054.219] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0054.219] SelectObject (hdc=0xffffffffdc0109c0, h=0x260a09ba) returned 0x18a002e [0054.220] GetBkMode (hdc=0xffffffffdc0109c0) returned 2 [0054.220] SetBkMode (hdc=0xffffffffdc0109c0, mode=1) returned 2 [0054.220] DrawTextExW (in: hdc=0xffffffffdc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x276c8e0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0054.220] DrawTextExW (in: hdc=0xffffffffdc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x276c8e0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0054.220] RestoreDC (hdc=0xffffffffdc0109c0, nSavedDC=-1) returned 1 [0054.220] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffdc0109c0) returned 0x0 [0054.220] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0054.220] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffdc0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0054.221] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffdc0109c0) returned 0x0 [0054.221] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0054.221] SelectObject (hdc=0xffffffffdc0109c0, h=0x185000f) returned 0xffffffffab0509d2 [0054.221] DeleteDC (hdc=0xffffffffdc0109c0) returned 1 [0054.221] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0054.221] DeleteObject (ho=0xffffffffab0509d2) returned 1 [0054.224] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0054.224] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.224] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.224] WaitMessage () returned 1 [0054.442] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.442] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.442] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.442] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.442] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.442] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0054.442] GetCurrentThreadId () returned 0xa28 [0054.442] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0054.442] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.442] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.442] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.443] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.443] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.443] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0054.443] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0054.443] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffa00109d7 [0054.443] GetObjectType (h=0x60109d6) returned 0x3 [0054.443] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffac0509d2 [0054.443] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffac0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.443] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffac0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.443] DeleteObject (ho=0xffffffffac0509d2) returned 1 [0054.443] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffdd0509c0 [0054.443] SelectObject (hdc=0xffffffffa00109d7, h=0xffffffffdd0509c0) returned 0x185000f [0054.443] GdipCreateFromHDC (hdc=0xffffffffa00109d7, graphics=0x26e408) returned 0x0 [0054.443] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0054.443] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0054.444] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0054.444] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0054.444] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0054.444] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.444] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0054.444] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.444] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0054.444] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0054.444] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0054.444] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0054.444] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0054.444] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.444] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.444] GetSystemMetrics (nIndex=42) returned 0 [0054.444] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.444] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.444] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0054.444] IsAppThemed () returned 0x1 [0054.444] GetThemeAppProperties () returned 0x3 [0054.444] GetThemeAppProperties () returned 0x3 [0054.444] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0054.444] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0054.444] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0054.444] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0054.444] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0054.444] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.444] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.444] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.444] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0054.445] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.445] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.445] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.445] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0054.445] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0054.445] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0054.445] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0054.445] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0054.445] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0054.445] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x1) returned 0x1b00017 [0054.445] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x2) returned 0x1900010 [0054.445] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x7) returned 0xffffffffdd0509c0 [0054.445] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x6) returned 0x18a002e [0054.445] SaveDC (hdc=0xffffffffa00109d7) returned 1 [0054.445] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffef0409f1 [0054.445] GetClipRgn (hdc=0xffffffffa00109d7, hrgn=0xffffffffef0409f1) returned 0 [0054.445] SelectClipRgn (hdc=0xffffffffa00109d7, hrgn=0x170409ff) returned 2 [0054.445] DeleteObject (ho=0xffffffffef0409f1) returned 1 [0054.445] DeleteObject (ho=0x170409ff) returned 1 [0054.445] OffsetViewportOrgEx (in: hdc=0xffffffffa00109d7, x=0, y=0, lppt=0x2770180 | out: lppt=0x2770180) returned 1 [0054.445] OffsetViewportOrgEx (in: hdc=0xffffffffa00109d7, x=-417, y=-278, lppt=0x2770198 | out: lppt=0x2770198) returned 1 [0054.445] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0054.445] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x1) returned 0x1b00017 [0054.445] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x2) returned 0x1900010 [0054.445] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x7) returned 0xffffffffdd0509c0 [0054.445] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x6) returned 0x18a002e [0054.445] SaveDC (hdc=0xffffffffa00109d7) returned 2 [0054.445] GetNearestColor (hdc=0xffffffffa00109d7, color=0x6c4607) returned 0x6c4607 [0054.446] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb0100276 [0054.446] FillRect (hDC=0xffffffffa00109d7, lprc=0x26de08, hbr=0xffffffffb0100276) returned 1 [0054.452] DeleteObject (ho=0xffffffffb0100276) returned 1 [0054.452] RestoreDC (hdc=0xffffffffa00109d7, nSavedDC=-1) returned 1 [0054.452] RestoreDC (hdc=0xffffffffa00109d7, nSavedDC=-1) returned 1 [0054.452] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa00109d7) returned 0x0 [0054.452] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcd60dbd) returned 0x0 [0054.452] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0054.452] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.452] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.452] GetSystemMetrics (nIndex=42) returned 0 [0054.452] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.452] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.452] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x26) returned 0x0 [0054.453] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0054.453] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0054.453] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0054.453] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0054.453] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0054.453] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0054.453] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x1) returned 0x1b00017 [0054.453] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x2) returned 0x1900010 [0054.453] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x7) returned 0xffffffffdd0509c0 [0054.453] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x6) returned 0x18a002e [0054.453] SaveDC (hdc=0xffffffffa00109d7) returned 1 [0054.453] GetNearestColor (hdc=0xffffffffa00109d7, color=0xf0f0f0) returned 0xf0f0f0 [0054.453] RestoreDC (hdc=0xffffffffa00109d7, nSavedDC=-1) returned 1 [0054.453] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa00109d7) returned 0x0 [0054.453] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0054.453] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0054.453] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0054.453] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x1) returned 0x1b00017 [0054.453] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x2) returned 0x1900010 [0054.453] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x7) returned 0xffffffffdd0509c0 [0054.453] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x6) returned 0x18a002e [0054.453] SaveDC (hdc=0xffffffffa00109d7) returned 1 [0054.454] GetTextAlign (hdc=0xffffffffa00109d7) returned 0x0 [0054.454] GetTextColor (hdc=0xffffffffa00109d7) returned 0x0 [0054.454] SetTextColor (hdc=0xffffffffa00109d7, color=0xf0f0f0) returned 0x0 [0054.454] GetCurrentObject (hdc=0xffffffffa00109d7, type=0x6) returned 0x18a002e [0054.454] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0054.454] SelectObject (hdc=0xffffffffa00109d7, h=0x260a09ba) returned 0x18a002e [0054.454] GetBkMode (hdc=0xffffffffa00109d7) returned 2 [0054.454] SetBkMode (hdc=0xffffffffa00109d7, mode=1) returned 2 [0054.454] DrawTextExW (in: hdc=0xffffffffa00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2771048 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0054.454] DrawTextExW (in: hdc=0xffffffffa00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2771048 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0054.454] RestoreDC (hdc=0xffffffffa00109d7, nSavedDC=-1) returned 1 [0054.454] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa00109d7) returned 0x0 [0054.455] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0054.455] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffa00109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0054.455] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa00109d7) returned 0x0 [0054.455] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0054.455] SelectObject (hdc=0xffffffffa00109d7, h=0x185000f) returned 0xffffffffdd0509c0 [0054.455] DeleteDC (hdc=0xffffffffa00109d7) returned 1 [0054.455] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0054.455] DeleteObject (ho=0xffffffffdd0509c0) returned 1 [0054.458] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0054.458] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.458] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.458] WaitMessage () returned 1 [0054.679] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.679] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.679] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.679] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.679] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.679] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0054.679] GetCurrentThreadId () returned 0xa28 [0054.679] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0054.679] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.679] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.679] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.679] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.679] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.680] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0054.680] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0054.680] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffae0109d2 [0054.680] GetObjectType (h=0x60109d6) returned 0x3 [0054.680] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffde0509c0 [0054.680] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffde0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.680] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffde0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.680] DeleteObject (ho=0xffffffffde0509c0) returned 1 [0054.680] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffa10509d7 [0054.680] SelectObject (hdc=0xffffffffae0109d2, h=0xffffffffa10509d7) returned 0x185000f [0054.680] GdipCreateFromHDC (hdc=0xffffffffae0109d2, graphics=0x26e408) returned 0x0 [0054.680] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0054.680] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0054.680] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0054.680] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0054.680] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0054.680] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.680] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0054.681] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.681] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0054.681] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0054.681] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0054.681] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0054.681] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0054.681] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.681] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.681] GetSystemMetrics (nIndex=42) returned 0 [0054.681] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.681] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.681] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0054.681] IsAppThemed () returned 0x1 [0054.681] GetThemeAppProperties () returned 0x3 [0054.681] GetThemeAppProperties () returned 0x3 [0054.681] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0054.681] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0054.681] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0054.681] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0054.681] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0054.681] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.681] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.681] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.681] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0054.681] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.681] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.681] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.681] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0054.681] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0054.681] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0054.682] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0054.682] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0054.682] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0054.682] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x1) returned 0x1b00017 [0054.682] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x2) returned 0x1900010 [0054.682] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x7) returned 0xffffffffa10509d7 [0054.682] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x6) returned 0x18a002e [0054.682] SaveDC (hdc=0xffffffffae0109d2) returned 1 [0054.682] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x180409ff [0054.682] GetClipRgn (hdc=0xffffffffae0109d2, hrgn=0x180409ff) returned 0 [0054.682] SelectClipRgn (hdc=0xffffffffae0109d2, hrgn=0xfffffffff20409f1) returned 2 [0054.682] DeleteObject (ho=0x180409ff) returned 1 [0054.682] DeleteObject (ho=0xfffffffff20409f1) returned 1 [0054.682] OffsetViewportOrgEx (in: hdc=0xffffffffae0109d2, x=0, y=0, lppt=0x2760a68 | out: lppt=0x2760a68) returned 1 [0054.682] OffsetViewportOrgEx (in: hdc=0xffffffffae0109d2, x=-417, y=-278, lppt=0x2760a80 | out: lppt=0x2760a80) returned 1 [0054.682] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0054.682] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x1) returned 0x1b00017 [0054.682] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x2) returned 0x1900010 [0054.682] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x7) returned 0xffffffffa10509d7 [0054.682] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x6) returned 0x18a002e [0054.682] SaveDC (hdc=0xffffffffae0109d2) returned 2 [0054.682] GetNearestColor (hdc=0xffffffffae0109d2, color=0x6c4607) returned 0x6c4607 [0054.682] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb1100276 [0054.682] FillRect (hDC=0xffffffffae0109d2, lprc=0x26de08, hbr=0xffffffffb1100276) returned 1 [0054.689] DeleteObject (ho=0xffffffffb1100276) returned 1 [0054.689] RestoreDC (hdc=0xffffffffae0109d2, nSavedDC=-1) returned 1 [0054.689] RestoreDC (hdc=0xffffffffae0109d2, nSavedDC=-1) returned 1 [0054.689] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffae0109d2) returned 0x0 [0054.689] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcd40dbd) returned 0x0 [0054.689] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0054.689] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.689] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.689] GetSystemMetrics (nIndex=42) returned 0 [0054.689] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.689] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.689] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0054.689] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0054.689] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0054.689] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0054.689] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0054.689] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0054.689] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x1) returned 0x1b00017 [0054.689] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x2) returned 0x1900010 [0054.689] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x7) returned 0xffffffffa10509d7 [0054.689] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x6) returned 0x18a002e [0054.689] SaveDC (hdc=0xffffffffae0109d2) returned 1 [0054.689] GetNearestColor (hdc=0xffffffffae0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0054.689] RestoreDC (hdc=0xffffffffae0109d2, nSavedDC=-1) returned 1 [0054.690] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffae0109d2) returned 0x0 [0054.690] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0054.690] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0054.690] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0054.690] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x1) returned 0x1b00017 [0054.690] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x2) returned 0x1900010 [0054.690] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x7) returned 0xffffffffa10509d7 [0054.690] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x6) returned 0x18a002e [0054.690] SaveDC (hdc=0xffffffffae0109d2) returned 1 [0054.690] GetTextAlign (hdc=0xffffffffae0109d2) returned 0x0 [0054.690] GetTextColor (hdc=0xffffffffae0109d2) returned 0x0 [0054.690] SetTextColor (hdc=0xffffffffae0109d2, color=0xf0f0f0) returned 0x0 [0054.690] GetCurrentObject (hdc=0xffffffffae0109d2, type=0x6) returned 0x18a002e [0054.690] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0054.690] SelectObject (hdc=0xffffffffae0109d2, h=0x260a09ba) returned 0x18a002e [0054.690] GetBkMode (hdc=0xffffffffae0109d2) returned 2 [0054.690] SetBkMode (hdc=0xffffffffae0109d2, mode=1) returned 2 [0054.690] DrawTextExW (in: hdc=0xffffffffae0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2761730 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0054.691] DrawTextExW (in: hdc=0xffffffffae0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2761730 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0054.691] RestoreDC (hdc=0xffffffffae0109d2, nSavedDC=-1) returned 1 [0054.691] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffae0109d2) returned 0x0 [0054.691] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0054.691] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffae0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0054.691] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffae0109d2) returned 0x0 [0054.691] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0054.691] SelectObject (hdc=0xffffffffae0109d2, h=0x185000f) returned 0xffffffffa10509d7 [0054.691] DeleteDC (hdc=0xffffffffae0109d2) returned 1 [0054.691] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0054.692] DeleteObject (ho=0xffffffffa10509d7) returned 1 [0054.695] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0054.695] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.695] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.695] WaitMessage () returned 1 [0054.863] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.863] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.863] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.863] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.863] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.863] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0054.863] GetCurrentThreadId () returned 0xa28 [0054.864] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0054.864] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.864] IsWindowUnicode (hWnd=0x3015e) returned 1 [0054.864] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0054.864] TranslateMessage (lpMsg=0x26ee10) returned 0 [0054.864] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0054.864] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0054.864] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0054.864] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffe00109c0 [0054.864] GetObjectType (h=0x60109d6) returned 0x3 [0054.864] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffa20509d7 [0054.864] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa20509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.864] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa20509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0054.864] DeleteObject (ho=0xffffffffa20509d7) returned 1 [0054.864] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffaf0509d2 [0054.864] SelectObject (hdc=0xffffffffe00109c0, h=0xffffffffaf0509d2) returned 0x185000f [0054.864] GdipCreateFromHDC (hdc=0xffffffffe00109c0, graphics=0x26e408) returned 0x0 [0054.865] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0054.865] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0054.865] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0054.865] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0054.865] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0054.865] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.865] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0054.865] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.865] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0054.865] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0054.865] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0054.865] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0054.865] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0054.865] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.865] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.865] GetSystemMetrics (nIndex=42) returned 0 [0054.865] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.865] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.865] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0054.865] IsAppThemed () returned 0x1 [0054.865] GetThemeAppProperties () returned 0x3 [0054.865] GetThemeAppProperties () returned 0x3 [0054.865] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0054.865] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0054.865] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0054.865] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0054.865] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0054.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.866] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.866] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.866] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0054.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0054.866] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0054.866] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0054.866] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0054.866] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0054.866] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0054.866] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0054.866] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0054.866] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0054.866] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x1) returned 0x1b00017 [0054.866] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x2) returned 0x1900010 [0054.866] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x7) returned 0xffffffffaf0509d2 [0054.866] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x6) returned 0x18a002e [0054.866] SaveDC (hdc=0xffffffffe00109c0) returned 1 [0054.866] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffff30409f1 [0054.866] GetClipRgn (hdc=0xffffffffe00109c0, hrgn=0xfffffffff30409f1) returned 0 [0054.866] SelectClipRgn (hdc=0xffffffffe00109c0, hrgn=0x1b0409ff) returned 2 [0054.866] DeleteObject (ho=0xfffffffff30409f1) returned 1 [0054.866] DeleteObject (ho=0x1b0409ff) returned 1 [0054.866] OffsetViewportOrgEx (in: hdc=0xffffffffe00109c0, x=0, y=0, lppt=0x26a61e8 | out: lppt=0x26a61e8) returned 1 [0054.866] OffsetViewportOrgEx (in: hdc=0xffffffffe00109c0, x=-417, y=-278, lppt=0x26a6200 | out: lppt=0x26a6200) returned 1 [0054.866] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0054.866] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x1) returned 0x1b00017 [0054.866] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x2) returned 0x1900010 [0054.867] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x7) returned 0xffffffffaf0509d2 [0054.867] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x6) returned 0x18a002e [0054.867] SaveDC (hdc=0xffffffffe00109c0) returned 2 [0054.867] GetNearestColor (hdc=0xffffffffe00109c0, color=0x6c4607) returned 0x6c4607 [0054.867] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb2100276 [0054.867] FillRect (hDC=0xffffffffe00109c0, lprc=0x26de08, hbr=0xffffffffb2100276) returned 1 [0054.873] DeleteObject (ho=0xffffffffb2100276) returned 1 [0054.873] RestoreDC (hdc=0xffffffffe00109c0, nSavedDC=-1) returned 1 [0054.873] RestoreDC (hdc=0xffffffffe00109c0, nSavedDC=-1) returned 1 [0054.873] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe00109c0) returned 0x0 [0054.873] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcd20dbd) returned 0x0 [0054.873] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0054.873] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0054.873] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0054.873] GetSystemMetrics (nIndex=42) returned 0 [0054.873] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0054.873] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0054.873] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x28) returned 0x0 [0054.874] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0054.874] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0054.874] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0054.874] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0054.874] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0054.874] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0054.874] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x1) returned 0x1b00017 [0054.874] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x2) returned 0x1900010 [0054.874] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x7) returned 0xffffffffaf0509d2 [0054.874] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x6) returned 0x18a002e [0054.874] SaveDC (hdc=0xffffffffe00109c0) returned 1 [0054.874] GetNearestColor (hdc=0xffffffffe00109c0, color=0xf0f0f0) returned 0xf0f0f0 [0054.874] RestoreDC (hdc=0xffffffffe00109c0, nSavedDC=-1) returned 1 [0054.874] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe00109c0) returned 0x0 [0054.875] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0054.875] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0054.875] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0054.875] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0054.875] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x1) returned 0x1b00017 [0054.875] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x2) returned 0x1900010 [0054.875] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x7) returned 0xffffffffaf0509d2 [0054.875] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x6) returned 0x18a002e [0054.875] SaveDC (hdc=0xffffffffe00109c0) returned 1 [0054.875] GetTextAlign (hdc=0xffffffffe00109c0) returned 0x0 [0054.875] GetTextColor (hdc=0xffffffffe00109c0) returned 0x0 [0054.875] SetTextColor (hdc=0xffffffffe00109c0, color=0xf0f0f0) returned 0x0 [0054.875] GetCurrentObject (hdc=0xffffffffe00109c0, type=0x6) returned 0x18a002e [0054.875] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0054.875] SelectObject (hdc=0xffffffffe00109c0, h=0x260a09ba) returned 0x18a002e [0054.875] GetBkMode (hdc=0xffffffffe00109c0) returned 2 [0054.875] SetBkMode (hdc=0xffffffffe00109c0, mode=1) returned 2 [0054.875] DrawTextExW (in: hdc=0xffffffffe00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a70b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0054.875] DrawTextExW (in: hdc=0xffffffffe00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a70b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0054.876] RestoreDC (hdc=0xffffffffe00109c0, nSavedDC=-1) returned 1 [0054.876] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe00109c0) returned 0x0 [0054.876] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0054.876] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffe00109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0054.876] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe00109c0) returned 0x0 [0054.876] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0054.876] SelectObject (hdc=0xffffffffe00109c0, h=0x185000f) returned 0xffffffffaf0509d2 [0054.876] DeleteDC (hdc=0xffffffffe00109c0) returned 1 [0054.876] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0054.876] DeleteObject (ho=0xffffffffaf0509d2) returned 1 [0054.880] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0054.880] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.880] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0054.880] WaitMessage () returned 1 [0055.012] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.013] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.013] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.013] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.013] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.013] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0055.013] GetCurrentThreadId () returned 0xa28 [0055.013] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0055.013] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.013] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.013] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.013] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.013] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.013] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0055.013] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0055.014] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffa40109d7 [0055.014] GetObjectType (h=0x60109d6) returned 0x3 [0055.014] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffb00509d2 [0055.014] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb00509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.014] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb00509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.014] DeleteObject (ho=0xffffffffb00509d2) returned 1 [0055.014] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffe10509c0 [0055.015] SelectObject (hdc=0xffffffffa40109d7, h=0xffffffffe10509c0) returned 0x185000f [0055.015] GdipCreateFromHDC (hdc=0xffffffffa40109d7, graphics=0x26e408) returned 0x0 [0055.015] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0055.015] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0055.016] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0055.016] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0055.016] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0055.016] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.016] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0055.016] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.016] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0055.016] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0055.016] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0055.016] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0055.016] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0055.016] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.016] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.016] GetSystemMetrics (nIndex=42) returned 0 [0055.016] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.016] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.016] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0055.016] IsAppThemed () returned 0x1 [0055.016] GetThemeAppProperties () returned 0x3 [0055.017] GetThemeAppProperties () returned 0x3 [0055.017] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0055.017] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0055.017] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0055.017] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0055.017] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0055.017] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.017] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.017] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.017] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0055.017] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.017] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.017] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.017] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0055.017] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0055.017] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0055.017] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0055.017] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0055.017] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0055.017] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x1) returned 0x1b00017 [0055.017] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x2) returned 0x1900010 [0055.017] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x7) returned 0xffffffffe10509c0 [0055.017] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x6) returned 0x18a002e [0055.017] SaveDC (hdc=0xffffffffa40109d7) returned 1 [0055.017] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1c0409ff [0055.018] GetClipRgn (hdc=0xffffffffa40109d7, hrgn=0x1c0409ff) returned 0 [0055.018] SelectClipRgn (hdc=0xffffffffa40109d7, hrgn=0xfffffffff60409f1) returned 2 [0055.018] DeleteObject (ho=0x1c0409ff) returned 1 [0055.018] DeleteObject (ho=0xfffffffff60409f1) returned 1 [0055.018] OffsetViewportOrgEx (in: hdc=0xffffffffa40109d7, x=0, y=0, lppt=0x26a8c90 | out: lppt=0x26a8c90) returned 1 [0055.018] OffsetViewportOrgEx (in: hdc=0xffffffffa40109d7, x=-417, y=-278, lppt=0x26a8ca8 | out: lppt=0x26a8ca8) returned 1 [0055.018] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0055.018] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x1) returned 0x1b00017 [0055.018] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x2) returned 0x1900010 [0055.018] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x7) returned 0xffffffffe10509c0 [0055.018] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x6) returned 0x18a002e [0055.018] SaveDC (hdc=0xffffffffa40109d7) returned 2 [0055.018] GetNearestColor (hdc=0xffffffffa40109d7, color=0x6c4607) returned 0x6c4607 [0055.018] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb3100276 [0055.018] FillRect (hDC=0xffffffffa40109d7, lprc=0x26de08, hbr=0xffffffffb3100276) returned 1 [0055.031] DeleteObject (ho=0xffffffffb3100276) returned 1 [0055.031] RestoreDC (hdc=0xffffffffa40109d7, nSavedDC=-1) returned 1 [0055.031] RestoreDC (hdc=0xffffffffa40109d7, nSavedDC=-1) returned 1 [0055.031] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa40109d7) returned 0x0 [0055.031] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcd00dbd) returned 0x0 [0055.031] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0055.031] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.031] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.031] GetSystemMetrics (nIndex=42) returned 0 [0055.031] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.031] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.031] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0055.031] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0055.031] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0055.031] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0055.031] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0055.032] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0055.032] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x1) returned 0x1b00017 [0055.032] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x2) returned 0x1900010 [0055.032] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x7) returned 0xffffffffe10509c0 [0055.032] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x6) returned 0x18a002e [0055.032] SaveDC (hdc=0xffffffffa40109d7) returned 1 [0055.032] GetNearestColor (hdc=0xffffffffa40109d7, color=0xf0f0f0) returned 0xf0f0f0 [0055.032] RestoreDC (hdc=0xffffffffa40109d7, nSavedDC=-1) returned 1 [0055.032] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa40109d7) returned 0x0 [0055.032] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0055.033] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0055.033] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0055.033] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0055.033] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x1) returned 0x1b00017 [0055.033] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x2) returned 0x1900010 [0055.033] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x7) returned 0xffffffffe10509c0 [0055.033] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x6) returned 0x18a002e [0055.033] SaveDC (hdc=0xffffffffa40109d7) returned 1 [0055.033] GetTextAlign (hdc=0xffffffffa40109d7) returned 0x0 [0055.033] GetTextColor (hdc=0xffffffffa40109d7) returned 0x0 [0055.033] SetTextColor (hdc=0xffffffffa40109d7, color=0xf0f0f0) returned 0x0 [0055.033] GetCurrentObject (hdc=0xffffffffa40109d7, type=0x6) returned 0x18a002e [0055.033] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0055.033] SelectObject (hdc=0xffffffffa40109d7, h=0x260a09ba) returned 0x18a002e [0055.033] GetBkMode (hdc=0xffffffffa40109d7) returned 2 [0055.033] SetBkMode (hdc=0xffffffffa40109d7, mode=1) returned 2 [0055.033] DrawTextExW (in: hdc=0xffffffffa40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a9958 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0055.034] DrawTextExW (in: hdc=0xffffffffa40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a9958 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0055.035] RestoreDC (hdc=0xffffffffa40109d7, nSavedDC=-1) returned 1 [0055.035] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa40109d7) returned 0x0 [0055.035] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0055.035] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffa40109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0055.036] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa40109d7) returned 0x0 [0055.036] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0055.036] SelectObject (hdc=0xffffffffa40109d7, h=0x185000f) returned 0xffffffffe10509c0 [0055.036] DeleteDC (hdc=0xffffffffa40109d7) returned 1 [0055.036] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0055.036] DeleteObject (ho=0xffffffffe10509c0) returned 1 [0055.039] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0055.039] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0055.039] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0055.039] WaitMessage () returned 1 [0055.316] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.316] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.316] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.316] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.316] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.316] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0055.316] GetCurrentThreadId () returned 0xa28 [0055.316] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0055.316] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.316] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.316] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.316] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.316] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.316] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0055.316] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0055.316] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffb20109d2 [0055.316] GetObjectType (h=0x60109d6) returned 0x3 [0055.316] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffe20509c0 [0055.317] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe20509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.317] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe20509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.317] DeleteObject (ho=0xffffffffe20509c0) returned 1 [0055.317] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffa50509d7 [0055.317] SelectObject (hdc=0xffffffffb20109d2, h=0xffffffffa50509d7) returned 0x185000f [0055.317] GdipCreateFromHDC (hdc=0xffffffffb20109d2, graphics=0x26e408) returned 0x0 [0055.317] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0055.317] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0055.317] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0055.317] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0055.317] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0055.317] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.317] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0055.317] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.317] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0055.317] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0055.317] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0055.317] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0055.317] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0055.318] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.318] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.318] GetSystemMetrics (nIndex=42) returned 0 [0055.318] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.318] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.318] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0055.318] IsAppThemed () returned 0x1 [0055.318] GetThemeAppProperties () returned 0x3 [0055.318] GetThemeAppProperties () returned 0x3 [0055.318] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0055.318] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0055.318] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0055.318] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0055.318] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0055.318] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.318] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.318] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.318] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0055.318] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.318] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.318] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.318] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0055.318] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0055.318] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0055.318] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0055.318] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0055.318] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0055.318] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x1) returned 0x1b00017 [0055.318] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x2) returned 0x1900010 [0055.318] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x7) returned 0xffffffffa50509d7 [0055.319] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x6) returned 0x18a002e [0055.319] SaveDC (hdc=0xffffffffb20109d2) returned 1 [0055.319] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffff70409f1 [0055.319] GetClipRgn (hdc=0xffffffffb20109d2, hrgn=0xfffffffff70409f1) returned 0 [0055.319] SelectClipRgn (hdc=0xffffffffb20109d2, hrgn=0x1f0409ff) returned 2 [0055.319] DeleteObject (ho=0xfffffffff70409f1) returned 1 [0055.319] DeleteObject (ho=0x1f0409ff) returned 1 [0055.319] OffsetViewportOrgEx (in: hdc=0xffffffffb20109d2, x=0, y=0, lppt=0x26ad200 | out: lppt=0x26ad200) returned 1 [0055.319] OffsetViewportOrgEx (in: hdc=0xffffffffb20109d2, x=-417, y=-278, lppt=0x26ad218 | out: lppt=0x26ad218) returned 1 [0055.319] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0055.319] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x1) returned 0x1b00017 [0055.319] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x2) returned 0x1900010 [0055.319] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x7) returned 0xffffffffa50509d7 [0055.319] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x6) returned 0x18a002e [0055.319] SaveDC (hdc=0xffffffffb20109d2) returned 2 [0055.319] GetNearestColor (hdc=0xffffffffb20109d2, color=0x6c4607) returned 0x6c4607 [0055.319] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb4100276 [0055.319] FillRect (hDC=0xffffffffb20109d2, lprc=0x26de08, hbr=0xffffffffb4100276) returned 1 [0055.325] DeleteObject (ho=0xffffffffb4100276) returned 1 [0055.325] RestoreDC (hdc=0xffffffffb20109d2, nSavedDC=-1) returned 1 [0055.325] RestoreDC (hdc=0xffffffffb20109d2, nSavedDC=-1) returned 1 [0055.325] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb20109d2) returned 0x0 [0055.325] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcce0dbd) returned 0x0 [0055.325] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0055.326] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.326] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.326] GetSystemMetrics (nIndex=42) returned 0 [0055.326] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.326] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.326] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2a) returned 0x0 [0055.328] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0055.328] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0055.328] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0055.328] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0055.328] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0055.328] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0055.328] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x1) returned 0x1b00017 [0055.328] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x2) returned 0x1900010 [0055.328] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x7) returned 0xffffffffa50509d7 [0055.328] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x6) returned 0x18a002e [0055.328] SaveDC (hdc=0xffffffffb20109d2) returned 1 [0055.328] GetNearestColor (hdc=0xffffffffb20109d2, color=0xf0f0f0) returned 0xf0f0f0 [0055.328] RestoreDC (hdc=0xffffffffb20109d2, nSavedDC=-1) returned 1 [0055.328] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb20109d2) returned 0x0 [0055.329] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0055.329] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0055.329] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0055.329] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0055.329] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x1) returned 0x1b00017 [0055.329] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x2) returned 0x1900010 [0055.329] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x7) returned 0xffffffffa50509d7 [0055.329] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x6) returned 0x18a002e [0055.329] SaveDC (hdc=0xffffffffb20109d2) returned 1 [0055.329] GetTextAlign (hdc=0xffffffffb20109d2) returned 0x0 [0055.329] GetTextColor (hdc=0xffffffffb20109d2) returned 0x0 [0055.329] SetTextColor (hdc=0xffffffffb20109d2, color=0xf0f0f0) returned 0x0 [0055.329] GetCurrentObject (hdc=0xffffffffb20109d2, type=0x6) returned 0x18a002e [0055.329] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0055.329] SelectObject (hdc=0xffffffffb20109d2, h=0x260a09ba) returned 0x18a002e [0055.329] GetBkMode (hdc=0xffffffffb20109d2) returned 2 [0055.329] SetBkMode (hdc=0xffffffffb20109d2, mode=1) returned 2 [0055.329] DrawTextExW (in: hdc=0xffffffffb20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26ae0c8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0055.329] DrawTextExW (in: hdc=0xffffffffb20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26ae0c8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0055.330] RestoreDC (hdc=0xffffffffb20109d2, nSavedDC=-1) returned 1 [0055.330] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb20109d2) returned 0x0 [0055.330] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0055.330] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffb20109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0055.330] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb20109d2) returned 0x0 [0055.330] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0055.330] SelectObject (hdc=0xffffffffb20109d2, h=0x185000f) returned 0xffffffffa50509d7 [0055.330] DeleteDC (hdc=0xffffffffb20109d2) returned 1 [0055.330] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0055.330] DeleteObject (ho=0xffffffffa50509d7) returned 1 [0055.337] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0055.337] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0055.337] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0055.337] WaitMessage () returned 1 [0055.519] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.519] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.519] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.519] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.519] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.519] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0055.519] GetCurrentThreadId () returned 0xa28 [0055.519] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0055.519] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.519] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.519] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.519] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.519] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.519] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0055.519] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0055.519] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffe40109c0 [0055.519] GetObjectType (h=0x60109d6) returned 0x3 [0055.519] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffa60509d7 [0055.519] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa60509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.519] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffa60509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.519] DeleteObject (ho=0xffffffffa60509d7) returned 1 [0055.520] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffb30509d2 [0055.520] SelectObject (hdc=0xffffffffe40109c0, h=0xffffffffb30509d2) returned 0x185000f [0055.520] GdipCreateFromHDC (hdc=0xffffffffe40109c0, graphics=0x26e408) returned 0x0 [0055.520] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0055.520] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0055.520] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0055.520] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0055.520] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0055.520] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.520] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0055.520] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.520] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0055.520] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0055.520] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0055.520] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0055.520] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0055.520] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.520] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.520] GetSystemMetrics (nIndex=42) returned 0 [0055.520] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.520] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.521] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0055.521] IsAppThemed () returned 0x1 [0055.521] GetThemeAppProperties () returned 0x3 [0055.521] GetThemeAppProperties () returned 0x3 [0055.521] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0055.521] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0055.521] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0055.521] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0055.521] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0055.521] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.521] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.521] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.521] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0055.521] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.521] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.521] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.521] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0055.521] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0055.521] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0055.521] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0055.521] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0055.521] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0055.521] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x1) returned 0x1b00017 [0055.521] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x2) returned 0x1900010 [0055.521] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x7) returned 0xffffffffb30509d2 [0055.521] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x6) returned 0x18a002e [0055.521] SaveDC (hdc=0xffffffffe40109c0) returned 1 [0055.521] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x200409ff [0055.521] GetClipRgn (hdc=0xffffffffe40109c0, hrgn=0x200409ff) returned 0 [0055.521] SelectClipRgn (hdc=0xffffffffe40109c0, hrgn=0xfffffffffa0409f1) returned 2 [0055.522] DeleteObject (ho=0x200409ff) returned 1 [0055.522] DeleteObject (ho=0xfffffffffa0409f1) returned 1 [0055.522] OffsetViewportOrgEx (in: hdc=0xffffffffe40109c0, x=0, y=0, lppt=0x26afca8 | out: lppt=0x26afca8) returned 1 [0055.522] OffsetViewportOrgEx (in: hdc=0xffffffffe40109c0, x=-417, y=-278, lppt=0x26afcc0 | out: lppt=0x26afcc0) returned 1 [0055.522] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0055.522] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x1) returned 0x1b00017 [0055.522] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x2) returned 0x1900010 [0055.522] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x7) returned 0xffffffffb30509d2 [0055.522] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x6) returned 0x18a002e [0055.522] SaveDC (hdc=0xffffffffe40109c0) returned 2 [0055.522] GetNearestColor (hdc=0xffffffffe40109c0, color=0x6c4607) returned 0x6c4607 [0055.522] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb5100276 [0055.522] FillRect (hDC=0xffffffffe40109c0, lprc=0x26de08, hbr=0xffffffffb5100276) returned 1 [0055.528] DeleteObject (ho=0xffffffffb5100276) returned 1 [0055.528] RestoreDC (hdc=0xffffffffe40109c0, nSavedDC=-1) returned 1 [0055.529] RestoreDC (hdc=0xffffffffe40109c0, nSavedDC=-1) returned 1 [0055.529] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe40109c0) returned 0x0 [0055.529] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffccc0dbd) returned 0x0 [0055.529] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0055.529] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.529] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.529] GetSystemMetrics (nIndex=42) returned 0 [0055.529] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.529] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.529] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0055.529] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0055.529] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0055.529] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0055.529] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0055.529] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0055.529] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x1) returned 0x1b00017 [0055.529] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x2) returned 0x1900010 [0055.529] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x7) returned 0xffffffffb30509d2 [0055.529] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x6) returned 0x18a002e [0055.529] SaveDC (hdc=0xffffffffe40109c0) returned 1 [0055.529] GetNearestColor (hdc=0xffffffffe40109c0, color=0xf0f0f0) returned 0xf0f0f0 [0055.529] RestoreDC (hdc=0xffffffffe40109c0, nSavedDC=-1) returned 1 [0055.529] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe40109c0) returned 0x0 [0055.530] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0055.530] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0055.530] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0055.530] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0055.530] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x1) returned 0x1b00017 [0055.530] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x2) returned 0x1900010 [0055.530] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x7) returned 0xffffffffb30509d2 [0055.530] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x6) returned 0x18a002e [0055.530] SaveDC (hdc=0xffffffffe40109c0) returned 1 [0055.530] GetTextAlign (hdc=0xffffffffe40109c0) returned 0x0 [0055.530] GetTextColor (hdc=0xffffffffe40109c0) returned 0x0 [0055.530] SetTextColor (hdc=0xffffffffe40109c0, color=0xf0f0f0) returned 0x0 [0055.530] GetCurrentObject (hdc=0xffffffffe40109c0, type=0x6) returned 0x18a002e [0055.530] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0055.530] SelectObject (hdc=0xffffffffe40109c0, h=0x260a09ba) returned 0x18a002e [0055.530] GetBkMode (hdc=0xffffffffe40109c0) returned 2 [0055.530] SetBkMode (hdc=0xffffffffe40109c0, mode=1) returned 2 [0055.530] DrawTextExW (in: hdc=0xffffffffe40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26b0970 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0055.530] DrawTextExW (in: hdc=0xffffffffe40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26b0970 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0055.531] RestoreDC (hdc=0xffffffffe40109c0, nSavedDC=-1) returned 1 [0055.531] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe40109c0) returned 0x0 [0055.531] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0055.531] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffe40109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0055.531] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe40109c0) returned 0x0 [0055.531] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0055.531] SelectObject (hdc=0xffffffffe40109c0, h=0x185000f) returned 0xffffffffb30509d2 [0055.531] DeleteDC (hdc=0xffffffffe40109c0) returned 1 [0055.531] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0055.531] DeleteObject (ho=0xffffffffb30509d2) returned 1 [0055.534] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0055.535] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0055.535] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0055.535] WaitMessage () returned 1 [0055.797] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.797] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.797] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.797] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.797] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.797] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0055.797] GetCurrentThreadId () returned 0xa28 [0055.797] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0055.797] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.797] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.797] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.797] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.797] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.797] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0055.798] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0055.798] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffa80109d7 [0055.798] GetObjectType (h=0x60109d6) returned 0x3 [0055.798] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffb40509d2 [0055.798] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb40509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.798] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb40509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.798] DeleteObject (ho=0xffffffffb40509d2) returned 1 [0055.798] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffe50509c0 [0055.798] SelectObject (hdc=0xffffffffa80109d7, h=0xffffffffe50509c0) returned 0x185000f [0055.798] GdipCreateFromHDC (hdc=0xffffffffa80109d7, graphics=0x26e408) returned 0x0 [0055.798] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0055.798] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0055.798] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0055.798] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0055.798] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0055.799] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.799] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0055.799] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.799] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0055.799] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0055.799] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0055.799] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0055.799] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0055.799] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.799] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.799] GetSystemMetrics (nIndex=42) returned 0 [0055.799] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.799] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.799] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0055.799] IsAppThemed () returned 0x1 [0055.799] GetThemeAppProperties () returned 0x3 [0055.799] GetThemeAppProperties () returned 0x3 [0055.799] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0055.799] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0055.799] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0055.799] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0055.799] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0055.800] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.800] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.800] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.800] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0055.800] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.800] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.800] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.800] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0055.800] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0055.800] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0055.800] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0055.800] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0055.800] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0055.800] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x1) returned 0x1b00017 [0055.800] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x2) returned 0x1900010 [0055.800] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x7) returned 0xffffffffe50509c0 [0055.800] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x6) returned 0x18a002e [0055.800] SaveDC (hdc=0xffffffffa80109d7) returned 1 [0055.800] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xfffffffffb0409f1 [0055.800] GetClipRgn (hdc=0xffffffffa80109d7, hrgn=0xfffffffffb0409f1) returned 0 [0055.800] SelectClipRgn (hdc=0xffffffffa80109d7, hrgn=0x230409ff) returned 2 [0055.800] DeleteObject (ho=0xfffffffffb0409f1) returned 1 [0055.800] DeleteObject (ho=0x230409ff) returned 1 [0055.800] OffsetViewportOrgEx (in: hdc=0xffffffffa80109d7, x=0, y=0, lppt=0x26a6c50 | out: lppt=0x26a6c50) returned 1 [0055.800] OffsetViewportOrgEx (in: hdc=0xffffffffa80109d7, x=-417, y=-278, lppt=0x26a6d08 | out: lppt=0x26a6d08) returned 1 [0055.800] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0055.801] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x1) returned 0x1b00017 [0055.801] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x2) returned 0x1900010 [0055.801] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x7) returned 0xffffffffe50509c0 [0055.801] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x6) returned 0x18a002e [0055.801] SaveDC (hdc=0xffffffffa80109d7) returned 2 [0055.801] GetNearestColor (hdc=0xffffffffa80109d7, color=0x6c4607) returned 0x6c4607 [0055.801] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb6100276 [0055.801] FillRect (hDC=0xffffffffa80109d7, lprc=0x26de08, hbr=0xffffffffb6100276) returned 1 [0055.807] DeleteObject (ho=0xffffffffb6100276) returned 1 [0055.807] RestoreDC (hdc=0xffffffffa80109d7, nSavedDC=-1) returned 1 [0055.807] RestoreDC (hdc=0xffffffffa80109d7, nSavedDC=-1) returned 1 [0055.807] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109d7) returned 0x0 [0055.807] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcca0dbd) returned 0x0 [0055.807] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0055.807] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.807] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.808] GetSystemMetrics (nIndex=42) returned 0 [0055.808] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.808] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.808] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2c) returned 0x0 [0055.808] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0055.808] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0055.808] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0055.808] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0055.808] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0055.809] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0055.809] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x1) returned 0x1b00017 [0055.809] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x2) returned 0x1900010 [0055.809] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x7) returned 0xffffffffe50509c0 [0055.809] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x6) returned 0x18a002e [0055.809] SaveDC (hdc=0xffffffffa80109d7) returned 1 [0055.809] GetNearestColor (hdc=0xffffffffa80109d7, color=0xf0f0f0) returned 0xf0f0f0 [0055.809] RestoreDC (hdc=0xffffffffa80109d7, nSavedDC=-1) returned 1 [0055.809] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109d7) returned 0x0 [0055.809] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0055.809] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0055.809] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0055.809] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x1) returned 0x1b00017 [0055.809] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x2) returned 0x1900010 [0055.809] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x7) returned 0xffffffffe50509c0 [0055.809] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x6) returned 0x18a002e [0055.809] SaveDC (hdc=0xffffffffa80109d7) returned 1 [0055.809] GetTextAlign (hdc=0xffffffffa80109d7) returned 0x0 [0055.809] GetTextColor (hdc=0xffffffffa80109d7) returned 0x0 [0055.809] SetTextColor (hdc=0xffffffffa80109d7, color=0xf0f0f0) returned 0x0 [0055.809] GetCurrentObject (hdc=0xffffffffa80109d7, type=0x6) returned 0x18a002e [0055.809] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0055.810] SelectObject (hdc=0xffffffffa80109d7, h=0x260a09ba) returned 0x18a002e [0055.810] GetBkMode (hdc=0xffffffffa80109d7) returned 2 [0055.810] SetBkMode (hdc=0xffffffffa80109d7, mode=1) returned 2 [0055.810] DrawTextExW (in: hdc=0xffffffffa80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a7f18 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0055.810] DrawTextExW (in: hdc=0xffffffffa80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a7f18 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0055.810] RestoreDC (hdc=0xffffffffa80109d7, nSavedDC=-1) returned 1 [0055.810] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109d7) returned 0x0 [0055.810] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0055.810] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffa80109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0055.811] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109d7) returned 0x0 [0055.811] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0055.811] SelectObject (hdc=0xffffffffa80109d7, h=0x185000f) returned 0xffffffffe50509c0 [0055.811] DeleteDC (hdc=0xffffffffa80109d7) returned 1 [0055.811] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0055.811] DeleteObject (ho=0xffffffffe50509c0) returned 1 [0055.814] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0055.814] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0055.814] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0055.814] WaitMessage () returned 1 [0055.985] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.985] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.985] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.985] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.985] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.985] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0055.985] GetCurrentThreadId () returned 0xa28 [0055.985] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0055.985] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.985] IsWindowUnicode (hWnd=0x3015e) returned 1 [0055.985] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0055.985] TranslateMessage (lpMsg=0x26ee10) returned 0 [0055.985] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0055.986] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0055.986] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0055.986] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffb60109d2 [0055.986] GetObjectType (h=0x60109d6) returned 0x3 [0055.986] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffe60509c0 [0055.986] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe60509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.986] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe60509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0055.986] DeleteObject (ho=0xffffffffe60509c0) returned 1 [0055.986] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffa90509d7 [0055.986] SelectObject (hdc=0xffffffffb60109d2, h=0xffffffffa90509d7) returned 0x185000f [0055.986] GdipCreateFromHDC (hdc=0xffffffffb60109d2, graphics=0x26e408) returned 0x0 [0055.987] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0055.987] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0055.987] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0055.987] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0055.987] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0055.987] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.987] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0055.987] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.987] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0055.987] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0055.987] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0055.987] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0055.987] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0055.987] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.987] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.987] GetSystemMetrics (nIndex=42) returned 0 [0055.987] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.987] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.987] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0055.987] IsAppThemed () returned 0x1 [0055.987] GetThemeAppProperties () returned 0x3 [0055.987] GetThemeAppProperties () returned 0x3 [0055.987] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0055.987] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0055.987] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0055.988] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0055.988] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0055.988] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.988] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.988] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.988] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0055.988] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0055.988] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0055.988] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0055.988] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0055.988] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0055.988] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0055.988] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0055.988] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0055.988] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0055.988] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x1) returned 0x1b00017 [0055.988] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x2) returned 0x1900010 [0055.988] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x7) returned 0xffffffffa90509d7 [0055.988] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x6) returned 0x18a002e [0055.988] SaveDC (hdc=0xffffffffb60109d2) returned 1 [0055.988] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x240409ff [0055.988] GetClipRgn (hdc=0xffffffffb60109d2, hrgn=0x240409ff) returned 0 [0055.988] SelectClipRgn (hdc=0xffffffffb60109d2, hrgn=0xfffffffffe0409f1) returned 2 [0055.988] DeleteObject (ho=0x240409ff) returned 1 [0055.988] DeleteObject (ho=0xfffffffffe0409f1) returned 1 [0055.988] OffsetViewportOrgEx (in: hdc=0xffffffffb60109d2, x=0, y=0, lppt=0x276f760 | out: lppt=0x276f760) returned 1 [0055.988] OffsetViewportOrgEx (in: hdc=0xffffffffb60109d2, x=-417, y=-278, lppt=0x276f778 | out: lppt=0x276f778) returned 1 [0055.988] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0055.988] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x1) returned 0x1b00017 [0055.989] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x2) returned 0x1900010 [0055.989] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x7) returned 0xffffffffa90509d7 [0055.989] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x6) returned 0x18a002e [0055.989] SaveDC (hdc=0xffffffffb60109d2) returned 2 [0055.989] GetNearestColor (hdc=0xffffffffb60109d2, color=0x6c4607) returned 0x6c4607 [0055.989] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb7100276 [0055.989] FillRect (hDC=0xffffffffb60109d2, lprc=0x26de08, hbr=0xffffffffb7100276) returned 1 [0055.995] DeleteObject (ho=0xffffffffb7100276) returned 1 [0055.995] RestoreDC (hdc=0xffffffffb60109d2, nSavedDC=-1) returned 1 [0055.995] RestoreDC (hdc=0xffffffffb60109d2, nSavedDC=-1) returned 1 [0055.995] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb60109d2) returned 0x0 [0055.995] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcc80dbd) returned 0x0 [0055.995] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0055.995] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0055.995] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0055.995] GetSystemMetrics (nIndex=42) returned 0 [0055.995] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0055.995] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0055.995] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0055.996] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0055.996] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0055.996] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0055.996] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0055.996] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0055.996] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x1) returned 0x1b00017 [0055.996] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x2) returned 0x1900010 [0055.996] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x7) returned 0xffffffffa90509d7 [0055.996] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x6) returned 0x18a002e [0055.996] SaveDC (hdc=0xffffffffb60109d2) returned 1 [0055.996] GetNearestColor (hdc=0xffffffffb60109d2, color=0xf0f0f0) returned 0xf0f0f0 [0055.996] RestoreDC (hdc=0xffffffffb60109d2, nSavedDC=-1) returned 1 [0055.996] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb60109d2) returned 0x0 [0055.996] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0055.996] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0055.996] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0055.997] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x1) returned 0x1b00017 [0055.997] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x2) returned 0x1900010 [0055.997] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x7) returned 0xffffffffa90509d7 [0055.997] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x6) returned 0x18a002e [0055.997] SaveDC (hdc=0xffffffffb60109d2) returned 1 [0055.997] GetTextAlign (hdc=0xffffffffb60109d2) returned 0x0 [0055.997] GetTextColor (hdc=0xffffffffb60109d2) returned 0x0 [0055.997] SetTextColor (hdc=0xffffffffb60109d2, color=0xf0f0f0) returned 0x0 [0055.997] GetCurrentObject (hdc=0xffffffffb60109d2, type=0x6) returned 0x18a002e [0055.997] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0055.997] SelectObject (hdc=0xffffffffb60109d2, h=0x260a09ba) returned 0x18a002e [0055.997] GetBkMode (hdc=0xffffffffb60109d2) returned 2 [0055.997] SetBkMode (hdc=0xffffffffb60109d2, mode=1) returned 2 [0055.997] DrawTextExW (in: hdc=0xffffffffb60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2770428 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0055.997] DrawTextExW (in: hdc=0xffffffffb60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2770428 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0055.998] RestoreDC (hdc=0xffffffffb60109d2, nSavedDC=-1) returned 1 [0055.998] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb60109d2) returned 0x0 [0055.998] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0055.998] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffb60109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0055.998] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb60109d2) returned 0x0 [0055.998] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0055.998] SelectObject (hdc=0xffffffffb60109d2, h=0x185000f) returned 0xffffffffa90509d7 [0055.998] DeleteDC (hdc=0xffffffffb60109d2) returned 1 [0055.998] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0055.998] DeleteObject (ho=0xffffffffa90509d7) returned 1 [0056.001] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0056.001] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.001] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.001] WaitMessage () returned 1 [0056.258] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.258] IsWindowUnicode (hWnd=0x3015e) returned 1 [0056.258] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.258] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.258] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.258] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0056.258] GetCurrentThreadId () returned 0xa28 [0056.258] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0056.258] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.258] IsWindowUnicode (hWnd=0x3015e) returned 1 [0056.258] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.258] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.258] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.259] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0056.259] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0056.259] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffe80109c0 [0056.259] GetObjectType (h=0x60109d6) returned 0x3 [0056.259] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffaa0509d7 [0056.259] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffaa0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.259] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffaa0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.259] DeleteObject (ho=0xffffffffaa0509d7) returned 1 [0056.259] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffb70509d2 [0056.259] SelectObject (hdc=0xffffffffe80109c0, h=0xffffffffb70509d2) returned 0x185000f [0056.259] GdipCreateFromHDC (hdc=0xffffffffe80109c0, graphics=0x26e408) returned 0x0 [0056.259] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0056.259] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0056.259] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0056.259] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0056.259] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0056.260] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.260] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0056.260] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.260] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0056.260] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0056.260] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0056.260] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0056.260] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0056.260] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.260] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.260] GetSystemMetrics (nIndex=42) returned 0 [0056.260] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0056.260] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.260] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0056.260] IsAppThemed () returned 0x1 [0056.260] GetThemeAppProperties () returned 0x3 [0056.260] GetThemeAppProperties () returned 0x3 [0056.260] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0056.260] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0056.260] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0056.260] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0056.260] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0056.260] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.260] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.260] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.260] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0056.260] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.260] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.260] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.260] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0056.260] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0056.261] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0056.261] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0056.261] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0056.261] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0056.261] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x1) returned 0x1b00017 [0056.261] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x2) returned 0x1900010 [0056.261] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x7) returned 0xffffffffb70509d2 [0056.261] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x6) returned 0x18a002e [0056.261] SaveDC (hdc=0xffffffffe80109c0) returned 1 [0056.261] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffff0409f1 [0056.261] GetClipRgn (hdc=0xffffffffe80109c0, hrgn=0xffffffffff0409f1) returned 0 [0056.261] SelectClipRgn (hdc=0xffffffffe80109c0, hrgn=0x270409ff) returned 2 [0056.261] DeleteObject (ho=0xffffffffff0409f1) returned 1 [0056.261] DeleteObject (ho=0x270409ff) returned 1 [0056.261] OffsetViewportOrgEx (in: hdc=0xffffffffe80109c0, x=0, y=0, lppt=0x26bfb68 | out: lppt=0x26bfb68) returned 1 [0056.261] OffsetViewportOrgEx (in: hdc=0xffffffffe80109c0, x=-417, y=-278, lppt=0x26bfb80 | out: lppt=0x26bfb80) returned 1 [0056.261] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0056.261] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x1) returned 0x1b00017 [0056.261] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x2) returned 0x1900010 [0056.261] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x7) returned 0xffffffffb70509d2 [0056.261] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x6) returned 0x18a002e [0056.261] SaveDC (hdc=0xffffffffe80109c0) returned 2 [0056.261] GetNearestColor (hdc=0xffffffffe80109c0, color=0x6c4607) returned 0x6c4607 [0056.261] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb8100276 [0056.261] FillRect (hDC=0xffffffffe80109c0, lprc=0x26de08, hbr=0xffffffffb8100276) returned 1 [0056.268] DeleteObject (ho=0xffffffffb8100276) returned 1 [0056.268] RestoreDC (hdc=0xffffffffe80109c0, nSavedDC=-1) returned 1 [0056.268] RestoreDC (hdc=0xffffffffe80109c0, nSavedDC=-1) returned 1 [0056.268] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe80109c0) returned 0x0 [0056.268] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcc60dbd) returned 0x0 [0056.268] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0056.268] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.268] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.268] GetSystemMetrics (nIndex=42) returned 0 [0056.268] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0056.268] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.268] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2e) returned 0x0 [0056.269] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0056.269] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0056.269] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0056.269] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0056.269] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0056.269] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0056.269] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x1) returned 0x1b00017 [0056.269] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x2) returned 0x1900010 [0056.269] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x7) returned 0xffffffffb70509d2 [0056.269] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x6) returned 0x18a002e [0056.269] SaveDC (hdc=0xffffffffe80109c0) returned 1 [0056.270] GetNearestColor (hdc=0xffffffffe80109c0, color=0xf0f0f0) returned 0xf0f0f0 [0056.270] RestoreDC (hdc=0xffffffffe80109c0, nSavedDC=-1) returned 1 [0056.270] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe80109c0) returned 0x0 [0056.270] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0056.270] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0056.270] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0056.270] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x1) returned 0x1b00017 [0056.270] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x2) returned 0x1900010 [0056.270] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x7) returned 0xffffffffb70509d2 [0056.270] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x6) returned 0x18a002e [0056.270] SaveDC (hdc=0xffffffffe80109c0) returned 1 [0056.270] GetTextAlign (hdc=0xffffffffe80109c0) returned 0x0 [0056.270] GetTextColor (hdc=0xffffffffe80109c0) returned 0x0 [0056.270] SetTextColor (hdc=0xffffffffe80109c0, color=0xf0f0f0) returned 0x0 [0056.270] GetCurrentObject (hdc=0xffffffffe80109c0, type=0x6) returned 0x18a002e [0056.270] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0056.270] SelectObject (hdc=0xffffffffe80109c0, h=0x260a09ba) returned 0x18a002e [0056.270] GetBkMode (hdc=0xffffffffe80109c0) returned 2 [0056.270] SetBkMode (hdc=0xffffffffe80109c0, mode=1) returned 2 [0056.270] DrawTextExW (in: hdc=0xffffffffe80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c0a30 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0056.271] DrawTextExW (in: hdc=0xffffffffe80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c0a30 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0056.271] RestoreDC (hdc=0xffffffffe80109c0, nSavedDC=-1) returned 1 [0056.271] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe80109c0) returned 0x0 [0056.271] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0056.271] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffe80109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0056.271] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe80109c0) returned 0x0 [0056.271] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0056.272] SelectObject (hdc=0xffffffffe80109c0, h=0x185000f) returned 0xffffffffb70509d2 [0056.272] DeleteDC (hdc=0xffffffffe80109c0) returned 1 [0056.272] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0056.272] DeleteObject (ho=0xffffffffb70509d2) returned 1 [0056.275] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0056.275] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.275] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.275] WaitMessage () returned 1 [0056.423] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.423] IsWindowUnicode (hWnd=0x3015e) returned 1 [0056.423] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.423] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.423] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.423] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0056.423] GetCurrentThreadId () returned 0xa28 [0056.424] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0056.424] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.424] IsWindowUnicode (hWnd=0x3015e) returned 1 [0056.424] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.424] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.424] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.424] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0056.424] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0056.424] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffac0109d7 [0056.424] GetObjectType (h=0x60109d6) returned 0x3 [0056.424] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffb80509d2 [0056.424] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb80509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.424] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb80509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.424] DeleteObject (ho=0xffffffffb80509d2) returned 1 [0056.424] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffe90509c0 [0056.424] SelectObject (hdc=0xffffffffac0109d7, h=0xffffffffe90509c0) returned 0x185000f [0056.424] GdipCreateFromHDC (hdc=0xffffffffac0109d7, graphics=0x26e408) returned 0x0 [0056.425] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0056.425] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0056.425] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0056.425] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0056.425] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0056.425] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.425] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0056.425] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.425] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0056.425] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0056.425] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0056.425] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0056.425] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0056.425] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.425] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.425] GetSystemMetrics (nIndex=42) returned 0 [0056.425] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0056.425] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.425] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0056.425] IsAppThemed () returned 0x1 [0056.425] GetThemeAppProperties () returned 0x3 [0056.425] GetThemeAppProperties () returned 0x3 [0056.425] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0056.425] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0056.425] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0056.425] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0056.425] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0056.426] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.426] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.426] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.426] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0056.426] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.426] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.426] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.426] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0056.426] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0056.426] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0056.426] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0056.426] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0056.426] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0056.426] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x1) returned 0x1b00017 [0056.426] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x2) returned 0x1900010 [0056.426] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x7) returned 0xffffffffe90509c0 [0056.426] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x6) returned 0x18a002e [0056.426] SaveDC (hdc=0xffffffffac0109d7) returned 1 [0056.426] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x280409ff [0056.426] GetClipRgn (hdc=0xffffffffac0109d7, hrgn=0x280409ff) returned 0 [0056.426] SelectClipRgn (hdc=0xffffffffac0109d7, hrgn=0x20409f1) returned 2 [0056.426] DeleteObject (ho=0x280409ff) returned 1 [0056.426] DeleteObject (ho=0x20409f1) returned 1 [0056.426] OffsetViewportOrgEx (in: hdc=0xffffffffac0109d7, x=0, y=0, lppt=0x26c2610 | out: lppt=0x26c2610) returned 1 [0056.426] OffsetViewportOrgEx (in: hdc=0xffffffffac0109d7, x=-417, y=-278, lppt=0x26c2628 | out: lppt=0x26c2628) returned 1 [0056.426] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0056.426] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x1) returned 0x1b00017 [0056.426] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x2) returned 0x1900010 [0056.427] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x7) returned 0xffffffffe90509c0 [0056.427] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x6) returned 0x18a002e [0056.427] SaveDC (hdc=0xffffffffac0109d7) returned 2 [0056.427] GetNearestColor (hdc=0xffffffffac0109d7, color=0x6c4607) returned 0x6c4607 [0056.427] CreateSolidBrush (color=0x6c4607) returned 0xffffffffb9100276 [0056.427] FillRect (hDC=0xffffffffac0109d7, lprc=0x26de08, hbr=0xffffffffb9100276) returned 1 [0056.433] DeleteObject (ho=0xffffffffb9100276) returned 1 [0056.433] RestoreDC (hdc=0xffffffffac0109d7, nSavedDC=-1) returned 1 [0056.433] RestoreDC (hdc=0xffffffffac0109d7, nSavedDC=-1) returned 1 [0056.433] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffac0109d7) returned 0x0 [0056.433] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcc40dbd) returned 0x0 [0056.433] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0056.433] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.433] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.433] GetSystemMetrics (nIndex=42) returned 0 [0056.433] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0056.433] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.433] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0056.433] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0056.433] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0056.433] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0056.433] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0056.433] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0056.433] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x1) returned 0x1b00017 [0056.433] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x2) returned 0x1900010 [0056.433] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x7) returned 0xffffffffe90509c0 [0056.434] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x6) returned 0x18a002e [0056.434] SaveDC (hdc=0xffffffffac0109d7) returned 1 [0056.434] GetNearestColor (hdc=0xffffffffac0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0056.434] RestoreDC (hdc=0xffffffffac0109d7, nSavedDC=-1) returned 1 [0056.434] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffac0109d7) returned 0x0 [0056.434] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0056.434] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0056.434] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0056.434] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x1) returned 0x1b00017 [0056.434] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x2) returned 0x1900010 [0056.434] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x7) returned 0xffffffffe90509c0 [0056.434] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x6) returned 0x18a002e [0056.434] SaveDC (hdc=0xffffffffac0109d7) returned 1 [0056.434] GetTextAlign (hdc=0xffffffffac0109d7) returned 0x0 [0056.434] GetTextColor (hdc=0xffffffffac0109d7) returned 0x0 [0056.434] SetTextColor (hdc=0xffffffffac0109d7, color=0xf0f0f0) returned 0x0 [0056.434] GetCurrentObject (hdc=0xffffffffac0109d7, type=0x6) returned 0x18a002e [0056.434] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0056.434] SelectObject (hdc=0xffffffffac0109d7, h=0x260a09ba) returned 0x18a002e [0056.434] GetBkMode (hdc=0xffffffffac0109d7) returned 2 [0056.434] SetBkMode (hdc=0xffffffffac0109d7, mode=1) returned 2 [0056.434] DrawTextExW (in: hdc=0xffffffffac0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c32d8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0056.435] DrawTextExW (in: hdc=0xffffffffac0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c32d8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0056.435] RestoreDC (hdc=0xffffffffac0109d7, nSavedDC=-1) returned 1 [0056.435] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffac0109d7) returned 0x0 [0056.435] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0056.435] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffac0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0056.435] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffac0109d7) returned 0x0 [0056.435] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0056.435] SelectObject (hdc=0xffffffffac0109d7, h=0x185000f) returned 0xffffffffe90509c0 [0056.435] DeleteDC (hdc=0xffffffffac0109d7) returned 1 [0056.436] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0056.436] DeleteObject (ho=0xffffffffe90509c0) returned 1 [0056.439] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0056.439] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.439] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.439] WaitMessage () returned 1 [0056.598] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.598] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x27a023d) returned 0x1 [0056.598] IsWindowUnicode (hWnd=0x50114) returned 1 [0056.598] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.598] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x27a023d) returned 0x1 [0056.599] SetCursor (hCursor=0x10007) returned 0x10007 [0056.599] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.599] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.599] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0x27a023d) returned 0x0 [0056.599] GetKeyState (nVirtKey=1) returned 0 [0056.599] GetKeyState (nVirtKey=2) returned 0 [0056.599] GetKeyState (nVirtKey=4) returned 0 [0056.599] GetKeyState (nVirtKey=5) returned 0 [0056.599] GetKeyState (nVirtKey=6) returned 0 [0056.599] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.599] IsWindowUnicode (hWnd=0x5015a) returned 1 [0056.599] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.599] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.599] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.599] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.599] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.599] GetSystemMetrics (nIndex=42) returned 0 [0056.599] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e690, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0056.599] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e690) returned 0x5d [0056.599] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.599] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.600] GetSystemMetrics (nIndex=42) returned 0 [0056.600] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e630, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n2% complete\r\nDo not turn off your computer.") returned 93 [0056.600] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e630) returned 0x5d [0056.600] SetWindowTextW (hWnd=0x3015e, lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 1 [0056.600] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xc, wParam=0x0, lParam=0x26c35a4) returned 0x1 [0056.600] GetStockObject (i=5) returned 0x1900015 [0056.600] GetDlgItem (hDlg=0x50114, nIDDlgItem=196958) returned 0x3015e [0056.600] SendMessageW (hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26df90) returned 0x0 [0056.600] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26df90) returned 0x0 [0056.600] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0056.600] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.600] IsWindowUnicode (hWnd=0x3015e) returned 1 [0056.600] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.600] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.600] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.600] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0056.601] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0056.601] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffba0109d2 [0056.601] GetObjectType (h=0x60109d6) returned 0x3 [0056.601] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffea0509c0 [0056.601] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffea0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.601] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffea0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.601] DeleteObject (ho=0xffffffffea0509c0) returned 1 [0056.601] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffad0509d7 [0056.601] SelectObject (hdc=0xffffffffba0109d2, h=0xffffffffad0509d7) returned 0x185000f [0056.601] GdipCreateFromHDC (hdc=0xffffffffba0109d2, graphics=0x26e408) returned 0x0 [0056.601] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0056.601] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0056.601] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0056.601] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0056.601] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0056.602] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.602] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0056.602] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.602] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0056.602] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0056.602] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0056.602] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0056.602] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0056.602] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.602] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.602] GetSystemMetrics (nIndex=42) returned 0 [0056.602] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0056.602] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.602] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0056.602] IsAppThemed () returned 0x1 [0056.602] GetThemeAppProperties () returned 0x3 [0056.602] GetThemeAppProperties () returned 0x3 [0056.602] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0056.602] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0056.602] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0056.602] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0056.602] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0056.602] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.602] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.602] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.602] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0056.602] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.602] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.602] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.602] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0056.603] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0056.603] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0056.603] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0056.603] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0056.603] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0056.603] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x1) returned 0x1b00017 [0056.603] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x2) returned 0x1900010 [0056.603] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x7) returned 0xffffffffad0509d7 [0056.603] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x6) returned 0x18a002e [0056.603] SaveDC (hdc=0xffffffffba0109d2) returned 1 [0056.603] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x30409f1 [0056.603] GetClipRgn (hdc=0xffffffffba0109d2, hrgn=0x30409f1) returned 0 [0056.603] SelectClipRgn (hdc=0xffffffffba0109d2, hrgn=0x2b0409ff) returned 2 [0056.603] DeleteObject (ho=0x30409f1) returned 1 [0056.603] DeleteObject (ho=0x2b0409ff) returned 1 [0056.603] OffsetViewportOrgEx (in: hdc=0xffffffffba0109d2, x=0, y=0, lppt=0x26c55e8 | out: lppt=0x26c55e8) returned 1 [0056.603] OffsetViewportOrgEx (in: hdc=0xffffffffba0109d2, x=-417, y=-278, lppt=0x26c5600 | out: lppt=0x26c5600) returned 1 [0056.603] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0056.603] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x1) returned 0x1b00017 [0056.603] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x2) returned 0x1900010 [0056.603] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x7) returned 0xffffffffad0509d7 [0056.603] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x6) returned 0x18a002e [0056.603] SaveDC (hdc=0xffffffffba0109d2) returned 2 [0056.603] GetNearestColor (hdc=0xffffffffba0109d2, color=0x6c4607) returned 0x6c4607 [0056.603] CreateSolidBrush (color=0x6c4607) returned 0xffffffffba100276 [0056.603] FillRect (hDC=0xffffffffba0109d2, lprc=0x26de08, hbr=0xffffffffba100276) returned 1 [0056.610] DeleteObject (ho=0xffffffffba100276) returned 1 [0056.610] RestoreDC (hdc=0xffffffffba0109d2, nSavedDC=-1) returned 1 [0056.610] RestoreDC (hdc=0xffffffffba0109d2, nSavedDC=-1) returned 1 [0056.610] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffba0109d2) returned 0x0 [0056.610] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcc20dbd) returned 0x0 [0056.610] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0056.610] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.610] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.610] GetSystemMetrics (nIndex=42) returned 0 [0056.610] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0056.610] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.610] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2f) returned 0x0 [0056.611] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0056.611] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0056.611] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0056.611] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0056.611] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0056.611] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0056.611] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x1) returned 0x1b00017 [0056.611] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x2) returned 0x1900010 [0056.611] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x7) returned 0xffffffffad0509d7 [0056.611] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x6) returned 0x18a002e [0056.611] SaveDC (hdc=0xffffffffba0109d2) returned 1 [0056.611] GetNearestColor (hdc=0xffffffffba0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0056.611] RestoreDC (hdc=0xffffffffba0109d2, nSavedDC=-1) returned 1 [0056.611] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffba0109d2) returned 0x0 [0056.611] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0056.611] DrawTextExW (in: hdc=0xffffffff81010269, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e1c8, format=0x102405, lpdtp=0x26c5f70 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e1c8) returned 333 [0056.612] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0056.612] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0056.612] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x1) returned 0x1b00017 [0056.612] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x2) returned 0x1900010 [0056.612] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x7) returned 0xffffffffad0509d7 [0056.612] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x6) returned 0x18a002e [0056.612] SaveDC (hdc=0xffffffffba0109d2) returned 1 [0056.612] GetTextAlign (hdc=0xffffffffba0109d2) returned 0x0 [0056.612] GetTextColor (hdc=0xffffffffba0109d2) returned 0x0 [0056.612] SetTextColor (hdc=0xffffffffba0109d2, color=0xf0f0f0) returned 0x0 [0056.612] GetCurrentObject (hdc=0xffffffffba0109d2, type=0x6) returned 0x18a002e [0056.612] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0056.612] SelectObject (hdc=0xffffffffba0109d2, h=0x260a09ba) returned 0x18a002e [0056.612] GetBkMode (hdc=0xffffffffba0109d2) returned 2 [0056.612] SetBkMode (hdc=0xffffffffba0109d2, mode=1) returned 2 [0056.612] DrawTextExW (in: hdc=0xffffffffba0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c63e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0056.612] DrawTextExW (in: hdc=0xffffffffba0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c63e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0056.613] RestoreDC (hdc=0xffffffffba0109d2, nSavedDC=-1) returned 1 [0056.613] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffba0109d2) returned 0x0 [0056.614] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0056.614] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffba0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0056.614] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffba0109d2) returned 0x0 [0056.614] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0056.614] SelectObject (hdc=0xffffffffba0109d2, h=0x185000f) returned 0xffffffffad0509d7 [0056.614] DeleteDC (hdc=0xffffffffba0109d2) returned 1 [0056.614] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0056.614] DeleteObject (ho=0xffffffffad0509d7) returned 1 [0056.617] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0056.617] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.617] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.617] WaitMessage () returned 1 [0056.685] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.685] IsWindowUnicode (hWnd=0x3015e) returned 1 [0056.685] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.685] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.685] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.685] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0056.685] GetCurrentThreadId () returned 0xa28 [0056.685] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0056.685] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.685] IsWindowUnicode (hWnd=0x3015e) returned 1 [0056.685] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.685] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.685] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.685] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0056.685] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0056.685] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffec0109c0 [0056.686] GetObjectType (h=0x60109d6) returned 0x3 [0056.686] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffae0509d7 [0056.686] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffae0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.686] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffae0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.686] DeleteObject (ho=0xffffffffae0509d7) returned 1 [0056.686] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffbb0509d2 [0056.686] SelectObject (hdc=0xffffffffec0109c0, h=0xffffffffbb0509d2) returned 0x185000f [0056.686] GdipCreateFromHDC (hdc=0xffffffffec0109c0, graphics=0x26e408) returned 0x0 [0056.686] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0056.686] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0056.686] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0056.686] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0056.686] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0056.686] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.686] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0056.686] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.686] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0056.686] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0056.687] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0056.687] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0056.687] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0056.687] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.687] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.687] GetSystemMetrics (nIndex=42) returned 0 [0056.687] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0056.687] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.687] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0056.687] IsAppThemed () returned 0x1 [0056.687] GetThemeAppProperties () returned 0x3 [0056.687] GetThemeAppProperties () returned 0x3 [0056.687] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0056.687] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0056.687] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0056.687] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0056.687] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0056.687] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.687] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.687] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.687] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0056.687] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.687] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.687] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.687] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0056.687] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0056.687] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0056.687] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0056.688] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0056.688] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0056.688] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x1) returned 0x1b00017 [0056.688] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x2) returned 0x1900010 [0056.688] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x7) returned 0xffffffffbb0509d2 [0056.688] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x6) returned 0x18a002e [0056.688] SaveDC (hdc=0xffffffffec0109c0) returned 1 [0056.688] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2c0409ff [0056.688] GetClipRgn (hdc=0xffffffffec0109c0, hrgn=0x2c0409ff) returned 0 [0056.688] SelectClipRgn (hdc=0xffffffffec0109c0, hrgn=0x70409f1) returned 2 [0056.688] DeleteObject (ho=0x2c0409ff) returned 1 [0056.688] DeleteObject (ho=0x70409f1) returned 1 [0056.688] OffsetViewportOrgEx (in: hdc=0xffffffffec0109c0, x=0, y=0, lppt=0x26c7fc8 | out: lppt=0x26c7fc8) returned 1 [0056.688] OffsetViewportOrgEx (in: hdc=0xffffffffec0109c0, x=-417, y=-278, lppt=0x26c7fe0 | out: lppt=0x26c7fe0) returned 1 [0056.688] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0056.688] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x1) returned 0x1b00017 [0056.688] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x2) returned 0x1900010 [0056.689] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x7) returned 0xffffffffbb0509d2 [0056.689] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x6) returned 0x18a002e [0056.689] SaveDC (hdc=0xffffffffec0109c0) returned 2 [0056.689] GetNearestColor (hdc=0xffffffffec0109c0, color=0x6c4607) returned 0x6c4607 [0056.689] CreateSolidBrush (color=0x6c4607) returned 0xffffffffbb100276 [0056.689] FillRect (hDC=0xffffffffec0109c0, lprc=0x26de08, hbr=0xffffffffbb100276) returned 1 [0056.695] DeleteObject (ho=0xffffffffbb100276) returned 1 [0056.695] RestoreDC (hdc=0xffffffffec0109c0, nSavedDC=-1) returned 1 [0056.695] RestoreDC (hdc=0xffffffffec0109c0, nSavedDC=-1) returned 1 [0056.695] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffec0109c0) returned 0x0 [0056.695] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcc00dbd) returned 0x0 [0056.695] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0056.695] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.695] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.695] GetSystemMetrics (nIndex=42) returned 0 [0056.695] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0056.695] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.695] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0056.695] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0056.695] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0056.695] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0056.695] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0056.696] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0056.696] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x1) returned 0x1b00017 [0056.696] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x2) returned 0x1900010 [0056.696] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x7) returned 0xffffffffbb0509d2 [0056.696] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x6) returned 0x18a002e [0056.696] SaveDC (hdc=0xffffffffec0109c0) returned 1 [0056.696] GetNearestColor (hdc=0xffffffffec0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0056.696] RestoreDC (hdc=0xffffffffec0109c0, nSavedDC=-1) returned 1 [0056.696] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffec0109c0) returned 0x0 [0056.696] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0056.696] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0056.696] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0056.696] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x1) returned 0x1b00017 [0056.696] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x2) returned 0x1900010 [0056.696] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x7) returned 0xffffffffbb0509d2 [0056.696] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x6) returned 0x18a002e [0056.696] SaveDC (hdc=0xffffffffec0109c0) returned 1 [0056.696] GetTextAlign (hdc=0xffffffffec0109c0) returned 0x0 [0056.696] GetTextColor (hdc=0xffffffffec0109c0) returned 0x0 [0056.696] SetTextColor (hdc=0xffffffffec0109c0, color=0xf0f0f0) returned 0x0 [0056.696] GetCurrentObject (hdc=0xffffffffec0109c0, type=0x6) returned 0x18a002e [0056.696] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0056.696] SelectObject (hdc=0xffffffffec0109c0, h=0x260a09ba) returned 0x18a002e [0056.696] GetBkMode (hdc=0xffffffffec0109c0) returned 2 [0056.696] SetBkMode (hdc=0xffffffffec0109c0, mode=1) returned 2 [0056.696] DrawTextExW (in: hdc=0xffffffffec0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c8c90 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0056.697] DrawTextExW (in: hdc=0xffffffffec0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c8c90 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0056.697] RestoreDC (hdc=0xffffffffec0109c0, nSavedDC=-1) returned 1 [0056.697] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffec0109c0) returned 0x0 [0056.697] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0056.697] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffec0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0056.697] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffec0109c0) returned 0x0 [0056.697] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0056.697] SelectObject (hdc=0xffffffffec0109c0, h=0x185000f) returned 0xffffffffbb0509d2 [0056.697] DeleteDC (hdc=0xffffffffec0109c0) returned 1 [0056.698] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0056.698] DeleteObject (ho=0xffffffffbb0509d2) returned 1 [0056.701] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0056.701] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.701] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.701] WaitMessage () returned 1 [0056.876] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.876] IsWindowUnicode (hWnd=0x3015e) returned 1 [0056.876] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.876] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.876] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.876] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0056.876] GetCurrentThreadId () returned 0xa28 [0056.876] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0056.876] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.876] IsWindowUnicode (hWnd=0x3015e) returned 1 [0056.876] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0056.876] TranslateMessage (lpMsg=0x26ee10) returned 0 [0056.876] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0056.876] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0056.876] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0056.877] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffb00109d7 [0056.877] GetObjectType (h=0x60109d6) returned 0x3 [0056.877] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffbc0509d2 [0056.877] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffbc0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.877] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffbc0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0056.877] DeleteObject (ho=0xffffffffbc0509d2) returned 1 [0056.877] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffed0509c0 [0056.877] SelectObject (hdc=0xffffffffb00109d7, h=0xffffffffed0509c0) returned 0x185000f [0056.877] GdipCreateFromHDC (hdc=0xffffffffb00109d7, graphics=0x26e408) returned 0x0 [0056.877] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0056.877] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0056.877] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0056.877] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0056.877] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0056.877] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.878] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0056.878] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.878] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0056.878] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0056.878] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0056.878] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0056.878] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0056.878] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.878] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.878] GetSystemMetrics (nIndex=42) returned 0 [0056.878] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0056.878] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.878] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0056.878] IsAppThemed () returned 0x1 [0056.878] GetThemeAppProperties () returned 0x3 [0056.878] GetThemeAppProperties () returned 0x3 [0056.878] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0056.878] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0056.878] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0056.878] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0056.878] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0056.878] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.878] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.878] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.878] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0056.878] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0056.879] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0056.879] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0056.879] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0056.879] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0056.879] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0056.879] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0056.879] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0056.879] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0056.879] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x1) returned 0x1b00017 [0056.879] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x2) returned 0x1900010 [0056.879] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x7) returned 0xffffffffed0509c0 [0056.879] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x6) returned 0x18a002e [0056.879] SaveDC (hdc=0xffffffffb00109d7) returned 1 [0056.879] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x80409f1 [0056.879] GetClipRgn (hdc=0xffffffffb00109d7, hrgn=0x80409f1) returned 0 [0056.879] SelectClipRgn (hdc=0xffffffffb00109d7, hrgn=0x2f0409ff) returned 2 [0056.879] DeleteObject (ho=0x80409f1) returned 1 [0056.879] DeleteObject (ho=0x2f0409ff) returned 1 [0056.879] OffsetViewportOrgEx (in: hdc=0xffffffffb00109d7, x=0, y=0, lppt=0x26cc538 | out: lppt=0x26cc538) returned 1 [0056.879] OffsetViewportOrgEx (in: hdc=0xffffffffb00109d7, x=-417, y=-278, lppt=0x26cc550 | out: lppt=0x26cc550) returned 1 [0056.879] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0056.879] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x1) returned 0x1b00017 [0056.879] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x2) returned 0x1900010 [0056.879] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x7) returned 0xffffffffed0509c0 [0056.879] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x6) returned 0x18a002e [0056.879] SaveDC (hdc=0xffffffffb00109d7) returned 2 [0056.879] GetNearestColor (hdc=0xffffffffb00109d7, color=0x6c4607) returned 0x6c4607 [0056.880] CreateSolidBrush (color=0x6c4607) returned 0xffffffffbc100276 [0056.880] FillRect (hDC=0xffffffffb00109d7, lprc=0x26de08, hbr=0xffffffffbc100276) returned 1 [0056.886] DeleteObject (ho=0xffffffffbc100276) returned 1 [0056.886] RestoreDC (hdc=0xffffffffb00109d7, nSavedDC=-1) returned 1 [0056.886] RestoreDC (hdc=0xffffffffb00109d7, nSavedDC=-1) returned 1 [0056.886] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb00109d7) returned 0x0 [0056.886] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcbe0dbd) returned 0x0 [0056.886] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0056.886] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0056.886] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0056.886] GetSystemMetrics (nIndex=42) returned 0 [0056.886] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0056.886] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0056.886] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x31) returned 0x0 [0056.887] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0056.887] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0056.887] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0056.887] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0056.887] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0056.887] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0056.887] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x1) returned 0x1b00017 [0056.887] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x2) returned 0x1900010 [0056.887] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x7) returned 0xffffffffed0509c0 [0056.887] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x6) returned 0x18a002e [0056.887] SaveDC (hdc=0xffffffffb00109d7) returned 1 [0056.887] GetNearestColor (hdc=0xffffffffb00109d7, color=0xf0f0f0) returned 0xf0f0f0 [0056.887] RestoreDC (hdc=0xffffffffb00109d7, nSavedDC=-1) returned 1 [0056.887] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb00109d7) returned 0x0 [0056.888] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0056.888] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0056.888] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0056.888] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0056.888] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x1) returned 0x1b00017 [0056.888] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x2) returned 0x1900010 [0056.888] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x7) returned 0xffffffffed0509c0 [0056.888] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x6) returned 0x18a002e [0056.888] SaveDC (hdc=0xffffffffb00109d7) returned 1 [0056.888] GetTextAlign (hdc=0xffffffffb00109d7) returned 0x0 [0056.888] GetTextColor (hdc=0xffffffffb00109d7) returned 0x0 [0056.888] SetTextColor (hdc=0xffffffffb00109d7, color=0xf0f0f0) returned 0x0 [0056.888] GetCurrentObject (hdc=0xffffffffb00109d7, type=0x6) returned 0x18a002e [0056.888] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0056.888] SelectObject (hdc=0xffffffffb00109d7, h=0x260a09ba) returned 0x18a002e [0056.888] GetBkMode (hdc=0xffffffffb00109d7) returned 2 [0056.888] SetBkMode (hdc=0xffffffffb00109d7, mode=1) returned 2 [0056.888] DrawTextExW (in: hdc=0xffffffffb00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26cd400 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0056.888] DrawTextExW (in: hdc=0xffffffffb00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26cd400 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0056.889] RestoreDC (hdc=0xffffffffb00109d7, nSavedDC=-1) returned 1 [0056.889] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb00109d7) returned 0x0 [0056.889] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0056.889] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffb00109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0056.889] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb00109d7) returned 0x0 [0056.889] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0056.889] SelectObject (hdc=0xffffffffb00109d7, h=0x185000f) returned 0xffffffffed0509c0 [0056.889] DeleteDC (hdc=0xffffffffb00109d7) returned 1 [0056.889] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0056.889] DeleteObject (ho=0xffffffffed0509c0) returned 1 [0056.893] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0056.893] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.893] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0056.893] WaitMessage () returned 1 [0057.062] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.062] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.062] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.062] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.062] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.062] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0057.062] GetCurrentThreadId () returned 0xa28 [0057.062] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0057.062] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.062] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.063] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.063] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.063] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.063] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0057.063] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0057.063] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffbe0109d2 [0057.063] GetObjectType (h=0x60109d6) returned 0x3 [0057.063] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffee0509c0 [0057.064] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffee0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.064] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffee0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.064] DeleteObject (ho=0xffffffffee0509c0) returned 1 [0057.064] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffb10509d7 [0057.064] SelectObject (hdc=0xffffffffbe0109d2, h=0xffffffffb10509d7) returned 0x185000f [0057.064] GdipCreateFromHDC (hdc=0xffffffffbe0109d2, graphics=0x26e408) returned 0x0 [0057.064] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0057.064] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0057.064] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0057.064] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0057.064] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0057.064] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.064] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0057.064] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.065] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0057.065] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0057.065] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0057.065] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0057.065] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0057.065] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.065] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.065] GetSystemMetrics (nIndex=42) returned 0 [0057.065] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.065] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.065] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0057.065] IsAppThemed () returned 0x1 [0057.065] GetThemeAppProperties () returned 0x3 [0057.065] GetThemeAppProperties () returned 0x3 [0057.065] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0057.065] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0057.065] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0057.065] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0057.065] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0057.065] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.065] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.065] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.065] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0057.065] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.065] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.065] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.065] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0057.065] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0057.065] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0057.065] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0057.065] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0057.066] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0057.066] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x1) returned 0x1b00017 [0057.066] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x2) returned 0x1900010 [0057.066] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x7) returned 0xffffffffb10509d7 [0057.066] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x6) returned 0x18a002e [0057.066] SaveDC (hdc=0xffffffffbe0109d2) returned 1 [0057.066] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x300409ff [0057.066] GetClipRgn (hdc=0xffffffffbe0109d2, hrgn=0x300409ff) returned 0 [0057.066] SelectClipRgn (hdc=0xffffffffbe0109d2, hrgn=0xb0409f1) returned 2 [0057.066] DeleteObject (ho=0x300409ff) returned 1 [0057.066] DeleteObject (ho=0xb0409f1) returned 1 [0057.066] OffsetViewportOrgEx (in: hdc=0xffffffffbe0109d2, x=0, y=0, lppt=0x273ade0 | out: lppt=0x273ade0) returned 1 [0057.066] OffsetViewportOrgEx (in: hdc=0xffffffffbe0109d2, x=-417, y=-278, lppt=0x273adf8 | out: lppt=0x273adf8) returned 1 [0057.066] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0057.066] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x1) returned 0x1b00017 [0057.066] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x2) returned 0x1900010 [0057.066] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x7) returned 0xffffffffb10509d7 [0057.066] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x6) returned 0x18a002e [0057.066] SaveDC (hdc=0xffffffffbe0109d2) returned 2 [0057.066] GetNearestColor (hdc=0xffffffffbe0109d2, color=0x6c4607) returned 0x6c4607 [0057.066] CreateSolidBrush (color=0x6c4607) returned 0xffffffffbd100276 [0057.066] FillRect (hDC=0xffffffffbe0109d2, lprc=0x26de08, hbr=0xffffffffbd100276) returned 1 [0057.073] DeleteObject (ho=0xffffffffbd100276) returned 1 [0057.073] RestoreDC (hdc=0xffffffffbe0109d2, nSavedDC=-1) returned 1 [0057.073] RestoreDC (hdc=0xffffffffbe0109d2, nSavedDC=-1) returned 1 [0057.073] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbe0109d2) returned 0x0 [0057.073] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcbc0dbd) returned 0x0 [0057.073] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0057.073] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.073] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.073] GetSystemMetrics (nIndex=42) returned 0 [0057.073] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.073] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.073] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0057.073] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0057.073] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0057.073] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0057.073] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0057.074] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0057.074] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x1) returned 0x1b00017 [0057.074] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x2) returned 0x1900010 [0057.074] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x7) returned 0xffffffffb10509d7 [0057.074] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x6) returned 0x18a002e [0057.074] SaveDC (hdc=0xffffffffbe0109d2) returned 1 [0057.074] GetNearestColor (hdc=0xffffffffbe0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0057.074] RestoreDC (hdc=0xffffffffbe0109d2, nSavedDC=-1) returned 1 [0057.074] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbe0109d2) returned 0x0 [0057.074] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0057.074] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0057.074] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0057.074] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0057.074] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x1) returned 0x1b00017 [0057.074] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x2) returned 0x1900010 [0057.074] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x7) returned 0xffffffffb10509d7 [0057.074] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x6) returned 0x18a002e [0057.074] SaveDC (hdc=0xffffffffbe0109d2) returned 1 [0057.074] GetTextAlign (hdc=0xffffffffbe0109d2) returned 0x0 [0057.074] GetTextColor (hdc=0xffffffffbe0109d2) returned 0x0 [0057.075] SetTextColor (hdc=0xffffffffbe0109d2, color=0xf0f0f0) returned 0x0 [0057.075] GetCurrentObject (hdc=0xffffffffbe0109d2, type=0x6) returned 0x18a002e [0057.075] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0057.075] SelectObject (hdc=0xffffffffbe0109d2, h=0x260a09ba) returned 0x18a002e [0057.075] GetBkMode (hdc=0xffffffffbe0109d2) returned 2 [0057.075] SetBkMode (hdc=0xffffffffbe0109d2, mode=1) returned 2 [0057.075] DrawTextExW (in: hdc=0xffffffffbe0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x273baa8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0057.075] DrawTextExW (in: hdc=0xffffffffbe0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x273baa8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0057.076] RestoreDC (hdc=0xffffffffbe0109d2, nSavedDC=-1) returned 1 [0057.076] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbe0109d2) returned 0x0 [0057.076] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0057.076] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffbe0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0057.083] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbe0109d2) returned 0x0 [0057.083] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0057.083] SelectObject (hdc=0xffffffffbe0109d2, h=0x185000f) returned 0xffffffffb10509d7 [0057.083] DeleteDC (hdc=0xffffffffbe0109d2) returned 1 [0057.083] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0057.083] DeleteObject (ho=0xffffffffb10509d7) returned 1 [0057.086] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0057.086] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.086] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.086] WaitMessage () returned 1 [0057.259] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.259] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.259] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.259] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.259] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.259] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0057.259] GetCurrentThreadId () returned 0xa28 [0057.259] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0057.259] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.259] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.259] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.259] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.259] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.259] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0057.259] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0057.259] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffff00109c0 [0057.259] GetObjectType (h=0x60109d6) returned 0x3 [0057.259] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffb20509d7 [0057.259] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb20509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.260] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb20509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.260] DeleteObject (ho=0xffffffffb20509d7) returned 1 [0057.260] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffbf0509d2 [0057.260] SelectObject (hdc=0xfffffffff00109c0, h=0xffffffffbf0509d2) returned 0x185000f [0057.260] GdipCreateFromHDC (hdc=0xfffffffff00109c0, graphics=0x26e408) returned 0x0 [0057.260] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0057.260] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0057.260] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0057.260] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0057.260] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0057.260] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.260] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0057.260] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.260] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0057.260] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0057.260] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0057.260] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0057.260] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0057.260] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.260] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.261] GetSystemMetrics (nIndex=42) returned 0 [0057.261] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.261] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.261] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0057.261] IsAppThemed () returned 0x1 [0057.261] GetThemeAppProperties () returned 0x3 [0057.261] GetThemeAppProperties () returned 0x3 [0057.261] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0057.261] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0057.261] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0057.261] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0057.261] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0057.261] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.261] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.261] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.261] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0057.261] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.261] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.261] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.261] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0057.261] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0057.261] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0057.261] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0057.261] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0057.261] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0057.261] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x1) returned 0x1b00017 [0057.261] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x2) returned 0x1900010 [0057.261] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x7) returned 0xffffffffbf0509d2 [0057.261] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x6) returned 0x18a002e [0057.261] SaveDC (hdc=0xfffffffff00109c0) returned 1 [0057.262] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc0409f1 [0057.262] GetClipRgn (hdc=0xfffffffff00109c0, hrgn=0xc0409f1) returned 0 [0057.262] SelectClipRgn (hdc=0xfffffffff00109c0, hrgn=0x330409ff) returned 2 [0057.262] DeleteObject (ho=0xc0409f1) returned 1 [0057.262] DeleteObject (ho=0x330409ff) returned 1 [0057.262] OffsetViewportOrgEx (in: hdc=0xfffffffff00109c0, x=0, y=0, lppt=0x26c47e0 | out: lppt=0x26c47e0) returned 1 [0057.262] OffsetViewportOrgEx (in: hdc=0xfffffffff00109c0, x=-417, y=-278, lppt=0x26c47f8 | out: lppt=0x26c47f8) returned 1 [0057.262] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0057.262] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x1) returned 0x1b00017 [0057.262] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x2) returned 0x1900010 [0057.262] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x7) returned 0xffffffffbf0509d2 [0057.262] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x6) returned 0x18a002e [0057.262] SaveDC (hdc=0xfffffffff00109c0) returned 2 [0057.262] GetNearestColor (hdc=0xfffffffff00109c0, color=0x6c4607) returned 0x6c4607 [0057.262] CreateSolidBrush (color=0x6c4607) returned 0xffffffffbe100276 [0057.262] FillRect (hDC=0xfffffffff00109c0, lprc=0x26de08, hbr=0xffffffffbe100276) returned 1 [0057.269] DeleteObject (ho=0xffffffffbe100276) returned 1 [0057.269] RestoreDC (hdc=0xfffffffff00109c0, nSavedDC=-1) returned 1 [0057.269] RestoreDC (hdc=0xfffffffff00109c0, nSavedDC=-1) returned 1 [0057.269] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff00109c0) returned 0x0 [0057.269] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcba0dbd) returned 0x0 [0057.269] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0057.269] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.269] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.269] GetSystemMetrics (nIndex=42) returned 0 [0057.269] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.269] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.269] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x33) returned 0x0 [0057.270] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0057.270] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0057.270] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0057.270] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0057.270] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0057.270] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0057.270] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x1) returned 0x1b00017 [0057.270] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x2) returned 0x1900010 [0057.270] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x7) returned 0xffffffffbf0509d2 [0057.270] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x6) returned 0x18a002e [0057.270] SaveDC (hdc=0xfffffffff00109c0) returned 1 [0057.270] GetNearestColor (hdc=0xfffffffff00109c0, color=0xf0f0f0) returned 0xf0f0f0 [0057.270] RestoreDC (hdc=0xfffffffff00109c0, nSavedDC=-1) returned 1 [0057.270] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff00109c0) returned 0x0 [0057.271] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0057.271] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0057.271] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0057.271] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0057.271] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x1) returned 0x1b00017 [0057.271] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x2) returned 0x1900010 [0057.271] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x7) returned 0xffffffffbf0509d2 [0057.271] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x6) returned 0x18a002e [0057.271] SaveDC (hdc=0xfffffffff00109c0) returned 1 [0057.271] GetTextAlign (hdc=0xfffffffff00109c0) returned 0x0 [0057.271] GetTextColor (hdc=0xfffffffff00109c0) returned 0x0 [0057.271] SetTextColor (hdc=0xfffffffff00109c0, color=0xf0f0f0) returned 0x0 [0057.271] GetCurrentObject (hdc=0xfffffffff00109c0, type=0x6) returned 0x18a002e [0057.271] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0057.271] SelectObject (hdc=0xfffffffff00109c0, h=0x260a09ba) returned 0x18a002e [0057.271] GetBkMode (hdc=0xfffffffff00109c0) returned 2 [0057.271] SetBkMode (hdc=0xfffffffff00109c0, mode=1) returned 2 [0057.271] DrawTextExW (in: hdc=0xfffffffff00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c5b08 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0057.272] DrawTextExW (in: hdc=0xfffffffff00109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c5b08 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0057.272] RestoreDC (hdc=0xfffffffff00109c0, nSavedDC=-1) returned 1 [0057.272] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff00109c0) returned 0x0 [0057.272] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0057.272] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffff00109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0057.272] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff00109c0) returned 0x0 [0057.272] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0057.272] SelectObject (hdc=0xfffffffff00109c0, h=0x185000f) returned 0xffffffffbf0509d2 [0057.272] DeleteDC (hdc=0xfffffffff00109c0) returned 1 [0057.272] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0057.273] DeleteObject (ho=0xffffffffbf0509d2) returned 1 [0057.276] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0057.276] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.276] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.276] WaitMessage () returned 1 [0057.453] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.453] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.453] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.453] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.453] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.453] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0057.453] GetCurrentThreadId () returned 0xa28 [0057.453] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0057.453] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.453] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.453] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.453] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.453] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.453] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0057.454] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0057.454] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffb40109d7 [0057.454] GetObjectType (h=0x60109d6) returned 0x3 [0057.454] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffc00509d2 [0057.454] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc00509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.454] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc00509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.454] DeleteObject (ho=0xffffffffc00509d2) returned 1 [0057.454] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffff10509c0 [0057.454] SelectObject (hdc=0xffffffffb40109d7, h=0xfffffffff10509c0) returned 0x185000f [0057.454] GdipCreateFromHDC (hdc=0xffffffffb40109d7, graphics=0x26e408) returned 0x0 [0057.454] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0057.454] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0057.454] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0057.454] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0057.454] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0057.454] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.455] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0057.455] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.455] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0057.455] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0057.455] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0057.455] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0057.455] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0057.455] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.455] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.455] GetSystemMetrics (nIndex=42) returned 0 [0057.455] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.455] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.455] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0057.455] IsAppThemed () returned 0x1 [0057.455] GetThemeAppProperties () returned 0x3 [0057.455] GetThemeAppProperties () returned 0x3 [0057.455] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0057.455] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0057.455] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0057.455] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0057.455] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0057.455] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.455] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.455] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.455] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0057.455] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.455] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.455] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.455] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0057.456] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0057.456] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0057.456] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0057.456] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0057.456] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0057.456] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x1) returned 0x1b00017 [0057.456] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x2) returned 0x1900010 [0057.456] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x7) returned 0xfffffffff10509c0 [0057.456] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x6) returned 0x18a002e [0057.456] SaveDC (hdc=0xffffffffb40109d7) returned 1 [0057.456] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x340409ff [0057.456] GetClipRgn (hdc=0xffffffffb40109d7, hrgn=0x340409ff) returned 0 [0057.456] SelectClipRgn (hdc=0xffffffffb40109d7, hrgn=0xf0409f1) returned 2 [0057.456] DeleteObject (ho=0x340409ff) returned 1 [0057.456] DeleteObject (ho=0xf0409f1) returned 1 [0057.456] OffsetViewportOrgEx (in: hdc=0xffffffffb40109d7, x=0, y=0, lppt=0x2804060 | out: lppt=0x2804060) returned 1 [0057.456] OffsetViewportOrgEx (in: hdc=0xffffffffb40109d7, x=-417, y=-278, lppt=0x2804078 | out: lppt=0x2804078) returned 1 [0057.456] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0057.456] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x1) returned 0x1b00017 [0057.456] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x2) returned 0x1900010 [0057.456] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x7) returned 0xfffffffff10509c0 [0057.456] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x6) returned 0x18a002e [0057.456] SaveDC (hdc=0xffffffffb40109d7) returned 2 [0057.456] GetNearestColor (hdc=0xffffffffb40109d7, color=0x6c4607) returned 0x6c4607 [0057.456] CreateSolidBrush (color=0x6c4607) returned 0xffffffffbf100276 [0057.456] FillRect (hDC=0xffffffffb40109d7, lprc=0x26de08, hbr=0xffffffffbf100276) returned 1 [0057.463] DeleteObject (ho=0xffffffffbf100276) returned 1 [0057.463] RestoreDC (hdc=0xffffffffb40109d7, nSavedDC=-1) returned 1 [0057.463] RestoreDC (hdc=0xffffffffb40109d7, nSavedDC=-1) returned 1 [0057.463] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb40109d7) returned 0x0 [0057.463] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcb80dbd) returned 0x0 [0057.463] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0057.463] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.463] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.463] GetSystemMetrics (nIndex=42) returned 0 [0057.463] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.463] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.463] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0057.463] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0057.463] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0057.463] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0057.463] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0057.463] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0057.463] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x1) returned 0x1b00017 [0057.463] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x2) returned 0x1900010 [0057.463] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x7) returned 0xfffffffff10509c0 [0057.463] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x6) returned 0x18a002e [0057.463] SaveDC (hdc=0xffffffffb40109d7) returned 1 [0057.463] GetNearestColor (hdc=0xffffffffb40109d7, color=0xf0f0f0) returned 0xf0f0f0 [0057.463] RestoreDC (hdc=0xffffffffb40109d7, nSavedDC=-1) returned 1 [0057.463] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb40109d7) returned 0x0 [0057.464] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0057.464] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0057.464] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0057.464] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x1) returned 0x1b00017 [0057.464] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x2) returned 0x1900010 [0057.464] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x7) returned 0xfffffffff10509c0 [0057.464] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x6) returned 0x18a002e [0057.464] SaveDC (hdc=0xffffffffb40109d7) returned 1 [0057.464] GetTextAlign (hdc=0xffffffffb40109d7) returned 0x0 [0057.464] GetTextColor (hdc=0xffffffffb40109d7) returned 0x0 [0057.464] SetTextColor (hdc=0xffffffffb40109d7, color=0xf0f0f0) returned 0x0 [0057.464] GetCurrentObject (hdc=0xffffffffb40109d7, type=0x6) returned 0x18a002e [0057.464] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0057.464] SelectObject (hdc=0xffffffffb40109d7, h=0x260a09ba) returned 0x18a002e [0057.464] GetBkMode (hdc=0xffffffffb40109d7) returned 2 [0057.464] SetBkMode (hdc=0xffffffffb40109d7, mode=1) returned 2 [0057.464] DrawTextExW (in: hdc=0xffffffffb40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2804d28 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0057.464] DrawTextExW (in: hdc=0xffffffffb40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2804d28 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0057.465] RestoreDC (hdc=0xffffffffb40109d7, nSavedDC=-1) returned 1 [0057.465] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb40109d7) returned 0x0 [0057.465] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0057.465] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffb40109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0057.465] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb40109d7) returned 0x0 [0057.465] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0057.465] SelectObject (hdc=0xffffffffb40109d7, h=0x185000f) returned 0xfffffffff10509c0 [0057.465] DeleteDC (hdc=0xffffffffb40109d7) returned 1 [0057.465] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0057.465] DeleteObject (ho=0xfffffffff10509c0) returned 1 [0057.469] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0057.469] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.469] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.469] WaitMessage () returned 1 [0057.656] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.656] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.656] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.656] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.656] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.656] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0057.656] GetCurrentThreadId () returned 0xa28 [0057.656] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0057.656] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.656] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.656] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.656] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.656] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.656] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0057.656] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0057.656] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffc20109d2 [0057.656] GetObjectType (h=0x60109d6) returned 0x3 [0057.656] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffff20509c0 [0057.657] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff20509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.657] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff20509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.657] DeleteObject (ho=0xfffffffff20509c0) returned 1 [0057.657] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffb50509d7 [0057.657] SelectObject (hdc=0xffffffffc20109d2, h=0xffffffffb50509d7) returned 0x185000f [0057.657] GdipCreateFromHDC (hdc=0xffffffffc20109d2, graphics=0x26e408) returned 0x0 [0057.657] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0057.657] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0057.657] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0057.657] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0057.657] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0057.657] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.657] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0057.657] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.657] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0057.657] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0057.657] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0057.657] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0057.657] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0057.658] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.658] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.658] GetSystemMetrics (nIndex=42) returned 0 [0057.658] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.658] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.658] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0057.658] IsAppThemed () returned 0x1 [0057.658] GetThemeAppProperties () returned 0x3 [0057.658] GetThemeAppProperties () returned 0x3 [0057.658] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0057.658] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0057.658] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0057.658] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0057.658] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0057.658] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.658] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.658] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.658] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0057.658] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.658] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.658] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.658] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0057.658] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0057.658] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0057.658] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0057.658] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0057.658] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0057.658] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x1) returned 0x1b00017 [0057.658] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x2) returned 0x1900010 [0057.658] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x7) returned 0xffffffffb50509d7 [0057.659] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x6) returned 0x18a002e [0057.659] SaveDC (hdc=0xffffffffc20109d2) returned 1 [0057.659] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x100409f1 [0057.659] GetClipRgn (hdc=0xffffffffc20109d2, hrgn=0x100409f1) returned 0 [0057.659] SelectClipRgn (hdc=0xffffffffc20109d2, hrgn=0x370409ff) returned 2 [0057.659] DeleteObject (ho=0x100409f1) returned 1 [0057.659] DeleteObject (ho=0x370409ff) returned 1 [0057.659] OffsetViewportOrgEx (in: hdc=0xffffffffc20109d2, x=0, y=0, lppt=0x26e9370 | out: lppt=0x26e9370) returned 1 [0057.659] OffsetViewportOrgEx (in: hdc=0xffffffffc20109d2, x=-417, y=-278, lppt=0x26e9388 | out: lppt=0x26e9388) returned 1 [0057.659] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0057.659] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x1) returned 0x1b00017 [0057.659] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x2) returned 0x1900010 [0057.659] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x7) returned 0xffffffffb50509d7 [0057.659] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x6) returned 0x18a002e [0057.659] SaveDC (hdc=0xffffffffc20109d2) returned 2 [0057.659] GetNearestColor (hdc=0xffffffffc20109d2, color=0x6c4607) returned 0x6c4607 [0057.659] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc0100276 [0057.659] FillRect (hDC=0xffffffffc20109d2, lprc=0x26de08, hbr=0xffffffffc0100276) returned 1 [0057.665] DeleteObject (ho=0xffffffffc0100276) returned 1 [0057.665] RestoreDC (hdc=0xffffffffc20109d2, nSavedDC=-1) returned 1 [0057.665] RestoreDC (hdc=0xffffffffc20109d2, nSavedDC=-1) returned 1 [0057.666] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc20109d2) returned 0x0 [0057.666] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcb60dbd) returned 0x0 [0057.666] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0057.666] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.666] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.666] GetSystemMetrics (nIndex=42) returned 0 [0057.666] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.666] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.666] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x35) returned 0x0 [0057.667] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0057.667] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0057.667] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0057.667] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0057.667] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0057.667] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0057.667] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x1) returned 0x1b00017 [0057.667] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x2) returned 0x1900010 [0057.667] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x7) returned 0xffffffffb50509d7 [0057.667] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x6) returned 0x18a002e [0057.667] SaveDC (hdc=0xffffffffc20109d2) returned 1 [0057.667] GetNearestColor (hdc=0xffffffffc20109d2, color=0xf0f0f0) returned 0xf0f0f0 [0057.667] RestoreDC (hdc=0xffffffffc20109d2, nSavedDC=-1) returned 1 [0057.667] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc20109d2) returned 0x0 [0057.667] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0057.667] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0057.667] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0057.667] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x1) returned 0x1b00017 [0057.667] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x2) returned 0x1900010 [0057.667] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x7) returned 0xffffffffb50509d7 [0057.667] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x6) returned 0x18a002e [0057.668] SaveDC (hdc=0xffffffffc20109d2) returned 1 [0057.668] GetTextAlign (hdc=0xffffffffc20109d2) returned 0x0 [0057.668] GetTextColor (hdc=0xffffffffc20109d2) returned 0x0 [0057.668] SetTextColor (hdc=0xffffffffc20109d2, color=0xf0f0f0) returned 0x0 [0057.668] GetCurrentObject (hdc=0xffffffffc20109d2, type=0x6) returned 0x18a002e [0057.668] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0057.668] SelectObject (hdc=0xffffffffc20109d2, h=0x260a09ba) returned 0x18a002e [0057.668] GetBkMode (hdc=0xffffffffc20109d2) returned 2 [0057.668] SetBkMode (hdc=0xffffffffc20109d2, mode=1) returned 2 [0057.668] DrawTextExW (in: hdc=0xffffffffc20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26ea248 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0057.668] DrawTextExW (in: hdc=0xffffffffc20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26ea248 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0057.668] RestoreDC (hdc=0xffffffffc20109d2, nSavedDC=-1) returned 1 [0057.668] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc20109d2) returned 0x0 [0057.669] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0057.669] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffc20109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0057.669] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc20109d2) returned 0x0 [0057.669] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0057.669] SelectObject (hdc=0xffffffffc20109d2, h=0x185000f) returned 0xffffffffb50509d7 [0057.669] DeleteDC (hdc=0xffffffffc20109d2) returned 1 [0057.669] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0057.669] DeleteObject (ho=0xffffffffb50509d7) returned 1 [0057.672] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0057.672] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.672] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.672] WaitMessage () returned 1 [0057.890] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.890] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.890] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.890] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.890] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.890] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0057.890] GetCurrentThreadId () returned 0xa28 [0057.890] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0057.891] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.891] IsWindowUnicode (hWnd=0x3015e) returned 1 [0057.891] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0057.891] TranslateMessage (lpMsg=0x26ee10) returned 0 [0057.891] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0057.891] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0057.891] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0057.891] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffff40109c0 [0057.891] GetObjectType (h=0x60109d6) returned 0x3 [0057.891] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffb60509d7 [0057.891] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb60509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.891] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffb60509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0057.891] DeleteObject (ho=0xffffffffb60509d7) returned 1 [0057.891] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffc30509d2 [0057.891] SelectObject (hdc=0xfffffffff40109c0, h=0xffffffffc30509d2) returned 0x185000f [0057.891] GdipCreateFromHDC (hdc=0xfffffffff40109c0, graphics=0x26e408) returned 0x0 [0057.892] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0057.892] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0057.892] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0057.892] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0057.892] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0057.892] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.892] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0057.892] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.892] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0057.892] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0057.892] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0057.892] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0057.892] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0057.892] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.892] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.892] GetSystemMetrics (nIndex=42) returned 0 [0057.892] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.892] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.892] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0057.892] IsAppThemed () returned 0x1 [0057.892] GetThemeAppProperties () returned 0x3 [0057.892] GetThemeAppProperties () returned 0x3 [0057.892] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0057.892] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0057.892] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0057.892] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0057.893] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0057.893] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.893] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.893] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.893] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0057.893] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0057.893] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0057.893] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0057.893] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0057.893] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0057.893] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0057.893] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0057.893] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0057.893] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0057.893] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x1) returned 0x1b00017 [0057.893] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x2) returned 0x1900010 [0057.893] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x7) returned 0xffffffffc30509d2 [0057.893] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x6) returned 0x18a002e [0057.893] SaveDC (hdc=0xfffffffff40109c0) returned 1 [0057.893] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x380409ff [0057.893] GetClipRgn (hdc=0xfffffffff40109c0, hrgn=0x380409ff) returned 0 [0057.893] SelectClipRgn (hdc=0xfffffffff40109c0, hrgn=0x130409f1) returned 2 [0057.893] DeleteObject (ho=0x380409ff) returned 1 [0057.893] DeleteObject (ho=0x130409f1) returned 1 [0057.893] OffsetViewportOrgEx (in: hdc=0xfffffffff40109c0, x=0, y=0, lppt=0x26ab330 | out: lppt=0x26ab330) returned 1 [0057.893] OffsetViewportOrgEx (in: hdc=0xfffffffff40109c0, x=-417, y=-278, lppt=0x26ab348 | out: lppt=0x26ab348) returned 1 [0057.893] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0057.893] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x1) returned 0x1b00017 [0057.893] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x2) returned 0x1900010 [0057.894] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x7) returned 0xffffffffc30509d2 [0057.894] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x6) returned 0x18a002e [0057.894] SaveDC (hdc=0xfffffffff40109c0) returned 2 [0057.894] GetNearestColor (hdc=0xfffffffff40109c0, color=0x6c4607) returned 0x6c4607 [0057.894] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc1100276 [0057.894] FillRect (hDC=0xfffffffff40109c0, lprc=0x26de08, hbr=0xffffffffc1100276) returned 1 [0057.900] DeleteObject (ho=0xffffffffc1100276) returned 1 [0057.900] RestoreDC (hdc=0xfffffffff40109c0, nSavedDC=-1) returned 1 [0057.900] RestoreDC (hdc=0xfffffffff40109c0, nSavedDC=-1) returned 1 [0057.900] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff40109c0) returned 0x0 [0057.900] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcb40dbd) returned 0x0 [0057.900] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0057.900] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0057.900] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0057.900] GetSystemMetrics (nIndex=42) returned 0 [0057.900] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0057.900] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0057.900] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0057.900] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0057.900] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0057.900] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0057.901] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0057.901] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0057.901] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x1) returned 0x1b00017 [0057.901] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x2) returned 0x1900010 [0057.901] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x7) returned 0xffffffffc30509d2 [0057.901] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x6) returned 0x18a002e [0057.901] SaveDC (hdc=0xfffffffff40109c0) returned 1 [0057.901] GetNearestColor (hdc=0xfffffffff40109c0, color=0xf0f0f0) returned 0xf0f0f0 [0057.901] RestoreDC (hdc=0xfffffffff40109c0, nSavedDC=-1) returned 1 [0057.901] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff40109c0) returned 0x0 [0057.901] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0057.901] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0057.901] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0057.901] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0057.901] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x1) returned 0x1b00017 [0057.901] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x2) returned 0x1900010 [0057.901] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x7) returned 0xffffffffc30509d2 [0057.901] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x6) returned 0x18a002e [0057.901] SaveDC (hdc=0xfffffffff40109c0) returned 1 [0057.901] GetTextAlign (hdc=0xfffffffff40109c0) returned 0x0 [0057.901] GetTextColor (hdc=0xfffffffff40109c0) returned 0x0 [0057.902] SetTextColor (hdc=0xfffffffff40109c0, color=0xf0f0f0) returned 0x0 [0057.902] GetCurrentObject (hdc=0xfffffffff40109c0, type=0x6) returned 0x18a002e [0057.902] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0057.902] SelectObject (hdc=0xfffffffff40109c0, h=0x260a09ba) returned 0x18a002e [0057.902] GetBkMode (hdc=0xfffffffff40109c0) returned 2 [0057.902] SetBkMode (hdc=0xfffffffff40109c0, mode=1) returned 2 [0057.902] DrawTextExW (in: hdc=0xfffffffff40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26abff8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0057.902] DrawTextExW (in: hdc=0xfffffffff40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26abff8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0057.902] RestoreDC (hdc=0xfffffffff40109c0, nSavedDC=-1) returned 1 [0057.902] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff40109c0) returned 0x0 [0057.903] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0057.903] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffff40109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0057.903] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff40109c0) returned 0x0 [0057.903] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0057.903] SelectObject (hdc=0xfffffffff40109c0, h=0x185000f) returned 0xffffffffc30509d2 [0057.903] DeleteDC (hdc=0xfffffffff40109c0) returned 1 [0057.903] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0057.903] DeleteObject (ho=0xffffffffc30509d2) returned 1 [0057.907] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0057.908] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.908] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0057.908] WaitMessage () returned 1 [0058.109] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.109] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.109] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.109] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.109] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.109] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0058.109] GetCurrentThreadId () returned 0xa28 [0058.109] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0058.109] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.109] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.109] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.109] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.109] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.109] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0058.109] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0058.109] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffb80109d7 [0058.109] GetObjectType (h=0x60109d6) returned 0x3 [0058.109] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffc40509d2 [0058.109] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc40509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.109] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc40509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.109] DeleteObject (ho=0xffffffffc40509d2) returned 1 [0058.110] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffff50509c0 [0058.110] SelectObject (hdc=0xffffffffb80109d7, h=0xfffffffff50509c0) returned 0x185000f [0058.110] GdipCreateFromHDC (hdc=0xffffffffb80109d7, graphics=0x26e408) returned 0x0 [0058.110] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0058.110] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0058.110] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0058.110] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0058.110] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0058.110] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.110] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0058.110] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.110] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0058.110] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0058.110] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0058.110] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0058.110] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0058.110] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.110] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.110] GetSystemMetrics (nIndex=42) returned 0 [0058.110] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.111] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.111] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0058.111] IsAppThemed () returned 0x1 [0058.111] GetThemeAppProperties () returned 0x3 [0058.111] GetThemeAppProperties () returned 0x3 [0058.111] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0058.111] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0058.111] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0058.111] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0058.111] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0058.111] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.111] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.111] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.111] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0058.111] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.111] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.111] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.111] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0058.111] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0058.111] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0058.111] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0058.111] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0058.111] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0058.111] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x1) returned 0x1b00017 [0058.111] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x2) returned 0x1900010 [0058.111] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x7) returned 0xfffffffff50509c0 [0058.111] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x6) returned 0x18a002e [0058.112] SaveDC (hdc=0xffffffffb80109d7) returned 1 [0058.112] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x140409f1 [0058.112] GetClipRgn (hdc=0xffffffffb80109d7, hrgn=0x140409f1) returned 0 [0058.112] SelectClipRgn (hdc=0xffffffffb80109d7, hrgn=0x3b0409ff) returned 2 [0058.112] DeleteObject (ho=0x140409f1) returned 1 [0058.112] DeleteObject (ho=0x3b0409ff) returned 1 [0058.112] OffsetViewportOrgEx (in: hdc=0xffffffffb80109d7, x=0, y=0, lppt=0x26adbd8 | out: lppt=0x26adbd8) returned 1 [0058.112] OffsetViewportOrgEx (in: hdc=0xffffffffb80109d7, x=-417, y=-278, lppt=0x26adbf0 | out: lppt=0x26adbf0) returned 1 [0058.112] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0058.112] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x1) returned 0x1b00017 [0058.112] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x2) returned 0x1900010 [0058.112] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x7) returned 0xfffffffff50509c0 [0058.112] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x6) returned 0x18a002e [0058.112] SaveDC (hdc=0xffffffffb80109d7) returned 2 [0058.112] GetNearestColor (hdc=0xffffffffb80109d7, color=0x6c4607) returned 0x6c4607 [0058.112] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc2100276 [0058.112] FillRect (hDC=0xffffffffb80109d7, lprc=0x26de08, hbr=0xffffffffc2100276) returned 1 [0058.118] DeleteObject (ho=0xffffffffc2100276) returned 1 [0058.118] RestoreDC (hdc=0xffffffffb80109d7, nSavedDC=-1) returned 1 [0058.119] RestoreDC (hdc=0xffffffffb80109d7, nSavedDC=-1) returned 1 [0058.119] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb80109d7) returned 0x0 [0058.119] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcb20dbd) returned 0x0 [0058.119] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0058.119] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.119] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.119] GetSystemMetrics (nIndex=42) returned 0 [0058.119] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.119] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.119] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x37) returned 0x0 [0058.120] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0058.120] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0058.120] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0058.120] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0058.120] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0058.120] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0058.120] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x1) returned 0x1b00017 [0058.120] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x2) returned 0x1900010 [0058.120] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x7) returned 0xfffffffff50509c0 [0058.120] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x6) returned 0x18a002e [0058.120] SaveDC (hdc=0xffffffffb80109d7) returned 1 [0058.120] GetNearestColor (hdc=0xffffffffb80109d7, color=0xf0f0f0) returned 0xf0f0f0 [0058.120] RestoreDC (hdc=0xffffffffb80109d7, nSavedDC=-1) returned 1 [0058.120] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb80109d7) returned 0x0 [0058.120] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0058.120] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0058.120] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0058.120] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0058.120] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x1) returned 0x1b00017 [0058.121] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x2) returned 0x1900010 [0058.121] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x7) returned 0xfffffffff50509c0 [0058.121] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x6) returned 0x18a002e [0058.121] SaveDC (hdc=0xffffffffb80109d7) returned 1 [0058.121] GetTextAlign (hdc=0xffffffffb80109d7) returned 0x0 [0058.121] GetTextColor (hdc=0xffffffffb80109d7) returned 0x0 [0058.121] SetTextColor (hdc=0xffffffffb80109d7, color=0xf0f0f0) returned 0x0 [0058.121] GetCurrentObject (hdc=0xffffffffb80109d7, type=0x6) returned 0x18a002e [0058.121] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0058.121] SelectObject (hdc=0xffffffffb80109d7, h=0x260a09ba) returned 0x18a002e [0058.121] GetBkMode (hdc=0xffffffffb80109d7) returned 2 [0058.121] SetBkMode (hdc=0xffffffffb80109d7, mode=1) returned 2 [0058.121] DrawTextExW (in: hdc=0xffffffffb80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26aeaa0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0058.121] DrawTextExW (in: hdc=0xffffffffb80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26aeaa0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0058.122] RestoreDC (hdc=0xffffffffb80109d7, nSavedDC=-1) returned 1 [0058.122] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb80109d7) returned 0x0 [0058.122] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0058.122] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffb80109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0058.122] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffb80109d7) returned 0x0 [0058.122] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0058.122] SelectObject (hdc=0xffffffffb80109d7, h=0x185000f) returned 0xfffffffff50509c0 [0058.122] DeleteDC (hdc=0xffffffffb80109d7) returned 1 [0058.122] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0058.122] DeleteObject (ho=0xfffffffff50509c0) returned 1 [0058.125] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0058.125] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0058.125] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0058.125] WaitMessage () returned 1 [0058.335] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.335] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.335] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.335] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.335] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.335] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0058.335] GetCurrentThreadId () returned 0xa28 [0058.335] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0058.335] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.336] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.336] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.336] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.336] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.336] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0058.336] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0058.336] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffc60109d2 [0058.336] GetObjectType (h=0x60109d6) returned 0x3 [0058.336] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffff60509c0 [0058.336] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff60509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.336] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff60509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.336] DeleteObject (ho=0xfffffffff60509c0) returned 1 [0058.336] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffb90509d7 [0058.336] SelectObject (hdc=0xffffffffc60109d2, h=0xffffffffb90509d7) returned 0x185000f [0058.336] GdipCreateFromHDC (hdc=0xffffffffc60109d2, graphics=0x26e408) returned 0x0 [0058.337] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0058.337] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0058.337] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0058.337] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0058.337] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0058.337] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.337] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0058.337] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.337] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0058.337] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0058.337] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0058.337] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0058.337] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0058.337] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.337] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.337] GetSystemMetrics (nIndex=42) returned 0 [0058.337] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.337] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.337] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0058.337] IsAppThemed () returned 0x1 [0058.337] GetThemeAppProperties () returned 0x3 [0058.337] GetThemeAppProperties () returned 0x3 [0058.337] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0058.337] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0058.337] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0058.337] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0058.337] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0058.337] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.338] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.338] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.338] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0058.338] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.338] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.338] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.338] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0058.338] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0058.338] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0058.338] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0058.338] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0058.338] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0058.338] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x1) returned 0x1b00017 [0058.338] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x2) returned 0x1900010 [0058.338] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x7) returned 0xffffffffb90509d7 [0058.338] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x6) returned 0x18a002e [0058.338] SaveDC (hdc=0xffffffffc60109d2) returned 1 [0058.338] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3c0409ff [0058.338] GetClipRgn (hdc=0xffffffffc60109d2, hrgn=0x3c0409ff) returned 0 [0058.338] SelectClipRgn (hdc=0xffffffffc60109d2, hrgn=0x170409f1) returned 2 [0058.338] DeleteObject (ho=0x3c0409ff) returned 1 [0058.338] DeleteObject (ho=0x170409f1) returned 1 [0058.338] OffsetViewportOrgEx (in: hdc=0xffffffffc60109d2, x=0, y=0, lppt=0x26b2390 | out: lppt=0x26b2390) returned 1 [0058.338] OffsetViewportOrgEx (in: hdc=0xffffffffc60109d2, x=-417, y=-278, lppt=0x26b23a8 | out: lppt=0x26b23a8) returned 1 [0058.338] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0058.338] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x1) returned 0x1b00017 [0058.338] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x2) returned 0x1900010 [0058.338] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x7) returned 0xffffffffb90509d7 [0058.339] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x6) returned 0x18a002e [0058.339] SaveDC (hdc=0xffffffffc60109d2) returned 2 [0058.339] GetNearestColor (hdc=0xffffffffc60109d2, color=0x6c4607) returned 0x6c4607 [0058.339] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc3100276 [0058.339] FillRect (hDC=0xffffffffc60109d2, lprc=0x26de08, hbr=0xffffffffc3100276) returned 1 [0058.345] DeleteObject (ho=0xffffffffc3100276) returned 1 [0058.345] RestoreDC (hdc=0xffffffffc60109d2, nSavedDC=-1) returned 1 [0058.345] RestoreDC (hdc=0xffffffffc60109d2, nSavedDC=-1) returned 1 [0058.345] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc60109d2) returned 0x0 [0058.345] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcb00dbd) returned 0x0 [0058.345] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0058.345] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.345] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.345] GetSystemMetrics (nIndex=42) returned 0 [0058.345] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.345] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.345] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0058.345] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0058.345] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0058.346] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0058.346] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0058.346] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0058.346] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x1) returned 0x1b00017 [0058.346] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x2) returned 0x1900010 [0058.346] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x7) returned 0xffffffffb90509d7 [0058.346] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x6) returned 0x18a002e [0058.346] SaveDC (hdc=0xffffffffc60109d2) returned 1 [0058.346] GetNearestColor (hdc=0xffffffffc60109d2, color=0xf0f0f0) returned 0xf0f0f0 [0058.346] RestoreDC (hdc=0xffffffffc60109d2, nSavedDC=-1) returned 1 [0058.346] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc60109d2) returned 0x0 [0058.346] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0058.346] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0058.346] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0058.346] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0058.346] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x1) returned 0x1b00017 [0058.346] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x2) returned 0x1900010 [0058.346] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x7) returned 0xffffffffb90509d7 [0058.346] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x6) returned 0x18a002e [0058.346] SaveDC (hdc=0xffffffffc60109d2) returned 1 [0058.346] GetTextAlign (hdc=0xffffffffc60109d2) returned 0x0 [0058.347] GetTextColor (hdc=0xffffffffc60109d2) returned 0x0 [0058.347] SetTextColor (hdc=0xffffffffc60109d2, color=0xf0f0f0) returned 0x0 [0058.347] GetCurrentObject (hdc=0xffffffffc60109d2, type=0x6) returned 0x18a002e [0058.347] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0058.347] SelectObject (hdc=0xffffffffc60109d2, h=0x260a09ba) returned 0x18a002e [0058.347] GetBkMode (hdc=0xffffffffc60109d2) returned 2 [0058.347] SetBkMode (hdc=0xffffffffc60109d2, mode=1) returned 2 [0058.347] DrawTextExW (in: hdc=0xffffffffc60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26b3058 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0058.347] DrawTextExW (in: hdc=0xffffffffc60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26b3058 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0058.347] RestoreDC (hdc=0xffffffffc60109d2, nSavedDC=-1) returned 1 [0058.347] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc60109d2) returned 0x0 [0058.348] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0058.348] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffc60109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0058.348] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc60109d2) returned 0x0 [0058.348] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0058.348] SelectObject (hdc=0xffffffffc60109d2, h=0x185000f) returned 0xffffffffb90509d7 [0058.348] DeleteDC (hdc=0xffffffffc60109d2) returned 1 [0058.348] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0058.348] DeleteObject (ho=0xffffffffb90509d7) returned 1 [0058.351] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0058.351] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0058.351] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0058.351] WaitMessage () returned 1 [0058.522] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.522] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.522] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.522] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.522] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.522] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0058.522] GetCurrentThreadId () returned 0xa28 [0058.522] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0058.522] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.522] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.522] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.522] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.522] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.522] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0058.523] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0058.523] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffff80109c0 [0058.523] GetObjectType (h=0x60109d6) returned 0x3 [0058.523] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffba0509d7 [0058.523] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffba0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.523] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffba0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.523] DeleteObject (ho=0xffffffffba0509d7) returned 1 [0058.523] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffc70509d2 [0058.523] SelectObject (hdc=0xfffffffff80109c0, h=0xffffffffc70509d2) returned 0x185000f [0058.523] GdipCreateFromHDC (hdc=0xfffffffff80109c0, graphics=0x26e408) returned 0x0 [0058.523] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0058.523] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0058.523] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0058.523] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0058.524] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0058.524] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.524] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0058.524] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.524] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0058.524] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0058.524] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0058.524] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0058.524] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0058.524] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.524] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.524] GetSystemMetrics (nIndex=42) returned 0 [0058.524] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.524] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.524] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0058.524] IsAppThemed () returned 0x1 [0058.524] GetThemeAppProperties () returned 0x3 [0058.524] GetThemeAppProperties () returned 0x3 [0058.524] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0058.524] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0058.524] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0058.524] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0058.524] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0058.524] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.524] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.524] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.524] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0058.524] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.524] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.525] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.525] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0058.525] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0058.525] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0058.525] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0058.525] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0058.525] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0058.525] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x1) returned 0x1b00017 [0058.525] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x2) returned 0x1900010 [0058.525] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x7) returned 0xffffffffc70509d2 [0058.525] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x6) returned 0x18a002e [0058.525] SaveDC (hdc=0xfffffffff80109c0) returned 1 [0058.525] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x180409f1 [0058.525] GetClipRgn (hdc=0xfffffffff80109c0, hrgn=0x180409f1) returned 0 [0058.525] SelectClipRgn (hdc=0xfffffffff80109c0, hrgn=0x3f0409ff) returned 2 [0058.525] DeleteObject (ho=0x180409f1) returned 1 [0058.525] DeleteObject (ho=0x3f0409ff) returned 1 [0058.525] OffsetViewportOrgEx (in: hdc=0xfffffffff80109c0, x=0, y=0, lppt=0x26b1ab0 | out: lppt=0x26b1ab0) returned 1 [0058.525] OffsetViewportOrgEx (in: hdc=0xfffffffff80109c0, x=-417, y=-278, lppt=0x26b1ac8 | out: lppt=0x26b1ac8) returned 1 [0058.525] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0058.525] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x1) returned 0x1b00017 [0058.525] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x2) returned 0x1900010 [0058.525] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x7) returned 0xffffffffc70509d2 [0058.525] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x6) returned 0x18a002e [0058.525] SaveDC (hdc=0xfffffffff80109c0) returned 2 [0058.525] GetNearestColor (hdc=0xfffffffff80109c0, color=0x6c4607) returned 0x6c4607 [0058.525] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc4100276 [0058.526] FillRect (hDC=0xfffffffff80109c0, lprc=0x26de08, hbr=0xffffffffc4100276) returned 1 [0058.532] DeleteObject (ho=0xffffffffc4100276) returned 1 [0058.532] RestoreDC (hdc=0xfffffffff80109c0, nSavedDC=-1) returned 1 [0058.532] RestoreDC (hdc=0xfffffffff80109c0, nSavedDC=-1) returned 1 [0058.532] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff80109c0) returned 0x0 [0058.532] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcae0dbd) returned 0x0 [0058.532] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0058.532] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.532] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.532] GetSystemMetrics (nIndex=42) returned 0 [0058.532] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.532] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.532] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x39) returned 0x0 [0058.533] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0058.533] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0058.533] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0058.533] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0058.533] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0058.533] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0058.533] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x1) returned 0x1b00017 [0058.533] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x2) returned 0x1900010 [0058.533] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x7) returned 0xffffffffc70509d2 [0058.533] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x6) returned 0x18a002e [0058.533] SaveDC (hdc=0xfffffffff80109c0) returned 1 [0058.533] GetNearestColor (hdc=0xfffffffff80109c0, color=0xf0f0f0) returned 0xf0f0f0 [0058.533] RestoreDC (hdc=0xfffffffff80109c0, nSavedDC=-1) returned 1 [0058.533] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff80109c0) returned 0x0 [0058.534] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0058.534] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0058.534] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0058.534] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0058.534] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x1) returned 0x1b00017 [0058.534] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x2) returned 0x1900010 [0058.534] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x7) returned 0xffffffffc70509d2 [0058.534] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x6) returned 0x18a002e [0058.534] SaveDC (hdc=0xfffffffff80109c0) returned 1 [0058.534] GetTextAlign (hdc=0xfffffffff80109c0) returned 0x0 [0058.534] GetTextColor (hdc=0xfffffffff80109c0) returned 0x0 [0058.534] SetTextColor (hdc=0xfffffffff80109c0, color=0xf0f0f0) returned 0x0 [0058.534] GetCurrentObject (hdc=0xfffffffff80109c0, type=0x6) returned 0x18a002e [0058.534] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0058.534] SelectObject (hdc=0xfffffffff80109c0, h=0x260a09ba) returned 0x18a002e [0058.534] GetBkMode (hdc=0xfffffffff80109c0) returned 2 [0058.534] SetBkMode (hdc=0xfffffffff80109c0, mode=1) returned 2 [0058.534] DrawTextExW (in: hdc=0xfffffffff80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26b3240 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0058.534] DrawTextExW (in: hdc=0xfffffffff80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26b3240 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0058.535] RestoreDC (hdc=0xfffffffff80109c0, nSavedDC=-1) returned 1 [0058.535] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff80109c0) returned 0x0 [0058.535] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0058.535] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffff80109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0058.535] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff80109c0) returned 0x0 [0058.535] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0058.535] SelectObject (hdc=0xfffffffff80109c0, h=0x185000f) returned 0xffffffffc70509d2 [0058.535] DeleteDC (hdc=0xfffffffff80109c0) returned 1 [0058.535] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0058.535] DeleteObject (ho=0xffffffffc70509d2) returned 1 [0058.539] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0058.539] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0058.539] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0058.539] WaitMessage () returned 1 [0058.671] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.671] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.671] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.671] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.671] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.671] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0058.671] GetCurrentThreadId () returned 0xa28 [0058.671] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0058.671] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.671] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.671] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.671] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.671] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.671] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0058.671] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0058.671] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffbc0109d7 [0058.671] GetObjectType (h=0x60109d6) returned 0x3 [0058.671] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffc80509d2 [0058.671] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc80509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.672] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc80509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.672] DeleteObject (ho=0xffffffffc80509d2) returned 1 [0058.672] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffff90509c0 [0058.672] SelectObject (hdc=0xffffffffbc0109d7, h=0xfffffffff90509c0) returned 0x185000f [0058.672] GdipCreateFromHDC (hdc=0xffffffffbc0109d7, graphics=0x26e408) returned 0x0 [0058.672] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0058.672] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0058.672] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0058.672] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0058.672] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0058.672] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.672] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0058.672] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.672] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0058.672] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0058.672] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0058.672] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0058.672] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0058.672] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.673] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.673] GetSystemMetrics (nIndex=42) returned 0 [0058.673] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.673] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.673] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0058.673] IsAppThemed () returned 0x1 [0058.673] GetThemeAppProperties () returned 0x3 [0058.673] GetThemeAppProperties () returned 0x3 [0058.673] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0058.673] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0058.673] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0058.673] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0058.673] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0058.673] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.673] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.673] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.673] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0058.673] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.673] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.673] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.673] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0058.673] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0058.673] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0058.673] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0058.673] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0058.673] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0058.673] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x1) returned 0x1b00017 [0058.673] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x2) returned 0x1900010 [0058.673] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x7) returned 0xfffffffff90509c0 [0058.674] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x6) returned 0x18a002e [0058.674] SaveDC (hdc=0xffffffffbc0109d7) returned 1 [0058.674] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x400409ff [0058.674] GetClipRgn (hdc=0xffffffffbc0109d7, hrgn=0x400409ff) returned 0 [0058.674] SelectClipRgn (hdc=0xffffffffbc0109d7, hrgn=0x1b0409f1) returned 2 [0058.674] DeleteObject (ho=0x400409ff) returned 1 [0058.674] DeleteObject (ho=0x1b0409f1) returned 1 [0058.674] OffsetViewportOrgEx (in: hdc=0xffffffffbc0109d7, x=0, y=0, lppt=0x277ed50 | out: lppt=0x277ed50) returned 1 [0058.674] OffsetViewportOrgEx (in: hdc=0xffffffffbc0109d7, x=-417, y=-278, lppt=0x277ed68 | out: lppt=0x277ed68) returned 1 [0058.674] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0058.674] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x1) returned 0x1b00017 [0058.674] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x2) returned 0x1900010 [0058.674] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x7) returned 0xfffffffff90509c0 [0058.674] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x6) returned 0x18a002e [0058.674] SaveDC (hdc=0xffffffffbc0109d7) returned 2 [0058.674] GetNearestColor (hdc=0xffffffffbc0109d7, color=0x6c4607) returned 0x6c4607 [0058.674] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc5100276 [0058.674] FillRect (hDC=0xffffffffbc0109d7, lprc=0x26de08, hbr=0xffffffffc5100276) returned 1 [0058.681] DeleteObject (ho=0xffffffffc5100276) returned 1 [0058.681] RestoreDC (hdc=0xffffffffbc0109d7, nSavedDC=-1) returned 1 [0058.681] RestoreDC (hdc=0xffffffffbc0109d7, nSavedDC=-1) returned 1 [0058.681] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbc0109d7) returned 0x0 [0058.681] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcac0dbd) returned 0x0 [0058.681] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0058.681] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.681] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.681] GetSystemMetrics (nIndex=42) returned 0 [0058.681] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.681] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.681] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0058.681] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0058.681] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0058.681] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0058.681] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0058.681] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0058.681] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x1) returned 0x1b00017 [0058.681] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x2) returned 0x1900010 [0058.681] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x7) returned 0xfffffffff90509c0 [0058.681] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x6) returned 0x18a002e [0058.681] SaveDC (hdc=0xffffffffbc0109d7) returned 1 [0058.681] GetNearestColor (hdc=0xffffffffbc0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0058.682] RestoreDC (hdc=0xffffffffbc0109d7, nSavedDC=-1) returned 1 [0058.682] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbc0109d7) returned 0x0 [0058.682] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0058.682] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0058.682] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0058.682] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x1) returned 0x1b00017 [0058.682] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x2) returned 0x1900010 [0058.682] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x7) returned 0xfffffffff90509c0 [0058.682] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x6) returned 0x18a002e [0058.682] SaveDC (hdc=0xffffffffbc0109d7) returned 1 [0058.682] GetTextAlign (hdc=0xffffffffbc0109d7) returned 0x0 [0058.682] GetTextColor (hdc=0xffffffffbc0109d7) returned 0x0 [0058.682] SetTextColor (hdc=0xffffffffbc0109d7, color=0xf0f0f0) returned 0x0 [0058.682] GetCurrentObject (hdc=0xffffffffbc0109d7, type=0x6) returned 0x18a002e [0058.682] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0058.682] SelectObject (hdc=0xffffffffbc0109d7, h=0x260a09ba) returned 0x18a002e [0058.682] GetBkMode (hdc=0xffffffffbc0109d7) returned 2 [0058.682] SetBkMode (hdc=0xffffffffbc0109d7, mode=1) returned 2 [0058.682] DrawTextExW (in: hdc=0xffffffffbc0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x277fa18 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0058.683] DrawTextExW (in: hdc=0xffffffffbc0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x277fa18 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0058.683] RestoreDC (hdc=0xffffffffbc0109d7, nSavedDC=-1) returned 1 [0058.683] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbc0109d7) returned 0x0 [0058.683] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0058.683] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffbc0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0058.683] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffbc0109d7) returned 0x0 [0058.683] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0058.683] SelectObject (hdc=0xffffffffbc0109d7, h=0x185000f) returned 0xfffffffff90509c0 [0058.684] DeleteDC (hdc=0xffffffffbc0109d7) returned 1 [0058.684] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0058.684] DeleteObject (ho=0xfffffffff90509c0) returned 1 [0058.687] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0058.687] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0058.687] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0058.687] WaitMessage () returned 1 [0058.983] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.983] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.983] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.983] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.983] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.983] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0058.983] GetCurrentThreadId () returned 0xa28 [0058.983] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0058.983] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.983] IsWindowUnicode (hWnd=0x3015e) returned 1 [0058.983] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0058.983] TranslateMessage (lpMsg=0x26ee10) returned 0 [0058.983] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0058.984] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0058.984] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0058.984] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffca0109d2 [0058.984] GetObjectType (h=0x60109d6) returned 0x3 [0058.984] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffffa0509c0 [0058.984] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffffa0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.984] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffffa0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0058.984] DeleteObject (ho=0xfffffffffa0509c0) returned 1 [0058.984] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffbd0509d7 [0058.985] SelectObject (hdc=0xffffffffca0109d2, h=0xffffffffbd0509d7) returned 0x185000f [0058.985] GdipCreateFromHDC (hdc=0xffffffffca0109d2, graphics=0x26e408) returned 0x0 [0058.985] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0058.985] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0058.985] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0058.985] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0058.985] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0058.985] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.985] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0058.985] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.985] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0058.986] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0058.986] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0058.986] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0058.986] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0058.986] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.986] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.986] GetSystemMetrics (nIndex=42) returned 0 [0058.986] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.986] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.986] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0058.986] IsAppThemed () returned 0x1 [0058.986] GetThemeAppProperties () returned 0x3 [0058.986] GetThemeAppProperties () returned 0x3 [0058.986] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0058.986] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0058.986] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0058.987] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0058.987] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0058.987] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.987] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.987] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.987] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0058.987] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0058.987] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0058.987] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0058.987] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0058.987] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0058.987] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0058.987] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0058.987] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0058.987] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0058.987] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x1) returned 0x1b00017 [0058.987] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x2) returned 0x1900010 [0058.987] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x7) returned 0xffffffffbd0509d7 [0058.987] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x6) returned 0x18a002e [0058.987] SaveDC (hdc=0xffffffffca0109d2) returned 1 [0058.987] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1c0409f1 [0058.987] GetClipRgn (hdc=0xffffffffca0109d2, hrgn=0x1c0409f1) returned 0 [0058.987] SelectClipRgn (hdc=0xffffffffca0109d2, hrgn=0x430409ff) returned 2 [0058.987] DeleteObject (ho=0x1c0409f1) returned 1 [0058.987] DeleteObject (ho=0x430409ff) returned 1 [0058.987] OffsetViewportOrgEx (in: hdc=0xffffffffca0109d2, x=0, y=0, lppt=0x278ff60 | out: lppt=0x278ff60) returned 1 [0058.988] OffsetViewportOrgEx (in: hdc=0xffffffffca0109d2, x=-417, y=-278, lppt=0x278ff78 | out: lppt=0x278ff78) returned 1 [0058.988] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0058.988] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x1) returned 0x1b00017 [0058.988] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x2) returned 0x1900010 [0058.988] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x7) returned 0xffffffffbd0509d7 [0058.988] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x6) returned 0x18a002e [0058.988] SaveDC (hdc=0xffffffffca0109d2) returned 2 [0058.988] GetNearestColor (hdc=0xffffffffca0109d2, color=0x6c4607) returned 0x6c4607 [0058.988] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc6100276 [0058.988] FillRect (hDC=0xffffffffca0109d2, lprc=0x26de08, hbr=0xffffffffc6100276) returned 1 [0058.994] DeleteObject (ho=0xffffffffc6100276) returned 1 [0058.994] RestoreDC (hdc=0xffffffffca0109d2, nSavedDC=-1) returned 1 [0058.994] RestoreDC (hdc=0xffffffffca0109d2, nSavedDC=-1) returned 1 [0058.994] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffca0109d2) returned 0x0 [0058.994] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffcaa0dbd) returned 0x0 [0058.994] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0058.994] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0058.994] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0058.994] GetSystemMetrics (nIndex=42) returned 0 [0058.994] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0058.994] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0058.995] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x3b) returned 0x0 [0058.996] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0058.996] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0058.996] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0058.996] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0058.996] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0058.996] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0058.996] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x1) returned 0x1b00017 [0058.996] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x2) returned 0x1900010 [0058.996] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x7) returned 0xffffffffbd0509d7 [0058.996] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x6) returned 0x18a002e [0058.996] SaveDC (hdc=0xffffffffca0109d2) returned 1 [0058.996] GetNearestColor (hdc=0xffffffffca0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0058.997] RestoreDC (hdc=0xffffffffca0109d2, nSavedDC=-1) returned 1 [0058.997] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffca0109d2) returned 0x0 [0058.997] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0058.997] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0058.997] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0058.997] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x1) returned 0x1b00017 [0058.997] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x2) returned 0x1900010 [0058.997] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x7) returned 0xffffffffbd0509d7 [0058.997] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x6) returned 0x18a002e [0058.997] SaveDC (hdc=0xffffffffca0109d2) returned 1 [0058.997] GetTextAlign (hdc=0xffffffffca0109d2) returned 0x0 [0058.997] GetTextColor (hdc=0xffffffffca0109d2) returned 0x0 [0058.997] SetTextColor (hdc=0xffffffffca0109d2, color=0xf0f0f0) returned 0x0 [0058.997] GetCurrentObject (hdc=0xffffffffca0109d2, type=0x6) returned 0x18a002e [0058.998] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0058.998] SelectObject (hdc=0xffffffffca0109d2, h=0x260a09ba) returned 0x18a002e [0058.998] GetBkMode (hdc=0xffffffffca0109d2) returned 2 [0058.998] SetBkMode (hdc=0xffffffffca0109d2, mode=1) returned 2 [0058.998] DrawTextExW (in: hdc=0xffffffffca0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2790e38 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0058.998] DrawTextExW (in: hdc=0xffffffffca0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2790e38 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0058.999] RestoreDC (hdc=0xffffffffca0109d2, nSavedDC=-1) returned 1 [0058.999] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffca0109d2) returned 0x0 [0058.999] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0058.999] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffca0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0058.999] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffca0109d2) returned 0x0 [0058.999] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0058.999] SelectObject (hdc=0xffffffffca0109d2, h=0x185000f) returned 0xffffffffbd0509d7 [0058.999] DeleteDC (hdc=0xffffffffca0109d2) returned 1 [0058.999] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0058.999] DeleteObject (ho=0xffffffffbd0509d7) returned 1 [0059.002] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0059.002] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.002] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.002] WaitMessage () returned 1 [0059.131] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.131] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.131] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.132] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.132] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.132] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0059.132] GetCurrentThreadId () returned 0xa28 [0059.132] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0059.132] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.132] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.132] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.132] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.132] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.132] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0059.132] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0059.132] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffffc0109c0 [0059.132] GetObjectType (h=0x60109d6) returned 0x3 [0059.132] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffbe0509d7 [0059.133] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffbe0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.133] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffbe0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.133] DeleteObject (ho=0xffffffffbe0509d7) returned 1 [0059.133] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffcb0509d2 [0059.133] SelectObject (hdc=0xfffffffffc0109c0, h=0xffffffffcb0509d2) returned 0x185000f [0059.133] GdipCreateFromHDC (hdc=0xfffffffffc0109c0, graphics=0x26e408) returned 0x0 [0059.133] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0059.133] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0059.133] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0059.133] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0059.133] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0059.133] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.133] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0059.133] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.133] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0059.133] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0059.134] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0059.134] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0059.134] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0059.134] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.134] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.134] GetSystemMetrics (nIndex=42) returned 0 [0059.134] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.134] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.134] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0059.134] IsAppThemed () returned 0x1 [0059.134] GetThemeAppProperties () returned 0x3 [0059.134] GetThemeAppProperties () returned 0x3 [0059.134] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0059.134] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0059.134] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0059.134] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0059.134] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0059.134] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.134] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.134] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.134] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0059.134] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.134] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.134] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.134] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0059.134] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0059.135] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0059.135] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0059.135] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0059.135] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0059.135] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x1) returned 0x1b00017 [0059.135] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x2) returned 0x1900010 [0059.135] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x7) returned 0xffffffffcb0509d2 [0059.135] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x6) returned 0x18a002e [0059.135] SaveDC (hdc=0xfffffffffc0109c0) returned 1 [0059.135] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x440409ff [0059.135] GetClipRgn (hdc=0xfffffffffc0109c0, hrgn=0x440409ff) returned 0 [0059.135] SelectClipRgn (hdc=0xfffffffffc0109c0, hrgn=0x1f0409f1) returned 2 [0059.135] DeleteObject (ho=0x440409ff) returned 1 [0059.135] DeleteObject (ho=0x1f0409f1) returned 1 [0059.135] OffsetViewportOrgEx (in: hdc=0xfffffffffc0109c0, x=0, y=0, lppt=0x2688360 | out: lppt=0x2688360) returned 1 [0059.135] OffsetViewportOrgEx (in: hdc=0xfffffffffc0109c0, x=-417, y=-278, lppt=0x26883b8 | out: lppt=0x26883b8) returned 1 [0059.135] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0059.135] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x1) returned 0x1b00017 [0059.135] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x2) returned 0x1900010 [0059.135] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x7) returned 0xffffffffcb0509d2 [0059.135] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x6) returned 0x18a002e [0059.135] SaveDC (hdc=0xfffffffffc0109c0) returned 2 [0059.136] GetNearestColor (hdc=0xfffffffffc0109c0, color=0x6c4607) returned 0x6c4607 [0059.136] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc7100276 [0059.136] FillRect (hDC=0xfffffffffc0109c0, lprc=0x26de08, hbr=0xffffffffc7100276) returned 1 [0059.142] DeleteObject (ho=0xffffffffc7100276) returned 1 [0059.142] RestoreDC (hdc=0xfffffffffc0109c0, nSavedDC=-1) returned 1 [0059.142] RestoreDC (hdc=0xfffffffffc0109c0, nSavedDC=-1) returned 1 [0059.142] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffc0109c0) returned 0x0 [0059.142] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffca80dbd) returned 0x0 [0059.142] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0059.142] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.142] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.142] GetSystemMetrics (nIndex=42) returned 0 [0059.143] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.143] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.143] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0059.143] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0059.143] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0059.143] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0059.143] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0059.143] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0059.143] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x1) returned 0x1b00017 [0059.143] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x2) returned 0x1900010 [0059.143] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x7) returned 0xffffffffcb0509d2 [0059.143] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x6) returned 0x18a002e [0059.143] SaveDC (hdc=0xfffffffffc0109c0) returned 1 [0059.143] GetNearestColor (hdc=0xfffffffffc0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0059.143] RestoreDC (hdc=0xfffffffffc0109c0, nSavedDC=-1) returned 1 [0059.143] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffc0109c0) returned 0x0 [0059.144] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0059.144] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0059.144] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0059.144] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0059.144] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x1) returned 0x1b00017 [0059.144] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x2) returned 0x1900010 [0059.144] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x7) returned 0xffffffffcb0509d2 [0059.144] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x6) returned 0x18a002e [0059.144] SaveDC (hdc=0xfffffffffc0109c0) returned 1 [0059.144] GetTextAlign (hdc=0xfffffffffc0109c0) returned 0x0 [0059.144] GetTextColor (hdc=0xfffffffffc0109c0) returned 0x0 [0059.144] SetTextColor (hdc=0xfffffffffc0109c0, color=0xf0f0f0) returned 0x0 [0059.144] GetCurrentObject (hdc=0xfffffffffc0109c0, type=0x6) returned 0x18a002e [0059.144] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0059.144] SelectObject (hdc=0xfffffffffc0109c0, h=0x260a09ba) returned 0x18a002e [0059.144] GetBkMode (hdc=0xfffffffffc0109c0) returned 2 [0059.144] SetBkMode (hdc=0xfffffffffc0109c0, mode=1) returned 2 [0059.144] DrawTextExW (in: hdc=0xfffffffffc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x268c228 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0059.145] DrawTextExW (in: hdc=0xfffffffffc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x268c228 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0059.145] RestoreDC (hdc=0xfffffffffc0109c0, nSavedDC=-1) returned 1 [0059.145] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffc0109c0) returned 0x0 [0059.145] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0059.145] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffffc0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0059.145] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffc0109c0) returned 0x0 [0059.145] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0059.145] SelectObject (hdc=0xfffffffffc0109c0, h=0x185000f) returned 0xffffffffcb0509d2 [0059.146] DeleteDC (hdc=0xfffffffffc0109c0) returned 1 [0059.146] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0059.146] DeleteObject (ho=0xffffffffcb0509d2) returned 1 [0059.149] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0059.149] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.149] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.149] WaitMessage () returned 1 [0059.278] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.278] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.278] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.278] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.278] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.278] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0059.278] GetCurrentThreadId () returned 0xa28 [0059.278] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0059.278] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.278] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.278] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.278] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.278] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.279] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0059.279] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0059.279] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffc00109d7 [0059.279] GetObjectType (h=0x60109d6) returned 0x3 [0059.279] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffcc0509d2 [0059.279] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffcc0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.279] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffcc0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.279] DeleteObject (ho=0xffffffffcc0509d2) returned 1 [0059.279] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffffd0509c0 [0059.279] SelectObject (hdc=0xffffffffc00109d7, h=0xfffffffffd0509c0) returned 0x185000f [0059.279] GdipCreateFromHDC (hdc=0xffffffffc00109d7, graphics=0x26e408) returned 0x0 [0059.279] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0059.279] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0059.279] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0059.279] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0059.279] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0059.280] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.280] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0059.280] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.280] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0059.280] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0059.280] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0059.280] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0059.280] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0059.280] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.280] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.280] GetSystemMetrics (nIndex=42) returned 0 [0059.280] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.280] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.280] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0059.280] IsAppThemed () returned 0x1 [0059.280] GetThemeAppProperties () returned 0x3 [0059.280] GetThemeAppProperties () returned 0x3 [0059.280] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0059.280] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0059.280] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0059.280] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0059.280] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0059.280] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.280] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.280] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.280] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0059.280] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.280] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.281] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.281] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0059.281] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0059.281] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0059.281] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0059.281] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0059.281] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0059.281] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x1) returned 0x1b00017 [0059.281] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x2) returned 0x1900010 [0059.281] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x7) returned 0xfffffffffd0509c0 [0059.281] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x6) returned 0x18a002e [0059.281] SaveDC (hdc=0xffffffffc00109d7) returned 1 [0059.281] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x200409f1 [0059.281] GetClipRgn (hdc=0xffffffffc00109d7, hrgn=0x200409f1) returned 0 [0059.281] SelectClipRgn (hdc=0xffffffffc00109d7, hrgn=0x470409ff) returned 2 [0059.281] DeleteObject (ho=0x200409f1) returned 1 [0059.281] DeleteObject (ho=0x470409ff) returned 1 [0059.281] OffsetViewportOrgEx (in: hdc=0xffffffffc00109d7, x=0, y=0, lppt=0x28397f0 | out: lppt=0x28397f0) returned 1 [0059.281] OffsetViewportOrgEx (in: hdc=0xffffffffc00109d7, x=-417, y=-278, lppt=0x2839808 | out: lppt=0x2839808) returned 1 [0059.281] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0059.281] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x1) returned 0x1b00017 [0059.281] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x2) returned 0x1900010 [0059.281] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x7) returned 0xfffffffffd0509c0 [0059.281] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x6) returned 0x18a002e [0059.281] SaveDC (hdc=0xffffffffc00109d7) returned 2 [0059.281] GetNearestColor (hdc=0xffffffffc00109d7, color=0x6c4607) returned 0x6c4607 [0059.282] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc8100276 [0059.282] FillRect (hDC=0xffffffffc00109d7, lprc=0x26de08, hbr=0xffffffffc8100276) returned 1 [0059.288] DeleteObject (ho=0xffffffffc8100276) returned 1 [0059.288] RestoreDC (hdc=0xffffffffc00109d7, nSavedDC=-1) returned 1 [0059.288] RestoreDC (hdc=0xffffffffc00109d7, nSavedDC=-1) returned 1 [0059.288] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc00109d7) returned 0x0 [0059.288] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffca60dbd) returned 0x0 [0059.288] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0059.288] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.288] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.288] GetSystemMetrics (nIndex=42) returned 0 [0059.288] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.288] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.288] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x3d) returned 0x0 [0059.289] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0059.289] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0059.289] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0059.289] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0059.289] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0059.289] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0059.289] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x1) returned 0x1b00017 [0059.289] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x2) returned 0x1900010 [0059.289] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x7) returned 0xfffffffffd0509c0 [0059.289] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x6) returned 0x18a002e [0059.289] SaveDC (hdc=0xffffffffc00109d7) returned 1 [0059.289] GetNearestColor (hdc=0xffffffffc00109d7, color=0xf0f0f0) returned 0xf0f0f0 [0059.289] RestoreDC (hdc=0xffffffffc00109d7, nSavedDC=-1) returned 1 [0059.289] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc00109d7) returned 0x0 [0059.290] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0059.290] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0059.290] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0059.290] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x1) returned 0x1b00017 [0059.290] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x2) returned 0x1900010 [0059.290] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x7) returned 0xfffffffffd0509c0 [0059.290] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x6) returned 0x18a002e [0059.290] SaveDC (hdc=0xffffffffc00109d7) returned 1 [0059.290] GetTextAlign (hdc=0xffffffffc00109d7) returned 0x0 [0059.290] GetTextColor (hdc=0xffffffffc00109d7) returned 0x0 [0059.290] SetTextColor (hdc=0xffffffffc00109d7, color=0xf0f0f0) returned 0x0 [0059.290] GetCurrentObject (hdc=0xffffffffc00109d7, type=0x6) returned 0x18a002e [0059.290] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0059.290] SelectObject (hdc=0xffffffffc00109d7, h=0x260a09ba) returned 0x18a002e [0059.290] GetBkMode (hdc=0xffffffffc00109d7) returned 2 [0059.290] SetBkMode (hdc=0xffffffffc00109d7, mode=1) returned 2 [0059.290] DrawTextExW (in: hdc=0xffffffffc00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x283a6c0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0059.291] DrawTextExW (in: hdc=0xffffffffc00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x283a6c0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0059.291] RestoreDC (hdc=0xffffffffc00109d7, nSavedDC=-1) returned 1 [0059.291] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc00109d7) returned 0x0 [0059.291] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0059.291] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffc00109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0059.291] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc00109d7) returned 0x0 [0059.291] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0059.291] SelectObject (hdc=0xffffffffc00109d7, h=0x185000f) returned 0xfffffffffd0509c0 [0059.291] DeleteDC (hdc=0xffffffffc00109d7) returned 1 [0059.292] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0059.292] DeleteObject (ho=0xfffffffffd0509c0) returned 1 [0059.295] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0059.295] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.295] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.295] WaitMessage () returned 1 [0059.404] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.404] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.404] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.404] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.404] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.404] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0059.404] GetCurrentThreadId () returned 0xa28 [0059.404] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0059.404] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.404] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.404] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.404] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.405] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.405] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0059.405] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0059.405] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffce0109d2 [0059.405] GetObjectType (h=0x60109d6) returned 0x3 [0059.405] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffffe0509c0 [0059.405] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffffe0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.405] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffffe0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.405] DeleteObject (ho=0xfffffffffe0509c0) returned 1 [0059.405] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffc10509d7 [0059.405] SelectObject (hdc=0xffffffffce0109d2, h=0xffffffffc10509d7) returned 0x185000f [0059.405] GdipCreateFromHDC (hdc=0xffffffffce0109d2, graphics=0x26e408) returned 0x0 [0059.406] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0059.406] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0059.406] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0059.406] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0059.406] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0059.406] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.406] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0059.406] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.406] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0059.406] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0059.406] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0059.406] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0059.406] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0059.406] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.406] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.406] GetSystemMetrics (nIndex=42) returned 0 [0059.406] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.406] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.406] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0059.406] IsAppThemed () returned 0x1 [0059.406] GetThemeAppProperties () returned 0x3 [0059.406] GetThemeAppProperties () returned 0x3 [0059.406] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0059.406] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0059.406] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0059.407] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0059.407] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0059.407] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.407] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.407] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.407] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0059.407] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.407] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.407] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.407] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0059.407] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0059.407] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0059.407] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0059.407] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0059.407] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0059.407] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x1) returned 0x1b00017 [0059.407] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x2) returned 0x1900010 [0059.407] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x7) returned 0xffffffffc10509d7 [0059.407] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x6) returned 0x18a002e [0059.407] SaveDC (hdc=0xffffffffce0109d2) returned 1 [0059.407] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x480409ff [0059.407] GetClipRgn (hdc=0xffffffffce0109d2, hrgn=0x480409ff) returned 0 [0059.407] SelectClipRgn (hdc=0xffffffffce0109d2, hrgn=0x230409f1) returned 2 [0059.407] DeleteObject (ho=0x480409ff) returned 1 [0059.407] DeleteObject (ho=0x230409f1) returned 1 [0059.408] OffsetViewportOrgEx (in: hdc=0xffffffffce0109d2, x=0, y=0, lppt=0x269b620 | out: lppt=0x269b620) returned 1 [0059.408] OffsetViewportOrgEx (in: hdc=0xffffffffce0109d2, x=-417, y=-278, lppt=0x269b638 | out: lppt=0x269b638) returned 1 [0059.408] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0059.408] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x1) returned 0x1b00017 [0059.408] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x2) returned 0x1900010 [0059.408] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x7) returned 0xffffffffc10509d7 [0059.408] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x6) returned 0x18a002e [0059.408] SaveDC (hdc=0xffffffffce0109d2) returned 2 [0059.408] GetNearestColor (hdc=0xffffffffce0109d2, color=0x6c4607) returned 0x6c4607 [0059.408] CreateSolidBrush (color=0x6c4607) returned 0xffffffffc9100276 [0059.408] FillRect (hDC=0xffffffffce0109d2, lprc=0x26de08, hbr=0xffffffffc9100276) returned 1 [0059.414] DeleteObject (ho=0xffffffffc9100276) returned 1 [0059.414] RestoreDC (hdc=0xffffffffce0109d2, nSavedDC=-1) returned 1 [0059.414] RestoreDC (hdc=0xffffffffce0109d2, nSavedDC=-1) returned 1 [0059.414] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffce0109d2) returned 0x0 [0059.414] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffca40dbd) returned 0x0 [0059.414] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0059.414] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.415] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.415] GetSystemMetrics (nIndex=42) returned 0 [0059.415] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.415] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.415] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0059.415] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0059.415] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0059.415] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0059.415] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0059.415] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0059.415] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x1) returned 0x1b00017 [0059.415] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x2) returned 0x1900010 [0059.415] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x7) returned 0xffffffffc10509d7 [0059.415] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x6) returned 0x18a002e [0059.415] SaveDC (hdc=0xffffffffce0109d2) returned 1 [0059.415] GetNearestColor (hdc=0xffffffffce0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0059.415] RestoreDC (hdc=0xffffffffce0109d2, nSavedDC=-1) returned 1 [0059.415] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffce0109d2) returned 0x0 [0059.416] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0059.416] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0059.416] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0059.416] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0059.416] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x1) returned 0x1b00017 [0059.416] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x2) returned 0x1900010 [0059.416] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x7) returned 0xffffffffc10509d7 [0059.416] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x6) returned 0x18a002e [0059.416] SaveDC (hdc=0xffffffffce0109d2) returned 1 [0059.416] GetTextAlign (hdc=0xffffffffce0109d2) returned 0x0 [0059.416] GetTextColor (hdc=0xffffffffce0109d2) returned 0x0 [0059.416] SetTextColor (hdc=0xffffffffce0109d2, color=0xf0f0f0) returned 0x0 [0059.416] GetCurrentObject (hdc=0xffffffffce0109d2, type=0x6) returned 0x18a002e [0059.416] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0059.416] SelectObject (hdc=0xffffffffce0109d2, h=0x260a09ba) returned 0x18a002e [0059.416] GetBkMode (hdc=0xffffffffce0109d2) returned 2 [0059.416] SetBkMode (hdc=0xffffffffce0109d2, mode=1) returned 2 [0059.416] DrawTextExW (in: hdc=0xffffffffce0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x269c2e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0059.416] DrawTextExW (in: hdc=0xffffffffce0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x269c2e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0059.417] RestoreDC (hdc=0xffffffffce0109d2, nSavedDC=-1) returned 1 [0059.417] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffce0109d2) returned 0x0 [0059.417] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0059.417] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffce0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0059.417] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffce0109d2) returned 0x0 [0059.417] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0059.417] SelectObject (hdc=0xffffffffce0109d2, h=0x185000f) returned 0xffffffffc10509d7 [0059.417] DeleteDC (hdc=0xffffffffce0109d2) returned 1 [0059.417] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0059.417] DeleteObject (ho=0xffffffffc10509d7) returned 1 [0059.421] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0059.421] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.421] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.421] WaitMessage () returned 1 [0059.596] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.596] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.596] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.596] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.596] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.596] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0059.596] GetCurrentThreadId () returned 0xa28 [0059.596] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0059.596] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.596] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.596] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.596] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.596] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.596] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0059.597] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0059.597] CreateCompatibleDC (hdc=0x60109d6) returned 0x109c0 [0059.597] GetObjectType (h=0x60109d6) returned 0x3 [0059.597] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffc20509d7 [0059.597] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc20509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.597] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc20509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.597] DeleteObject (ho=0xffffffffc20509d7) returned 1 [0059.597] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffcf0509d2 [0059.597] SelectObject (hdc=0x109c0, h=0xffffffffcf0509d2) returned 0x185000f [0059.597] GdipCreateFromHDC (hdc=0x109c0, graphics=0x26e408) returned 0x0 [0059.597] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0059.598] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0059.598] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0059.598] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0059.598] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0059.598] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.598] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0059.598] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.598] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0059.598] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0059.598] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0059.598] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0059.598] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0059.598] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.598] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.598] GetSystemMetrics (nIndex=42) returned 0 [0059.598] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.598] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.598] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0059.598] IsAppThemed () returned 0x1 [0059.598] GetThemeAppProperties () returned 0x3 [0059.598] GetThemeAppProperties () returned 0x3 [0059.598] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0059.598] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0059.598] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0059.598] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0059.598] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0059.598] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.598] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.599] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.599] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0059.599] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.599] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.599] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.599] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0059.599] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0059.599] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0059.599] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0059.599] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0059.599] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0059.599] GetCurrentObject (hdc=0x109c0, type=0x1) returned 0x1b00017 [0059.599] GetCurrentObject (hdc=0x109c0, type=0x2) returned 0x1900010 [0059.599] GetCurrentObject (hdc=0x109c0, type=0x7) returned 0xffffffffcf0509d2 [0059.599] GetCurrentObject (hdc=0x109c0, type=0x6) returned 0x18a002e [0059.599] SaveDC (hdc=0x109c0) returned 1 [0059.599] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x240409f1 [0059.599] GetClipRgn (hdc=0x109c0, hrgn=0x240409f1) returned 0 [0059.599] SelectClipRgn (hdc=0x109c0, hrgn=0x4b0409ff) returned 2 [0059.599] DeleteObject (ho=0x240409f1) returned 1 [0059.599] DeleteObject (ho=0x4b0409ff) returned 1 [0059.599] OffsetViewportOrgEx (in: hdc=0x109c0, x=0, y=0, lppt=0x26a8630 | out: lppt=0x26a8630) returned 1 [0059.599] OffsetViewportOrgEx (in: hdc=0x109c0, x=-417, y=-278, lppt=0x26a8648 | out: lppt=0x26a8648) returned 1 [0059.599] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0059.599] GetCurrentObject (hdc=0x109c0, type=0x1) returned 0x1b00017 [0059.599] GetCurrentObject (hdc=0x109c0, type=0x2) returned 0x1900010 [0059.600] GetCurrentObject (hdc=0x109c0, type=0x7) returned 0xffffffffcf0509d2 [0059.600] GetCurrentObject (hdc=0x109c0, type=0x6) returned 0x18a002e [0059.600] SaveDC (hdc=0x109c0) returned 2 [0059.600] GetNearestColor (hdc=0x109c0, color=0x6c4607) returned 0x6c4607 [0059.600] CreateSolidBrush (color=0x6c4607) returned 0xffffffffca100276 [0059.600] FillRect (hDC=0x109c0, lprc=0x26de08, hbr=0xffffffffca100276) returned 1 [0059.606] DeleteObject (ho=0xffffffffca100276) returned 1 [0059.606] RestoreDC (hdc=0x109c0, nSavedDC=-1) returned 1 [0059.606] RestoreDC (hdc=0x109c0, nSavedDC=-1) returned 1 [0059.606] GdipReleaseDC (graphics=0x1b86d040, hdc=0x109c0) returned 0x0 [0059.606] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffca20dbd) returned 0x0 [0059.606] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0059.606] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.606] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.606] GetSystemMetrics (nIndex=42) returned 0 [0059.606] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.606] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.607] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x3f) returned 0x0 [0059.607] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0059.607] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0059.607] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0059.607] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0059.607] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0059.607] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0059.607] GetCurrentObject (hdc=0x109c0, type=0x1) returned 0x1b00017 [0059.608] GetCurrentObject (hdc=0x109c0, type=0x2) returned 0x1900010 [0059.608] GetCurrentObject (hdc=0x109c0, type=0x7) returned 0xffffffffcf0509d2 [0059.608] GetCurrentObject (hdc=0x109c0, type=0x6) returned 0x18a002e [0059.608] SaveDC (hdc=0x109c0) returned 1 [0059.608] GetNearestColor (hdc=0x109c0, color=0xf0f0f0) returned 0xf0f0f0 [0059.608] RestoreDC (hdc=0x109c0, nSavedDC=-1) returned 1 [0059.608] GdipReleaseDC (graphics=0x1b86d040, hdc=0x109c0) returned 0x0 [0059.608] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0059.608] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0059.608] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0059.608] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0059.608] GetCurrentObject (hdc=0x109c0, type=0x1) returned 0x1b00017 [0059.608] GetCurrentObject (hdc=0x109c0, type=0x2) returned 0x1900010 [0059.608] GetCurrentObject (hdc=0x109c0, type=0x7) returned 0xffffffffcf0509d2 [0059.608] GetCurrentObject (hdc=0x109c0, type=0x6) returned 0x18a002e [0059.608] SaveDC (hdc=0x109c0) returned 1 [0059.608] GetTextAlign (hdc=0x109c0) returned 0x0 [0059.608] GetTextColor (hdc=0x109c0) returned 0x0 [0059.609] SetTextColor (hdc=0x109c0, color=0xf0f0f0) returned 0x0 [0059.609] GetCurrentObject (hdc=0x109c0, type=0x6) returned 0x18a002e [0059.609] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0059.609] SelectObject (hdc=0x109c0, h=0x260a09ba) returned 0x18a002e [0059.609] GetBkMode (hdc=0x109c0) returned 2 [0059.609] SetBkMode (hdc=0x109c0, mode=1) returned 2 [0059.609] DrawTextExW (in: hdc=0x109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a94e0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0059.609] DrawTextExW (in: hdc=0x109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a94e0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0059.609] RestoreDC (hdc=0x109c0, nSavedDC=-1) returned 1 [0059.609] GdipReleaseDC (graphics=0x1b86d040, hdc=0x109c0) returned 0x0 [0059.610] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0059.610] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0059.610] GdipReleaseDC (graphics=0x1b86d040, hdc=0x109c0) returned 0x0 [0059.610] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0059.610] SelectObject (hdc=0x109c0, h=0x185000f) returned 0xffffffffcf0509d2 [0059.610] DeleteDC (hdc=0x109c0) returned 1 [0059.610] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0059.610] DeleteObject (ho=0xffffffffcf0509d2) returned 1 [0059.613] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0059.613] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.613] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.613] WaitMessage () returned 1 [0059.746] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.746] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.746] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.746] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.746] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.746] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0059.746] GetCurrentThreadId () returned 0xa28 [0059.746] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0059.746] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.746] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.746] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.746] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.746] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.747] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0059.747] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0059.747] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffc40109d7 [0059.747] GetObjectType (h=0x60109d6) returned 0x3 [0059.747] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffd00509d2 [0059.747] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd00509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.747] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd00509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.747] DeleteObject (ho=0xffffffffd00509d2) returned 1 [0059.747] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x10509c0 [0059.747] SelectObject (hdc=0xffffffffc40109d7, h=0x10509c0) returned 0x185000f [0059.747] GdipCreateFromHDC (hdc=0xffffffffc40109d7, graphics=0x26e408) returned 0x0 [0059.747] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0059.747] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0059.748] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0059.748] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0059.748] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0059.748] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.748] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0059.748] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.748] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0059.748] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0059.748] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0059.748] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0059.748] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0059.748] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.748] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.748] GetSystemMetrics (nIndex=42) returned 0 [0059.748] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.748] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.748] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0059.748] IsAppThemed () returned 0x1 [0059.748] GetThemeAppProperties () returned 0x3 [0059.748] GetThemeAppProperties () returned 0x3 [0059.748] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0059.748] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0059.748] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0059.748] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0059.748] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0059.748] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.748] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.748] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.748] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0059.749] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.749] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.749] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.749] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0059.749] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0059.749] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0059.749] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0059.749] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0059.749] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0059.749] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x1) returned 0x1b00017 [0059.749] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x2) returned 0x1900010 [0059.749] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x7) returned 0x10509c0 [0059.749] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x6) returned 0x18a002e [0059.749] SaveDC (hdc=0xffffffffc40109d7) returned 1 [0059.749] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4c0409ff [0059.749] GetClipRgn (hdc=0xffffffffc40109d7, hrgn=0x4c0409ff) returned 0 [0059.749] SelectClipRgn (hdc=0xffffffffc40109d7, hrgn=0x270409f1) returned 2 [0059.749] DeleteObject (ho=0x4c0409ff) returned 1 [0059.749] DeleteObject (ho=0x270409f1) returned 1 [0059.749] OffsetViewportOrgEx (in: hdc=0xffffffffc40109d7, x=0, y=0, lppt=0x2707080 | out: lppt=0x2707080) returned 1 [0059.749] OffsetViewportOrgEx (in: hdc=0xffffffffc40109d7, x=-417, y=-278, lppt=0x2707098 | out: lppt=0x2707098) returned 1 [0059.749] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0059.749] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x1) returned 0x1b00017 [0059.749] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x2) returned 0x1900010 [0059.749] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x7) returned 0x10509c0 [0059.749] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x6) returned 0x18a002e [0059.749] SaveDC (hdc=0xffffffffc40109d7) returned 2 [0059.750] GetNearestColor (hdc=0xffffffffc40109d7, color=0x6c4607) returned 0x6c4607 [0059.750] CreateSolidBrush (color=0x6c4607) returned 0xffffffffcb100276 [0059.750] FillRect (hDC=0xffffffffc40109d7, lprc=0x26de08, hbr=0xffffffffcb100276) returned 1 [0059.756] DeleteObject (ho=0xffffffffcb100276) returned 1 [0059.756] RestoreDC (hdc=0xffffffffc40109d7, nSavedDC=-1) returned 1 [0059.756] RestoreDC (hdc=0xffffffffc40109d7, nSavedDC=-1) returned 1 [0059.756] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc40109d7) returned 0x0 [0059.756] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffca00dbd) returned 0x0 [0059.756] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0059.756] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.756] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.756] GetSystemMetrics (nIndex=42) returned 0 [0059.756] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.756] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.757] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0059.757] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0059.757] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0059.757] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0059.757] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0059.757] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0059.757] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x1) returned 0x1b00017 [0059.757] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x2) returned 0x1900010 [0059.757] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x7) returned 0x10509c0 [0059.757] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x6) returned 0x18a002e [0059.757] SaveDC (hdc=0xffffffffc40109d7) returned 1 [0059.757] GetNearestColor (hdc=0xffffffffc40109d7, color=0xf0f0f0) returned 0xf0f0f0 [0059.757] RestoreDC (hdc=0xffffffffc40109d7, nSavedDC=-1) returned 1 [0059.757] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc40109d7) returned 0x0 [0059.757] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0059.757] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0059.757] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0059.757] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x1) returned 0x1b00017 [0059.757] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x2) returned 0x1900010 [0059.757] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x7) returned 0x10509c0 [0059.757] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x6) returned 0x18a002e [0059.758] SaveDC (hdc=0xffffffffc40109d7) returned 1 [0059.758] GetTextAlign (hdc=0xffffffffc40109d7) returned 0x0 [0059.758] GetTextColor (hdc=0xffffffffc40109d7) returned 0x0 [0059.758] SetTextColor (hdc=0xffffffffc40109d7, color=0xf0f0f0) returned 0x0 [0059.758] GetCurrentObject (hdc=0xffffffffc40109d7, type=0x6) returned 0x18a002e [0059.758] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0059.758] SelectObject (hdc=0xffffffffc40109d7, h=0x260a09ba) returned 0x18a002e [0059.758] GetBkMode (hdc=0xffffffffc40109d7) returned 2 [0059.758] SetBkMode (hdc=0xffffffffc40109d7, mode=1) returned 2 [0059.758] DrawTextExW (in: hdc=0xffffffffc40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2707d48 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0059.758] DrawTextExW (in: hdc=0xffffffffc40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2707d48 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0059.759] RestoreDC (hdc=0xffffffffc40109d7, nSavedDC=-1) returned 1 [0059.759] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc40109d7) returned 0x0 [0059.759] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0059.759] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffc40109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0059.759] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc40109d7) returned 0x0 [0059.759] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0059.759] SelectObject (hdc=0xffffffffc40109d7, h=0x185000f) returned 0x10509c0 [0059.759] DeleteDC (hdc=0xffffffffc40109d7) returned 1 [0059.759] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0059.759] DeleteObject (ho=0x10509c0) returned 1 [0059.763] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0059.763] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.763] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.763] WaitMessage () returned 1 [0059.926] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.949] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.949] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.949] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.949] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.949] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0059.949] GetCurrentThreadId () returned 0xa28 [0059.949] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0059.949] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.949] IsWindowUnicode (hWnd=0x3015e) returned 1 [0059.949] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0059.949] TranslateMessage (lpMsg=0x26ee10) returned 0 [0059.949] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0059.949] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0059.949] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0059.950] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffd20109d2 [0059.950] GetObjectType (h=0x60109d6) returned 0x3 [0059.950] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x20509c0 [0059.950] GetDIBits (in: hdc=0x60109d6, hbm=0x20509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.950] GetDIBits (in: hdc=0x60109d6, hbm=0x20509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0059.950] DeleteObject (ho=0x20509c0) returned 1 [0059.950] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffc50509d7 [0059.950] SelectObject (hdc=0xffffffffd20109d2, h=0xffffffffc50509d7) returned 0x185000f [0059.950] GdipCreateFromHDC (hdc=0xffffffffd20109d2, graphics=0x26e408) returned 0x0 [0059.950] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0059.950] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0059.950] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0059.950] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0059.950] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0059.950] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.950] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0059.951] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.951] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0059.951] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0059.951] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0059.951] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0059.951] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0059.951] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.951] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.951] GetSystemMetrics (nIndex=42) returned 0 [0059.951] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.951] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.951] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0059.951] IsAppThemed () returned 0x1 [0059.951] GetThemeAppProperties () returned 0x3 [0059.951] GetThemeAppProperties () returned 0x3 [0059.951] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0059.951] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0059.951] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0059.951] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0059.951] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0059.951] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.951] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.951] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.951] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0059.951] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0059.951] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0059.951] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0059.951] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0059.952] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0059.952] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0059.952] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0059.952] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0059.952] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0059.952] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x1) returned 0x1b00017 [0059.952] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x2) returned 0x1900010 [0059.952] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x7) returned 0xffffffffc50509d7 [0059.952] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x6) returned 0x18a002e [0059.952] SaveDC (hdc=0xffffffffd20109d2) returned 1 [0059.952] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x280409f1 [0059.952] GetClipRgn (hdc=0xffffffffd20109d2, hrgn=0x280409f1) returned 0 [0059.952] SelectClipRgn (hdc=0xffffffffd20109d2, hrgn=0x4f0409ff) returned 2 [0059.952] DeleteObject (ho=0x280409f1) returned 1 [0059.952] DeleteObject (ho=0x4f0409ff) returned 1 [0059.952] OffsetViewportOrgEx (in: hdc=0xffffffffd20109d2, x=0, y=0, lppt=0x26aac28 | out: lppt=0x26aac28) returned 1 [0059.952] OffsetViewportOrgEx (in: hdc=0xffffffffd20109d2, x=-417, y=-278, lppt=0x26aac40 | out: lppt=0x26aac40) returned 1 [0059.952] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0059.952] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x1) returned 0x1b00017 [0059.952] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x2) returned 0x1900010 [0059.952] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x7) returned 0xffffffffc50509d7 [0059.952] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x6) returned 0x18a002e [0059.952] SaveDC (hdc=0xffffffffd20109d2) returned 2 [0059.952] GetNearestColor (hdc=0xffffffffd20109d2, color=0x6c4607) returned 0x6c4607 [0059.952] CreateSolidBrush (color=0x6c4607) returned 0xffffffffcc100276 [0059.953] FillRect (hDC=0xffffffffd20109d2, lprc=0x26de08, hbr=0xffffffffcc100276) returned 1 [0059.959] DeleteObject (ho=0xffffffffcc100276) returned 1 [0059.959] RestoreDC (hdc=0xffffffffd20109d2, nSavedDC=-1) returned 1 [0059.959] RestoreDC (hdc=0xffffffffd20109d2, nSavedDC=-1) returned 1 [0059.959] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd20109d2) returned 0x0 [0059.959] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc9e0dbd) returned 0x0 [0059.959] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0059.959] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0059.959] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0059.959] GetSystemMetrics (nIndex=42) returned 0 [0059.959] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0059.959] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0059.959] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x41) returned 0x0 [0059.960] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0059.960] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0059.960] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0059.960] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0059.960] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0059.960] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0059.960] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x1) returned 0x1b00017 [0059.960] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x2) returned 0x1900010 [0059.960] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x7) returned 0xffffffffc50509d7 [0059.960] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x6) returned 0x18a002e [0059.960] SaveDC (hdc=0xffffffffd20109d2) returned 1 [0059.960] GetNearestColor (hdc=0xffffffffd20109d2, color=0xf0f0f0) returned 0xf0f0f0 [0059.960] RestoreDC (hdc=0xffffffffd20109d2, nSavedDC=-1) returned 1 [0059.960] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd20109d2) returned 0x0 [0059.961] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0059.961] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0059.961] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0059.961] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0059.961] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x1) returned 0x1b00017 [0059.961] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x2) returned 0x1900010 [0059.961] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x7) returned 0xffffffffc50509d7 [0059.961] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x6) returned 0x18a002e [0059.961] SaveDC (hdc=0xffffffffd20109d2) returned 1 [0059.961] GetTextAlign (hdc=0xffffffffd20109d2) returned 0x0 [0059.961] GetTextColor (hdc=0xffffffffd20109d2) returned 0x0 [0059.961] SetTextColor (hdc=0xffffffffd20109d2, color=0xf0f0f0) returned 0x0 [0059.961] GetCurrentObject (hdc=0xffffffffd20109d2, type=0x6) returned 0x18a002e [0059.961] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0059.961] SelectObject (hdc=0xffffffffd20109d2, h=0x260a09ba) returned 0x18a002e [0059.961] GetBkMode (hdc=0xffffffffd20109d2) returned 2 [0059.961] SetBkMode (hdc=0xffffffffd20109d2, mode=1) returned 2 [0059.961] DrawTextExW (in: hdc=0xffffffffd20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26abac8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0059.962] DrawTextExW (in: hdc=0xffffffffd20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26abac8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0059.962] RestoreDC (hdc=0xffffffffd20109d2, nSavedDC=-1) returned 1 [0059.962] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd20109d2) returned 0x0 [0059.962] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0059.962] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffd20109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0059.962] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd20109d2) returned 0x0 [0059.962] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0059.962] SelectObject (hdc=0xffffffffd20109d2, h=0x185000f) returned 0xffffffffc50509d7 [0059.962] DeleteDC (hdc=0xffffffffd20109d2) returned 1 [0059.963] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0059.963] DeleteObject (ho=0xffffffffc50509d7) returned 1 [0059.966] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0059.966] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.966] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0059.966] WaitMessage () returned 1 [0060.214] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.214] IsWindowUnicode (hWnd=0x3015e) returned 1 [0060.214] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.214] TranslateMessage (lpMsg=0x26ee10) returned 0 [0060.214] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0060.214] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0060.214] GetCurrentThreadId () returned 0xa28 [0060.214] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0060.214] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.215] IsWindowUnicode (hWnd=0x3015e) returned 1 [0060.215] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.215] TranslateMessage (lpMsg=0x26ee10) returned 0 [0060.215] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0060.215] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0060.215] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0060.215] CreateCompatibleDC (hdc=0x60109d6) returned 0x40109c0 [0060.215] GetObjectType (h=0x60109d6) returned 0x3 [0060.215] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffc60509d7 [0060.215] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc60509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0060.215] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffc60509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0060.215] DeleteObject (ho=0xffffffffc60509d7) returned 1 [0060.215] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffd30509d2 [0060.215] SelectObject (hdc=0x40109c0, h=0xffffffffd30509d2) returned 0x185000f [0060.215] GdipCreateFromHDC (hdc=0x40109c0, graphics=0x26e408) returned 0x0 [0060.216] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0060.216] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0060.216] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0060.216] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0060.216] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0060.216] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.216] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0060.216] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.216] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0060.216] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0060.216] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0060.216] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0060.216] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0060.216] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0060.216] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0060.216] GetSystemMetrics (nIndex=42) returned 0 [0060.216] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0060.216] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0060.216] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0060.216] IsAppThemed () returned 0x1 [0060.216] GetThemeAppProperties () returned 0x3 [0060.216] GetThemeAppProperties () returned 0x3 [0060.216] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0060.216] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0060.217] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0060.217] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0060.217] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0060.217] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.217] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0060.217] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.217] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0060.217] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.217] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0060.217] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.217] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0060.217] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0060.217] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0060.217] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0060.217] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0060.217] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0060.217] GetCurrentObject (hdc=0x40109c0, type=0x1) returned 0x1b00017 [0060.217] GetCurrentObject (hdc=0x40109c0, type=0x2) returned 0x1900010 [0060.217] GetCurrentObject (hdc=0x40109c0, type=0x7) returned 0xffffffffd30509d2 [0060.217] GetCurrentObject (hdc=0x40109c0, type=0x6) returned 0x18a002e [0060.217] SaveDC (hdc=0x40109c0) returned 1 [0060.217] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x500409ff [0060.217] GetClipRgn (hdc=0x40109c0, hrgn=0x500409ff) returned 0 [0060.217] SelectClipRgn (hdc=0x40109c0, hrgn=0x2b0409f1) returned 2 [0060.217] DeleteObject (ho=0x500409ff) returned 1 [0060.217] DeleteObject (ho=0x2b0409f1) returned 1 [0060.217] OffsetViewportOrgEx (in: hdc=0x40109c0, x=0, y=0, lppt=0x26ae168 | out: lppt=0x26ae168) returned 1 [0060.218] OffsetViewportOrgEx (in: hdc=0x40109c0, x=-417, y=-278, lppt=0x26ae180 | out: lppt=0x26ae180) returned 1 [0060.218] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0060.218] GetCurrentObject (hdc=0x40109c0, type=0x1) returned 0x1b00017 [0060.218] GetCurrentObject (hdc=0x40109c0, type=0x2) returned 0x1900010 [0060.218] GetCurrentObject (hdc=0x40109c0, type=0x7) returned 0xffffffffd30509d2 [0060.218] GetCurrentObject (hdc=0x40109c0, type=0x6) returned 0x18a002e [0060.218] SaveDC (hdc=0x40109c0) returned 2 [0060.218] GetNearestColor (hdc=0x40109c0, color=0x6c4607) returned 0x6c4607 [0060.218] CreateSolidBrush (color=0x6c4607) returned 0xffffffffcd100276 [0060.218] FillRect (hDC=0x40109c0, lprc=0x26de08, hbr=0xffffffffcd100276) returned 1 [0060.224] DeleteObject (ho=0xffffffffcd100276) returned 1 [0060.224] RestoreDC (hdc=0x40109c0, nSavedDC=-1) returned 1 [0060.224] RestoreDC (hdc=0x40109c0, nSavedDC=-1) returned 1 [0060.224] GdipReleaseDC (graphics=0x1b86d040, hdc=0x40109c0) returned 0x0 [0060.224] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc9c0dbd) returned 0x0 [0060.224] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0060.224] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0060.224] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0060.225] GetSystemMetrics (nIndex=42) returned 0 [0060.225] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0060.225] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0060.225] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0060.225] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0060.225] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0060.225] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0060.225] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0060.225] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0060.225] GetCurrentObject (hdc=0x40109c0, type=0x1) returned 0x1b00017 [0060.225] GetCurrentObject (hdc=0x40109c0, type=0x2) returned 0x1900010 [0060.225] GetCurrentObject (hdc=0x40109c0, type=0x7) returned 0xffffffffd30509d2 [0060.225] GetCurrentObject (hdc=0x40109c0, type=0x6) returned 0x18a002e [0060.225] SaveDC (hdc=0x40109c0) returned 1 [0060.225] GetNearestColor (hdc=0x40109c0, color=0xf0f0f0) returned 0xf0f0f0 [0060.225] RestoreDC (hdc=0x40109c0, nSavedDC=-1) returned 1 [0060.225] GdipReleaseDC (graphics=0x1b86d040, hdc=0x40109c0) returned 0x0 [0060.225] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0060.225] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0060.225] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0060.225] GetCurrentObject (hdc=0x40109c0, type=0x1) returned 0x1b00017 [0060.226] GetCurrentObject (hdc=0x40109c0, type=0x2) returned 0x1900010 [0060.226] GetCurrentObject (hdc=0x40109c0, type=0x7) returned 0xffffffffd30509d2 [0060.226] GetCurrentObject (hdc=0x40109c0, type=0x6) returned 0x18a002e [0060.226] SaveDC (hdc=0x40109c0) returned 1 [0060.226] GetTextAlign (hdc=0x40109c0) returned 0x0 [0060.226] GetTextColor (hdc=0x40109c0) returned 0x0 [0060.226] SetTextColor (hdc=0x40109c0, color=0xf0f0f0) returned 0x0 [0060.226] GetCurrentObject (hdc=0x40109c0, type=0x6) returned 0x18a002e [0060.226] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0060.226] SelectObject (hdc=0x40109c0, h=0x260a09ba) returned 0x18a002e [0060.226] GetBkMode (hdc=0x40109c0) returned 2 [0060.226] SetBkMode (hdc=0x40109c0, mode=1) returned 2 [0060.226] DrawTextExW (in: hdc=0x40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26aee30 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0060.226] DrawTextExW (in: hdc=0x40109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26aee30 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0060.227] RestoreDC (hdc=0x40109c0, nSavedDC=-1) returned 1 [0060.227] GdipReleaseDC (graphics=0x1b86d040, hdc=0x40109c0) returned 0x0 [0060.227] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0060.227] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x40109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0060.227] GdipReleaseDC (graphics=0x1b86d040, hdc=0x40109c0) returned 0x0 [0060.227] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0060.227] SelectObject (hdc=0x40109c0, h=0x185000f) returned 0xffffffffd30509d2 [0060.227] DeleteDC (hdc=0x40109c0) returned 1 [0060.227] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0060.227] DeleteObject (ho=0xffffffffd30509d2) returned 1 [0060.231] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0060.231] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0060.231] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0060.231] WaitMessage () returned 1 [0060.370] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.370] IsWindowUnicode (hWnd=0x3015e) returned 1 [0060.370] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.370] TranslateMessage (lpMsg=0x26ee10) returned 0 [0060.370] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0060.370] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0060.370] GetCurrentThreadId () returned 0xa28 [0060.370] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0060.370] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.370] IsWindowUnicode (hWnd=0x3015e) returned 1 [0060.370] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.371] TranslateMessage (lpMsg=0x26ee10) returned 0 [0060.371] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0060.371] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0060.371] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0060.371] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffc80109d7 [0060.371] GetObjectType (h=0x60109d6) returned 0x3 [0060.371] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffd40509d2 [0060.371] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd40509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0060.371] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd40509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0060.371] DeleteObject (ho=0xffffffffd40509d2) returned 1 [0060.371] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x50509c0 [0060.371] SelectObject (hdc=0xffffffffc80109d7, h=0x50509c0) returned 0x185000f [0060.371] GdipCreateFromHDC (hdc=0xffffffffc80109d7, graphics=0x26e408) returned 0x0 [0060.372] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0060.372] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0060.372] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0060.372] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0060.372] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0060.372] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.372] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0060.372] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.372] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0060.372] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0060.372] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0060.372] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0060.372] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0060.372] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0060.372] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0060.372] GetSystemMetrics (nIndex=42) returned 0 [0060.372] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0060.372] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0060.372] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0060.372] IsAppThemed () returned 0x1 [0060.372] GetThemeAppProperties () returned 0x3 [0060.372] GetThemeAppProperties () returned 0x3 [0060.372] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0060.372] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0060.372] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0060.372] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0060.372] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0060.373] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.373] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0060.373] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.373] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0060.373] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.373] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0060.373] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.373] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0060.373] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0060.373] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0060.373] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0060.373] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0060.373] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0060.373] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x1) returned 0x1b00017 [0060.373] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x2) returned 0x1900010 [0060.373] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x7) returned 0x50509c0 [0060.373] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x6) returned 0x18a002e [0060.373] SaveDC (hdc=0xffffffffc80109d7) returned 1 [0060.373] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2c0409f1 [0060.373] GetClipRgn (hdc=0xffffffffc80109d7, hrgn=0x2c0409f1) returned 0 [0060.373] SelectClipRgn (hdc=0xffffffffc80109d7, hrgn=0x530409ff) returned 2 [0060.373] DeleteObject (ho=0x2c0409f1) returned 1 [0060.373] DeleteObject (ho=0x530409ff) returned 1 [0060.373] OffsetViewportOrgEx (in: hdc=0xffffffffc80109d7, x=0, y=0, lppt=0x26914f0 | out: lppt=0x26914f0) returned 1 [0060.373] OffsetViewportOrgEx (in: hdc=0xffffffffc80109d7, x=-417, y=-278, lppt=0x2691508 | out: lppt=0x2691508) returned 1 [0060.373] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0060.373] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x1) returned 0x1b00017 [0060.374] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x2) returned 0x1900010 [0060.374] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x7) returned 0x50509c0 [0060.374] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x6) returned 0x18a002e [0060.374] SaveDC (hdc=0xffffffffc80109d7) returned 2 [0060.374] GetNearestColor (hdc=0xffffffffc80109d7, color=0x6c4607) returned 0x6c4607 [0060.374] CreateSolidBrush (color=0x6c4607) returned 0xffffffffce100276 [0060.374] FillRect (hDC=0xffffffffc80109d7, lprc=0x26de08, hbr=0xffffffffce100276) returned 1 [0060.380] DeleteObject (ho=0xffffffffce100276) returned 1 [0060.380] RestoreDC (hdc=0xffffffffc80109d7, nSavedDC=-1) returned 1 [0060.380] RestoreDC (hdc=0xffffffffc80109d7, nSavedDC=-1) returned 1 [0060.380] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc80109d7) returned 0x0 [0060.380] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc9a0dbd) returned 0x0 [0060.380] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0060.380] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0060.380] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0060.380] GetSystemMetrics (nIndex=42) returned 0 [0060.380] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0060.380] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0060.380] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x43) returned 0x0 [0060.381] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0060.381] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0060.381] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0060.381] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0060.381] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0060.381] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0060.381] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x1) returned 0x1b00017 [0060.381] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x2) returned 0x1900010 [0060.381] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x7) returned 0x50509c0 [0060.381] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x6) returned 0x18a002e [0060.382] SaveDC (hdc=0xffffffffc80109d7) returned 1 [0060.382] GetNearestColor (hdc=0xffffffffc80109d7, color=0xf0f0f0) returned 0xf0f0f0 [0060.382] RestoreDC (hdc=0xffffffffc80109d7, nSavedDC=-1) returned 1 [0060.382] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc80109d7) returned 0x0 [0060.382] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0060.382] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0060.382] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0060.382] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0060.382] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x1) returned 0x1b00017 [0060.382] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x2) returned 0x1900010 [0060.382] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x7) returned 0x50509c0 [0060.382] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x6) returned 0x18a002e [0060.382] SaveDC (hdc=0xffffffffc80109d7) returned 1 [0060.382] GetTextAlign (hdc=0xffffffffc80109d7) returned 0x0 [0060.382] GetTextColor (hdc=0xffffffffc80109d7) returned 0x0 [0060.382] SetTextColor (hdc=0xffffffffc80109d7, color=0xf0f0f0) returned 0x0 [0060.382] GetCurrentObject (hdc=0xffffffffc80109d7, type=0x6) returned 0x18a002e [0060.382] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0060.383] SelectObject (hdc=0xffffffffc80109d7, h=0x260a09ba) returned 0x18a002e [0060.383] GetBkMode (hdc=0xffffffffc80109d7) returned 2 [0060.383] SetBkMode (hdc=0xffffffffc80109d7, mode=1) returned 2 [0060.383] DrawTextExW (in: hdc=0xffffffffc80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2692360 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0060.383] DrawTextExW (in: hdc=0xffffffffc80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2692360 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0060.383] RestoreDC (hdc=0xffffffffc80109d7, nSavedDC=-1) returned 1 [0060.383] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc80109d7) returned 0x0 [0060.383] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0060.383] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffc80109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0060.384] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffc80109d7) returned 0x0 [0060.384] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0060.384] SelectObject (hdc=0xffffffffc80109d7, h=0x185000f) returned 0x50509c0 [0060.384] DeleteDC (hdc=0xffffffffc80109d7) returned 1 [0060.384] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0060.384] DeleteObject (ho=0x50509c0) returned 1 [0060.387] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0060.387] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0060.387] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0060.387] WaitMessage () returned 1 [0060.526] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.526] IsWindowUnicode (hWnd=0x3015e) returned 1 [0060.526] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.526] TranslateMessage (lpMsg=0x26ee10) returned 0 [0060.526] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0060.526] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0060.526] GetCurrentThreadId () returned 0xa28 [0060.526] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0060.526] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.526] IsWindowUnicode (hWnd=0x3015e) returned 1 [0060.526] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.526] TranslateMessage (lpMsg=0x26ee10) returned 0 [0060.526] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0060.526] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0060.527] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0060.527] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffd60109d2 [0060.527] GetObjectType (h=0x60109d6) returned 0x3 [0060.527] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x60509c0 [0060.527] GetDIBits (in: hdc=0x60109d6, hbm=0x60509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0060.527] GetDIBits (in: hdc=0x60109d6, hbm=0x60509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0060.527] DeleteObject (ho=0x60509c0) returned 1 [0060.527] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffc90509d7 [0060.527] SelectObject (hdc=0xffffffffd60109d2, h=0xffffffffc90509d7) returned 0x185000f [0060.527] GdipCreateFromHDC (hdc=0xffffffffd60109d2, graphics=0x26e408) returned 0x0 [0060.527] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0060.527] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0060.527] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0060.527] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0060.527] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0060.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.528] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0060.528] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.528] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0060.528] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0060.528] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0060.528] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0060.528] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0060.528] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0060.528] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0060.528] GetSystemMetrics (nIndex=42) returned 0 [0060.528] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0060.528] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0060.528] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0060.528] IsAppThemed () returned 0x1 [0060.528] GetThemeAppProperties () returned 0x3 [0060.528] GetThemeAppProperties () returned 0x3 [0060.528] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0060.528] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0060.528] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0060.528] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0060.528] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0060.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.528] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0060.528] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.528] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0060.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.528] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0060.528] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.529] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0060.529] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0060.529] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0060.529] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0060.529] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0060.529] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0060.529] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x1) returned 0x1b00017 [0060.529] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x2) returned 0x1900010 [0060.529] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x7) returned 0xffffffffc90509d7 [0060.529] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x6) returned 0x18a002e [0060.529] SaveDC (hdc=0xffffffffd60109d2) returned 1 [0060.529] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x540409ff [0060.529] GetClipRgn (hdc=0xffffffffd60109d2, hrgn=0x540409ff) returned 0 [0060.529] SelectClipRgn (hdc=0xffffffffd60109d2, hrgn=0x2f0409f1) returned 2 [0060.529] DeleteObject (ho=0x540409ff) returned 1 [0060.529] DeleteObject (ho=0x2f0409f1) returned 1 [0060.529] OffsetViewportOrgEx (in: hdc=0xffffffffd60109d2, x=0, y=0, lppt=0x26eddd0 | out: lppt=0x26eddd0) returned 1 [0060.529] OffsetViewportOrgEx (in: hdc=0xffffffffd60109d2, x=-417, y=-278, lppt=0x26edde8 | out: lppt=0x26edde8) returned 1 [0060.529] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0060.529] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x1) returned 0x1b00017 [0060.529] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x2) returned 0x1900010 [0060.529] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x7) returned 0xffffffffc90509d7 [0060.529] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x6) returned 0x18a002e [0060.529] SaveDC (hdc=0xffffffffd60109d2) returned 2 [0060.529] GetNearestColor (hdc=0xffffffffd60109d2, color=0x6c4607) returned 0x6c4607 [0060.529] CreateSolidBrush (color=0x6c4607) returned 0xffffffffcf100276 [0060.530] FillRect (hDC=0xffffffffd60109d2, lprc=0x26de08, hbr=0xffffffffcf100276) returned 1 [0060.536] DeleteObject (ho=0xffffffffcf100276) returned 1 [0060.536] RestoreDC (hdc=0xffffffffd60109d2, nSavedDC=-1) returned 1 [0060.536] RestoreDC (hdc=0xffffffffd60109d2, nSavedDC=-1) returned 1 [0060.536] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd60109d2) returned 0x0 [0060.536] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc980dbd) returned 0x0 [0060.536] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0060.536] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0060.536] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0060.536] GetSystemMetrics (nIndex=42) returned 0 [0060.536] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0060.536] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0060.537] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0060.537] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0060.537] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0060.537] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0060.537] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0060.537] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0060.537] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x1) returned 0x1b00017 [0060.537] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x2) returned 0x1900010 [0060.537] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x7) returned 0xffffffffc90509d7 [0060.537] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x6) returned 0x18a002e [0060.537] SaveDC (hdc=0xffffffffd60109d2) returned 1 [0060.537] GetNearestColor (hdc=0xffffffffd60109d2, color=0xf0f0f0) returned 0xf0f0f0 [0060.537] RestoreDC (hdc=0xffffffffd60109d2, nSavedDC=-1) returned 1 [0060.537] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd60109d2) returned 0x0 [0060.537] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0060.537] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0060.537] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0060.537] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0060.537] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x1) returned 0x1b00017 [0060.537] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x2) returned 0x1900010 [0060.538] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x7) returned 0xffffffffc90509d7 [0060.538] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x6) returned 0x18a002e [0060.538] SaveDC (hdc=0xffffffffd60109d2) returned 1 [0060.538] GetTextAlign (hdc=0xffffffffd60109d2) returned 0x0 [0060.538] GetTextColor (hdc=0xffffffffd60109d2) returned 0x0 [0060.538] SetTextColor (hdc=0xffffffffd60109d2, color=0xf0f0f0) returned 0x0 [0060.538] GetCurrentObject (hdc=0xffffffffd60109d2, type=0x6) returned 0x18a002e [0060.538] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0060.538] SelectObject (hdc=0xffffffffd60109d2, h=0x260a09ba) returned 0x18a002e [0060.538] GetBkMode (hdc=0xffffffffd60109d2) returned 2 [0060.538] SetBkMode (hdc=0xffffffffd60109d2, mode=1) returned 2 [0060.538] DrawTextExW (in: hdc=0xffffffffd60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26eea98 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0060.538] DrawTextExW (in: hdc=0xffffffffd60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26eea98 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0060.539] RestoreDC (hdc=0xffffffffd60109d2, nSavedDC=-1) returned 1 [0060.539] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd60109d2) returned 0x0 [0060.539] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0060.539] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffd60109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0060.539] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd60109d2) returned 0x0 [0060.539] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0060.539] SelectObject (hdc=0xffffffffd60109d2, h=0x185000f) returned 0xffffffffc90509d7 [0060.539] DeleteDC (hdc=0xffffffffd60109d2) returned 1 [0060.539] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0060.539] DeleteObject (ho=0xffffffffc90509d7) returned 1 [0060.543] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0060.543] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0060.543] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0060.543] WaitMessage () returned 1 [0060.756] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.756] IsWindowUnicode (hWnd=0x3015e) returned 1 [0060.756] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.756] TranslateMessage (lpMsg=0x26ee10) returned 0 [0060.757] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0060.757] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0060.757] GetCurrentThreadId () returned 0xa28 [0060.757] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0060.757] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.757] IsWindowUnicode (hWnd=0x3015e) returned 1 [0060.757] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0060.757] TranslateMessage (lpMsg=0x26ee10) returned 0 [0060.757] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0060.757] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0060.757] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0060.757] CreateCompatibleDC (hdc=0x60109d6) returned 0x80109c0 [0060.757] GetObjectType (h=0x60109d6) returned 0x3 [0060.757] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffca0509d7 [0060.757] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffca0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0060.757] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffca0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0060.757] DeleteObject (ho=0xffffffffca0509d7) returned 1 [0060.757] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffd70509d2 [0060.758] SelectObject (hdc=0x80109c0, h=0xffffffffd70509d2) returned 0x185000f [0060.758] GdipCreateFromHDC (hdc=0x80109c0, graphics=0x26e408) returned 0x0 [0060.758] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0060.758] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0060.758] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0060.758] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0060.758] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0060.758] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.758] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0060.758] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.758] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0060.758] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0060.758] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0060.758] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0060.758] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0060.758] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0060.758] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0060.758] GetSystemMetrics (nIndex=42) returned 0 [0060.758] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0060.758] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0060.759] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0060.759] IsAppThemed () returned 0x1 [0060.759] GetThemeAppProperties () returned 0x3 [0060.759] GetThemeAppProperties () returned 0x3 [0060.759] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0060.759] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0060.759] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0060.759] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0060.759] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0060.759] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.759] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0060.759] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.759] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0060.759] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0060.759] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0060.759] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0060.759] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0060.759] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0060.759] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0060.759] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0060.759] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0060.759] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0060.759] GetCurrentObject (hdc=0x80109c0, type=0x1) returned 0x1b00017 [0060.759] GetCurrentObject (hdc=0x80109c0, type=0x2) returned 0x1900010 [0060.759] GetCurrentObject (hdc=0x80109c0, type=0x7) returned 0xffffffffd70509d2 [0060.759] GetCurrentObject (hdc=0x80109c0, type=0x6) returned 0x18a002e [0060.759] SaveDC (hdc=0x80109c0) returned 1 [0060.759] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x300409f1 [0060.760] GetClipRgn (hdc=0x80109c0, hrgn=0x300409f1) returned 0 [0060.760] SelectClipRgn (hdc=0x80109c0, hrgn=0x570409ff) returned 2 [0060.760] DeleteObject (ho=0x300409f1) returned 1 [0060.760] DeleteObject (ho=0x570409ff) returned 1 [0060.760] OffsetViewportOrgEx (in: hdc=0x80109c0, x=0, y=0, lppt=0x285c8a8 | out: lppt=0x285c8a8) returned 1 [0060.760] OffsetViewportOrgEx (in: hdc=0x80109c0, x=-417, y=-278, lppt=0x285c8c0 | out: lppt=0x285c8c0) returned 1 [0060.760] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0060.760] GetCurrentObject (hdc=0x80109c0, type=0x1) returned 0x1b00017 [0060.760] GetCurrentObject (hdc=0x80109c0, type=0x2) returned 0x1900010 [0060.760] GetCurrentObject (hdc=0x80109c0, type=0x7) returned 0xffffffffd70509d2 [0060.760] GetCurrentObject (hdc=0x80109c0, type=0x6) returned 0x18a002e [0060.760] SaveDC (hdc=0x80109c0) returned 2 [0060.760] GetNearestColor (hdc=0x80109c0, color=0x6c4607) returned 0x6c4607 [0060.760] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd0100276 [0060.760] FillRect (hDC=0x80109c0, lprc=0x26de08, hbr=0xffffffffd0100276) returned 1 [0060.767] DeleteObject (ho=0xffffffffd0100276) returned 1 [0060.767] RestoreDC (hdc=0x80109c0, nSavedDC=-1) returned 1 [0060.767] RestoreDC (hdc=0x80109c0, nSavedDC=-1) returned 1 [0060.767] GdipReleaseDC (graphics=0x1b86d040, hdc=0x80109c0) returned 0x0 [0060.767] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc960dbd) returned 0x0 [0060.767] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0060.767] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0060.767] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0060.767] GetSystemMetrics (nIndex=42) returned 0 [0060.767] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0060.767] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0060.767] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x45) returned 0x0 [0060.768] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0060.768] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0060.768] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0060.768] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0060.768] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0060.768] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0060.768] GetCurrentObject (hdc=0x80109c0, type=0x1) returned 0x1b00017 [0060.768] GetCurrentObject (hdc=0x80109c0, type=0x2) returned 0x1900010 [0060.768] GetCurrentObject (hdc=0x80109c0, type=0x7) returned 0xffffffffd70509d2 [0060.768] GetCurrentObject (hdc=0x80109c0, type=0x6) returned 0x18a002e [0060.768] SaveDC (hdc=0x80109c0) returned 1 [0060.768] GetNearestColor (hdc=0x80109c0, color=0xf0f0f0) returned 0xf0f0f0 [0060.768] RestoreDC (hdc=0x80109c0, nSavedDC=-1) returned 1 [0060.768] GdipReleaseDC (graphics=0x1b86d040, hdc=0x80109c0) returned 0x0 [0060.769] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0060.769] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0060.769] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0060.769] GetCurrentObject (hdc=0x80109c0, type=0x1) returned 0x1b00017 [0060.769] GetCurrentObject (hdc=0x80109c0, type=0x2) returned 0x1900010 [0060.769] GetCurrentObject (hdc=0x80109c0, type=0x7) returned 0xffffffffd70509d2 [0060.769] GetCurrentObject (hdc=0x80109c0, type=0x6) returned 0x18a002e [0060.769] SaveDC (hdc=0x80109c0) returned 1 [0060.769] GetTextAlign (hdc=0x80109c0) returned 0x0 [0060.769] GetTextColor (hdc=0x80109c0) returned 0x0 [0060.769] SetTextColor (hdc=0x80109c0, color=0xf0f0f0) returned 0x0 [0060.769] GetCurrentObject (hdc=0x80109c0, type=0x6) returned 0x18a002e [0060.769] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0060.769] SelectObject (hdc=0x80109c0, h=0x260a09ba) returned 0x18a002e [0060.769] GetBkMode (hdc=0x80109c0) returned 2 [0060.769] SetBkMode (hdc=0x80109c0, mode=1) returned 2 [0060.769] DrawTextExW (in: hdc=0x80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x285d710 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0060.769] DrawTextExW (in: hdc=0x80109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x285d710 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0060.770] RestoreDC (hdc=0x80109c0, nSavedDC=-1) returned 1 [0060.770] GdipReleaseDC (graphics=0x1b86d040, hdc=0x80109c0) returned 0x0 [0060.770] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0060.770] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x80109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0060.770] GdipReleaseDC (graphics=0x1b86d040, hdc=0x80109c0) returned 0x0 [0060.770] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0060.770] SelectObject (hdc=0x80109c0, h=0x185000f) returned 0xffffffffd70509d2 [0060.770] DeleteDC (hdc=0x80109c0) returned 1 [0060.770] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0060.770] DeleteObject (ho=0xffffffffd70509d2) returned 1 [0060.774] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0060.774] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0060.774] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0060.774] WaitMessage () returned 1 [0061.052] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.052] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.052] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.052] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.052] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.053] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0061.053] GetCurrentThreadId () returned 0xa28 [0061.053] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0061.053] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.053] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.053] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.053] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.053] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.053] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0061.053] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0061.053] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffcc0109d7 [0061.053] GetObjectType (h=0x60109d6) returned 0x3 [0061.053] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffd80509d2 [0061.053] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd80509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.054] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd80509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.054] DeleteObject (ho=0xffffffffd80509d2) returned 1 [0061.054] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x90509c0 [0061.054] SelectObject (hdc=0xffffffffcc0109d7, h=0x90509c0) returned 0x185000f [0061.054] GdipCreateFromHDC (hdc=0xffffffffcc0109d7, graphics=0x26e408) returned 0x0 [0061.054] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0061.054] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0061.054] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0061.054] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0061.054] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0061.054] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.054] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0061.054] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.054] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0061.054] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0061.054] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0061.054] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0061.054] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0061.054] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.055] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.055] GetSystemMetrics (nIndex=42) returned 0 [0061.055] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.055] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.055] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0061.055] IsAppThemed () returned 0x1 [0061.055] GetThemeAppProperties () returned 0x3 [0061.055] GetThemeAppProperties () returned 0x3 [0061.055] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0061.055] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0061.055] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0061.055] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0061.055] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0061.055] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.055] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.055] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.055] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0061.055] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.055] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.055] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.055] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0061.055] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0061.055] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0061.055] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0061.055] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0061.055] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0061.055] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x1) returned 0x1b00017 [0061.055] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x2) returned 0x1900010 [0061.055] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x7) returned 0x90509c0 [0061.056] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x6) returned 0x18a002e [0061.056] SaveDC (hdc=0xffffffffcc0109d7) returned 1 [0061.056] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x580409ff [0061.056] GetClipRgn (hdc=0xffffffffcc0109d7, hrgn=0x580409ff) returned 0 [0061.056] SelectClipRgn (hdc=0xffffffffcc0109d7, hrgn=0x330409f1) returned 2 [0061.056] DeleteObject (ho=0x580409ff) returned 1 [0061.056] DeleteObject (ho=0x330409f1) returned 1 [0061.056] OffsetViewportOrgEx (in: hdc=0xffffffffcc0109d7, x=0, y=0, lppt=0x2700038 | out: lppt=0x2700038) returned 1 [0061.056] OffsetViewportOrgEx (in: hdc=0xffffffffcc0109d7, x=-417, y=-278, lppt=0x2700050 | out: lppt=0x2700050) returned 1 [0061.056] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0061.056] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x1) returned 0x1b00017 [0061.056] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x2) returned 0x1900010 [0061.056] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x7) returned 0x90509c0 [0061.056] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x6) returned 0x18a002e [0061.056] SaveDC (hdc=0xffffffffcc0109d7) returned 2 [0061.056] GetNearestColor (hdc=0xffffffffcc0109d7, color=0x6c4607) returned 0x6c4607 [0061.056] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd1100276 [0061.056] FillRect (hDC=0xffffffffcc0109d7, lprc=0x26de08, hbr=0xffffffffd1100276) returned 1 [0061.062] DeleteObject (ho=0xffffffffd1100276) returned 1 [0061.062] RestoreDC (hdc=0xffffffffcc0109d7, nSavedDC=-1) returned 1 [0061.063] RestoreDC (hdc=0xffffffffcc0109d7, nSavedDC=-1) returned 1 [0061.063] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffcc0109d7) returned 0x0 [0061.063] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc940dbd) returned 0x0 [0061.063] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0061.063] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.063] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.063] GetSystemMetrics (nIndex=42) returned 0 [0061.063] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.063] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.063] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0061.063] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0061.063] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0061.063] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0061.063] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0061.063] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0061.063] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x1) returned 0x1b00017 [0061.063] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x2) returned 0x1900010 [0061.063] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x7) returned 0x90509c0 [0061.063] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x6) returned 0x18a002e [0061.063] SaveDC (hdc=0xffffffffcc0109d7) returned 1 [0061.063] GetNearestColor (hdc=0xffffffffcc0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0061.063] RestoreDC (hdc=0xffffffffcc0109d7, nSavedDC=-1) returned 1 [0061.063] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffcc0109d7) returned 0x0 [0061.064] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0061.064] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0061.064] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0061.064] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0061.064] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x1) returned 0x1b00017 [0061.064] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x2) returned 0x1900010 [0061.064] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x7) returned 0x90509c0 [0061.064] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x6) returned 0x18a002e [0061.064] SaveDC (hdc=0xffffffffcc0109d7) returned 1 [0061.064] GetTextAlign (hdc=0xffffffffcc0109d7) returned 0x0 [0061.064] GetTextColor (hdc=0xffffffffcc0109d7) returned 0x0 [0061.064] SetTextColor (hdc=0xffffffffcc0109d7, color=0xf0f0f0) returned 0x0 [0061.064] GetCurrentObject (hdc=0xffffffffcc0109d7, type=0x6) returned 0x18a002e [0061.064] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0061.064] SelectObject (hdc=0xffffffffcc0109d7, h=0x260a09ba) returned 0x18a002e [0061.064] GetBkMode (hdc=0xffffffffcc0109d7) returned 2 [0061.064] SetBkMode (hdc=0xffffffffcc0109d7, mode=1) returned 2 [0061.064] DrawTextExW (in: hdc=0xffffffffcc0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2700d00 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0061.065] DrawTextExW (in: hdc=0xffffffffcc0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2700d00 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0061.065] RestoreDC (hdc=0xffffffffcc0109d7, nSavedDC=-1) returned 1 [0061.065] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffcc0109d7) returned 0x0 [0061.065] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0061.065] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffcc0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0061.065] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffcc0109d7) returned 0x0 [0061.065] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0061.065] SelectObject (hdc=0xffffffffcc0109d7, h=0x185000f) returned 0x90509c0 [0061.065] DeleteDC (hdc=0xffffffffcc0109d7) returned 1 [0061.066] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0061.066] DeleteObject (ho=0x90509c0) returned 1 [0061.069] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0061.069] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.069] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.069] WaitMessage () returned 1 [0061.212] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.212] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.213] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.213] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.213] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.213] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0061.213] GetCurrentThreadId () returned 0xa28 [0061.213] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0061.213] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.213] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.213] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.213] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.213] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.213] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0061.213] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0061.213] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffda0109d2 [0061.213] GetObjectType (h=0x60109d6) returned 0x3 [0061.213] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xa0509c0 [0061.213] GetDIBits (in: hdc=0x60109d6, hbm=0xa0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.213] GetDIBits (in: hdc=0x60109d6, hbm=0xa0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.213] DeleteObject (ho=0xa0509c0) returned 1 [0061.213] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffcd0509d7 [0061.213] SelectObject (hdc=0xffffffffda0109d2, h=0xffffffffcd0509d7) returned 0x185000f [0061.213] GdipCreateFromHDC (hdc=0xffffffffda0109d2, graphics=0x26e408) returned 0x0 [0061.214] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0061.214] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0061.214] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0061.214] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0061.214] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0061.214] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.214] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0061.214] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.214] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0061.214] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0061.214] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0061.214] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0061.214] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0061.214] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.214] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.214] GetSystemMetrics (nIndex=42) returned 0 [0061.214] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.214] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.214] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0061.214] IsAppThemed () returned 0x1 [0061.214] GetThemeAppProperties () returned 0x3 [0061.214] GetThemeAppProperties () returned 0x3 [0061.214] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0061.215] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0061.215] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0061.215] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0061.215] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0061.215] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.215] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.215] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.215] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0061.215] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.215] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.215] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.215] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0061.215] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0061.215] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0061.215] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0061.215] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0061.215] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0061.215] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x1) returned 0x1b00017 [0061.215] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x2) returned 0x1900010 [0061.215] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x7) returned 0xffffffffcd0509d7 [0061.215] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x6) returned 0x18a002e [0061.215] SaveDC (hdc=0xffffffffda0109d2) returned 1 [0061.215] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x340409f1 [0061.215] GetClipRgn (hdc=0xffffffffda0109d2, hrgn=0x340409f1) returned 0 [0061.215] SelectClipRgn (hdc=0xffffffffda0109d2, hrgn=0x5b0409ff) returned 2 [0061.215] DeleteObject (ho=0x340409f1) returned 1 [0061.215] DeleteObject (ho=0x5b0409ff) returned 1 [0061.216] OffsetViewportOrgEx (in: hdc=0xffffffffda0109d2, x=0, y=0, lppt=0x26ad6f8 | out: lppt=0x26ad6f8) returned 1 [0061.216] OffsetViewportOrgEx (in: hdc=0xffffffffda0109d2, x=-417, y=-278, lppt=0x26ad710 | out: lppt=0x26ad710) returned 1 [0061.216] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0061.216] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x1) returned 0x1b00017 [0061.216] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x2) returned 0x1900010 [0061.216] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x7) returned 0xffffffffcd0509d7 [0061.216] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x6) returned 0x18a002e [0061.216] SaveDC (hdc=0xffffffffda0109d2) returned 2 [0061.216] GetNearestColor (hdc=0xffffffffda0109d2, color=0x6c4607) returned 0x6c4607 [0061.216] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd2100276 [0061.216] FillRect (hDC=0xffffffffda0109d2, lprc=0x26de08, hbr=0xffffffffd2100276) returned 1 [0061.222] DeleteObject (ho=0xffffffffd2100276) returned 1 [0061.222] RestoreDC (hdc=0xffffffffda0109d2, nSavedDC=-1) returned 1 [0061.222] RestoreDC (hdc=0xffffffffda0109d2, nSavedDC=-1) returned 1 [0061.222] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffda0109d2) returned 0x0 [0061.222] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc920dbd) returned 0x0 [0061.222] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0061.223] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.223] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.223] GetSystemMetrics (nIndex=42) returned 0 [0061.223] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.223] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.223] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x47) returned 0x0 [0061.223] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0061.223] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0061.223] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0061.223] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0061.224] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0061.224] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0061.224] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x1) returned 0x1b00017 [0061.224] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x2) returned 0x1900010 [0061.224] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x7) returned 0xffffffffcd0509d7 [0061.224] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x6) returned 0x18a002e [0061.224] SaveDC (hdc=0xffffffffda0109d2) returned 1 [0061.224] GetNearestColor (hdc=0xffffffffda0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0061.224] RestoreDC (hdc=0xffffffffda0109d2, nSavedDC=-1) returned 1 [0061.224] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffda0109d2) returned 0x0 [0061.224] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0061.224] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0061.224] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0061.224] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x1) returned 0x1b00017 [0061.224] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x2) returned 0x1900010 [0061.224] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x7) returned 0xffffffffcd0509d7 [0061.224] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x6) returned 0x18a002e [0061.224] SaveDC (hdc=0xffffffffda0109d2) returned 1 [0061.224] GetTextAlign (hdc=0xffffffffda0109d2) returned 0x0 [0061.225] GetTextColor (hdc=0xffffffffda0109d2) returned 0x0 [0061.225] SetTextColor (hdc=0xffffffffda0109d2, color=0xf0f0f0) returned 0x0 [0061.225] GetCurrentObject (hdc=0xffffffffda0109d2, type=0x6) returned 0x18a002e [0061.225] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0061.225] SelectObject (hdc=0xffffffffda0109d2, h=0x260a09ba) returned 0x18a002e [0061.225] GetBkMode (hdc=0xffffffffda0109d2) returned 2 [0061.225] SetBkMode (hdc=0xffffffffda0109d2, mode=1) returned 2 [0061.225] DrawTextExW (in: hdc=0xffffffffda0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26ae540 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0061.225] DrawTextExW (in: hdc=0xffffffffda0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26ae540 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0061.225] RestoreDC (hdc=0xffffffffda0109d2, nSavedDC=-1) returned 1 [0061.225] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffda0109d2) returned 0x0 [0061.225] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0061.226] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffda0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0061.226] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffda0109d2) returned 0x0 [0061.226] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0061.226] SelectObject (hdc=0xffffffffda0109d2, h=0x185000f) returned 0xffffffffcd0509d7 [0061.226] DeleteDC (hdc=0xffffffffda0109d2) returned 1 [0061.226] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0061.226] DeleteObject (ho=0xffffffffcd0509d7) returned 1 [0061.230] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0061.230] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.230] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.230] WaitMessage () returned 1 [0061.356] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.356] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.356] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.356] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.356] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.357] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0061.357] GetCurrentThreadId () returned 0xa28 [0061.357] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0061.357] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.357] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.357] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.357] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.357] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.357] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0061.357] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0061.357] CreateCompatibleDC (hdc=0x60109d6) returned 0xc0109c0 [0061.357] GetObjectType (h=0x60109d6) returned 0x3 [0061.357] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffce0509d7 [0061.357] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffce0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.357] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffce0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.357] DeleteObject (ho=0xffffffffce0509d7) returned 1 [0061.357] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffdb0509d2 [0061.357] SelectObject (hdc=0xc0109c0, h=0xffffffffdb0509d2) returned 0x185000f [0061.358] GdipCreateFromHDC (hdc=0xc0109c0, graphics=0x26e408) returned 0x0 [0061.358] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0061.358] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0061.358] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0061.358] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0061.358] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0061.358] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.358] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0061.358] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.358] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0061.358] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0061.358] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0061.358] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0061.358] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0061.358] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.358] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.358] GetSystemMetrics (nIndex=42) returned 0 [0061.358] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.358] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.358] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0061.358] IsAppThemed () returned 0x1 [0061.358] GetThemeAppProperties () returned 0x3 [0061.358] GetThemeAppProperties () returned 0x3 [0061.359] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0061.359] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0061.359] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0061.359] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0061.359] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0061.359] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.359] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.359] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.359] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0061.359] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.359] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.359] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.359] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0061.359] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0061.359] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0061.359] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0061.359] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0061.359] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0061.359] GetCurrentObject (hdc=0xc0109c0, type=0x1) returned 0x1b00017 [0061.359] GetCurrentObject (hdc=0xc0109c0, type=0x2) returned 0x1900010 [0061.359] GetCurrentObject (hdc=0xc0109c0, type=0x7) returned 0xffffffffdb0509d2 [0061.359] GetCurrentObject (hdc=0xc0109c0, type=0x6) returned 0x18a002e [0061.359] SaveDC (hdc=0xc0109c0) returned 1 [0061.359] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5c0409ff [0061.359] GetClipRgn (hdc=0xc0109c0, hrgn=0x5c0409ff) returned 0 [0061.359] SelectClipRgn (hdc=0xc0109c0, hrgn=0x370409f1) returned 2 [0061.359] DeleteObject (ho=0x5c0409ff) returned 1 [0061.359] DeleteObject (ho=0x370409f1) returned 1 [0061.360] OffsetViewportOrgEx (in: hdc=0xc0109c0, x=0, y=0, lppt=0x27f6360 | out: lppt=0x27f6360) returned 1 [0061.360] OffsetViewportOrgEx (in: hdc=0xc0109c0, x=-417, y=-278, lppt=0x27f6378 | out: lppt=0x27f6378) returned 1 [0061.360] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0061.360] GetCurrentObject (hdc=0xc0109c0, type=0x1) returned 0x1b00017 [0061.360] GetCurrentObject (hdc=0xc0109c0, type=0x2) returned 0x1900010 [0061.360] GetCurrentObject (hdc=0xc0109c0, type=0x7) returned 0xffffffffdb0509d2 [0061.360] GetCurrentObject (hdc=0xc0109c0, type=0x6) returned 0x18a002e [0061.360] SaveDC (hdc=0xc0109c0) returned 2 [0061.360] GetNearestColor (hdc=0xc0109c0, color=0x6c4607) returned 0x6c4607 [0061.360] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd3100276 [0061.360] FillRect (hDC=0xc0109c0, lprc=0x26de08, hbr=0xffffffffd3100276) returned 1 [0061.366] DeleteObject (ho=0xffffffffd3100276) returned 1 [0061.366] RestoreDC (hdc=0xc0109c0, nSavedDC=-1) returned 1 [0061.366] RestoreDC (hdc=0xc0109c0, nSavedDC=-1) returned 1 [0061.366] GdipReleaseDC (graphics=0x1b86d040, hdc=0xc0109c0) returned 0x0 [0061.366] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc900dbd) returned 0x0 [0061.366] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0061.366] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.366] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.367] GetSystemMetrics (nIndex=42) returned 0 [0061.367] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.367] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.367] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0061.367] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0061.367] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0061.367] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0061.367] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0061.367] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0061.367] GetCurrentObject (hdc=0xc0109c0, type=0x1) returned 0x1b00017 [0061.367] GetCurrentObject (hdc=0xc0109c0, type=0x2) returned 0x1900010 [0061.367] GetCurrentObject (hdc=0xc0109c0, type=0x7) returned 0xffffffffdb0509d2 [0061.367] GetCurrentObject (hdc=0xc0109c0, type=0x6) returned 0x18a002e [0061.367] SaveDC (hdc=0xc0109c0) returned 1 [0061.367] GetNearestColor (hdc=0xc0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0061.367] RestoreDC (hdc=0xc0109c0, nSavedDC=-1) returned 1 [0061.367] GdipReleaseDC (graphics=0x1b86d040, hdc=0xc0109c0) returned 0x0 [0061.367] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0061.367] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0061.367] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0061.368] GetCurrentObject (hdc=0xc0109c0, type=0x1) returned 0x1b00017 [0061.368] GetCurrentObject (hdc=0xc0109c0, type=0x2) returned 0x1900010 [0061.368] GetCurrentObject (hdc=0xc0109c0, type=0x7) returned 0xffffffffdb0509d2 [0061.368] GetCurrentObject (hdc=0xc0109c0, type=0x6) returned 0x18a002e [0061.368] SaveDC (hdc=0xc0109c0) returned 1 [0061.368] GetTextAlign (hdc=0xc0109c0) returned 0x0 [0061.368] GetTextColor (hdc=0xc0109c0) returned 0x0 [0061.368] SetTextColor (hdc=0xc0109c0, color=0xf0f0f0) returned 0x0 [0061.368] GetCurrentObject (hdc=0xc0109c0, type=0x6) returned 0x18a002e [0061.368] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0061.368] SelectObject (hdc=0xc0109c0, h=0x260a09ba) returned 0x18a002e [0061.368] GetBkMode (hdc=0xc0109c0) returned 2 [0061.368] SetBkMode (hdc=0xc0109c0, mode=1) returned 2 [0061.368] DrawTextExW (in: hdc=0xc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27f7028 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0061.369] DrawTextExW (in: hdc=0xc0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27f7028 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0061.369] RestoreDC (hdc=0xc0109c0, nSavedDC=-1) returned 1 [0061.369] GdipReleaseDC (graphics=0x1b86d040, hdc=0xc0109c0) returned 0x0 [0061.369] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0061.369] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xc0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0061.369] GdipReleaseDC (graphics=0x1b86d040, hdc=0xc0109c0) returned 0x0 [0061.369] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0061.370] SelectObject (hdc=0xc0109c0, h=0x185000f) returned 0xffffffffdb0509d2 [0061.370] DeleteDC (hdc=0xc0109c0) returned 1 [0061.370] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0061.370] DeleteObject (ho=0xffffffffdb0509d2) returned 1 [0061.373] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0061.373] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.373] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.373] WaitMessage () returned 1 [0061.496] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.496] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.496] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.496] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.496] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.496] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0061.496] GetCurrentThreadId () returned 0xa28 [0061.496] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0061.496] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.496] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.496] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.496] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.496] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.496] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0061.497] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0061.497] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffd00109d7 [0061.497] GetObjectType (h=0x60109d6) returned 0x3 [0061.497] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffdc0509d2 [0061.497] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffdc0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.497] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffdc0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.497] DeleteObject (ho=0xffffffffdc0509d2) returned 1 [0061.497] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xd0509c0 [0061.497] SelectObject (hdc=0xffffffffd00109d7, h=0xd0509c0) returned 0x185000f [0061.497] GdipCreateFromHDC (hdc=0xffffffffd00109d7, graphics=0x26e408) returned 0x0 [0061.497] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0061.497] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0061.497] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0061.497] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0061.497] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0061.497] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.498] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0061.498] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.498] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0061.498] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0061.498] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0061.498] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0061.498] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0061.498] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.498] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.498] GetSystemMetrics (nIndex=42) returned 0 [0061.498] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.498] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.498] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0061.498] IsAppThemed () returned 0x1 [0061.498] GetThemeAppProperties () returned 0x3 [0061.498] GetThemeAppProperties () returned 0x3 [0061.498] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0061.498] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0061.498] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0061.498] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0061.498] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0061.498] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.498] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.498] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.498] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0061.498] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.498] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.499] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.499] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0061.499] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0061.499] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0061.499] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0061.499] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0061.499] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0061.499] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x1) returned 0x1b00017 [0061.499] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x2) returned 0x1900010 [0061.499] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x7) returned 0xd0509c0 [0061.499] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x6) returned 0x18a002e [0061.499] SaveDC (hdc=0xffffffffd00109d7) returned 1 [0061.499] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x380409f1 [0061.499] GetClipRgn (hdc=0xffffffffd00109d7, hrgn=0x380409f1) returned 0 [0061.499] SelectClipRgn (hdc=0xffffffffd00109d7, hrgn=0x5f0409ff) returned 2 [0061.499] DeleteObject (ho=0x380409f1) returned 1 [0061.499] DeleteObject (ho=0x5f0409ff) returned 1 [0061.499] OffsetViewportOrgEx (in: hdc=0xffffffffd00109d7, x=0, y=0, lppt=0x26aa370 | out: lppt=0x26aa370) returned 1 [0061.499] OffsetViewportOrgEx (in: hdc=0xffffffffd00109d7, x=-417, y=-278, lppt=0x26aa388 | out: lppt=0x26aa388) returned 1 [0061.499] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0061.499] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x1) returned 0x1b00017 [0061.499] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x2) returned 0x1900010 [0061.499] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x7) returned 0xd0509c0 [0061.499] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x6) returned 0x18a002e [0061.499] SaveDC (hdc=0xffffffffd00109d7) returned 2 [0061.500] GetNearestColor (hdc=0xffffffffd00109d7, color=0x6c4607) returned 0x6c4607 [0061.500] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd4100276 [0061.500] FillRect (hDC=0xffffffffd00109d7, lprc=0x26de08, hbr=0xffffffffd4100276) returned 1 [0061.506] DeleteObject (ho=0xffffffffd4100276) returned 1 [0061.506] RestoreDC (hdc=0xffffffffd00109d7, nSavedDC=-1) returned 1 [0061.506] RestoreDC (hdc=0xffffffffd00109d7, nSavedDC=-1) returned 1 [0061.506] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd00109d7) returned 0x0 [0061.506] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc8e0dbd) returned 0x0 [0061.506] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0061.506] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.506] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.506] GetSystemMetrics (nIndex=42) returned 0 [0061.506] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.506] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.506] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x49) returned 0x0 [0061.507] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0061.507] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0061.507] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0061.507] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0061.507] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0061.507] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0061.507] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x1) returned 0x1b00017 [0061.507] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x2) returned 0x1900010 [0061.507] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x7) returned 0xd0509c0 [0061.507] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x6) returned 0x18a002e [0061.507] SaveDC (hdc=0xffffffffd00109d7) returned 1 [0061.507] GetNearestColor (hdc=0xffffffffd00109d7, color=0xf0f0f0) returned 0xf0f0f0 [0061.507] RestoreDC (hdc=0xffffffffd00109d7, nSavedDC=-1) returned 1 [0061.507] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd00109d7) returned 0x0 [0061.508] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0061.508] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0061.508] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0061.508] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0061.508] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x1) returned 0x1b00017 [0061.508] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x2) returned 0x1900010 [0061.508] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x7) returned 0xd0509c0 [0061.508] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x6) returned 0x18a002e [0061.508] SaveDC (hdc=0xffffffffd00109d7) returned 1 [0061.508] GetTextAlign (hdc=0xffffffffd00109d7) returned 0x0 [0061.508] GetTextColor (hdc=0xffffffffd00109d7) returned 0x0 [0061.508] SetTextColor (hdc=0xffffffffd00109d7, color=0xf0f0f0) returned 0x0 [0061.508] GetCurrentObject (hdc=0xffffffffd00109d7, type=0x6) returned 0x18a002e [0061.508] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0061.509] SelectObject (hdc=0xffffffffd00109d7, h=0x260a09ba) returned 0x18a002e [0061.509] GetBkMode (hdc=0xffffffffd00109d7) returned 2 [0061.509] SetBkMode (hdc=0xffffffffd00109d7, mode=1) returned 2 [0061.509] DrawTextExW (in: hdc=0xffffffffd00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26ab198 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0061.509] DrawTextExW (in: hdc=0xffffffffd00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26ab198 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0061.509] RestoreDC (hdc=0xffffffffd00109d7, nSavedDC=-1) returned 1 [0061.509] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd00109d7) returned 0x0 [0061.509] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0061.510] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffd00109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0061.510] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd00109d7) returned 0x0 [0061.510] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0061.510] SelectObject (hdc=0xffffffffd00109d7, h=0x185000f) returned 0xd0509c0 [0061.510] DeleteDC (hdc=0xffffffffd00109d7) returned 1 [0061.510] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0061.510] DeleteObject (ho=0xd0509c0) returned 1 [0061.513] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0061.513] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.513] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.513] WaitMessage () returned 1 [0061.727] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.727] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.727] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.727] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.727] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.727] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0061.727] GetCurrentThreadId () returned 0xa28 [0061.727] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0061.727] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.727] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.728] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.728] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.728] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.728] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0061.728] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0061.728] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffde0109d2 [0061.728] GetObjectType (h=0x60109d6) returned 0x3 [0061.728] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xe0509c0 [0061.728] GetDIBits (in: hdc=0x60109d6, hbm=0xe0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.728] GetDIBits (in: hdc=0x60109d6, hbm=0xe0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.728] DeleteObject (ho=0xe0509c0) returned 1 [0061.728] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffd10509d7 [0061.728] SelectObject (hdc=0xffffffffde0109d2, h=0xffffffffd10509d7) returned 0x185000f [0061.728] GdipCreateFromHDC (hdc=0xffffffffde0109d2, graphics=0x26e408) returned 0x0 [0061.729] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0061.729] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0061.729] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0061.729] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0061.729] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0061.729] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.729] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0061.729] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.729] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0061.729] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0061.729] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0061.729] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0061.729] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0061.729] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.729] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.729] GetSystemMetrics (nIndex=42) returned 0 [0061.729] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.729] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.729] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0061.729] IsAppThemed () returned 0x1 [0061.729] GetThemeAppProperties () returned 0x3 [0061.729] GetThemeAppProperties () returned 0x3 [0061.729] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0061.729] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0061.729] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0061.729] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0061.729] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0061.730] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.730] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.730] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.730] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0061.730] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.730] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.730] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.730] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0061.730] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0061.730] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0061.730] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0061.730] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0061.730] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0061.730] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x1) returned 0x1b00017 [0061.730] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x2) returned 0x1900010 [0061.730] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x7) returned 0xffffffffd10509d7 [0061.730] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x6) returned 0x18a002e [0061.730] SaveDC (hdc=0xffffffffde0109d2) returned 1 [0061.730] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x600409ff [0061.730] GetClipRgn (hdc=0xffffffffde0109d2, hrgn=0x600409ff) returned 0 [0061.730] SelectClipRgn (hdc=0xffffffffde0109d2, hrgn=0x3b0409f1) returned 2 [0061.730] DeleteObject (ho=0x600409ff) returned 1 [0061.730] DeleteObject (ho=0x3b0409f1) returned 1 [0061.730] OffsetViewportOrgEx (in: hdc=0xffffffffde0109d2, x=0, y=0, lppt=0x26a8d20 | out: lppt=0x26a8d20) returned 1 [0061.730] OffsetViewportOrgEx (in: hdc=0xffffffffde0109d2, x=-417, y=-278, lppt=0x26a8d38 | out: lppt=0x26a8d38) returned 1 [0061.730] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0061.730] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x1) returned 0x1b00017 [0061.731] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x2) returned 0x1900010 [0061.731] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x7) returned 0xffffffffd10509d7 [0061.731] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x6) returned 0x18a002e [0061.731] SaveDC (hdc=0xffffffffde0109d2) returned 2 [0061.731] GetNearestColor (hdc=0xffffffffde0109d2, color=0x6c4607) returned 0x6c4607 [0061.731] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd5100276 [0061.731] FillRect (hDC=0xffffffffde0109d2, lprc=0x26de08, hbr=0xffffffffd5100276) returned 1 [0061.737] DeleteObject (ho=0xffffffffd5100276) returned 1 [0061.737] RestoreDC (hdc=0xffffffffde0109d2, nSavedDC=-1) returned 1 [0061.737] RestoreDC (hdc=0xffffffffde0109d2, nSavedDC=-1) returned 1 [0061.737] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffde0109d2) returned 0x0 [0061.737] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc8c0dbd) returned 0x0 [0061.737] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0061.737] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.737] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.737] GetSystemMetrics (nIndex=42) returned 0 [0061.737] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.737] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.738] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0061.738] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0061.738] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0061.738] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0061.738] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0061.738] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0061.738] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x1) returned 0x1b00017 [0061.738] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x2) returned 0x1900010 [0061.738] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x7) returned 0xffffffffd10509d7 [0061.738] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x6) returned 0x18a002e [0061.738] SaveDC (hdc=0xffffffffde0109d2) returned 1 [0061.738] GetNearestColor (hdc=0xffffffffde0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0061.738] RestoreDC (hdc=0xffffffffde0109d2, nSavedDC=-1) returned 1 [0061.738] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffde0109d2) returned 0x0 [0061.738] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0061.738] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0061.738] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0061.738] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0061.738] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x1) returned 0x1b00017 [0061.738] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x2) returned 0x1900010 [0061.739] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x7) returned 0xffffffffd10509d7 [0061.739] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x6) returned 0x18a002e [0061.739] SaveDC (hdc=0xffffffffde0109d2) returned 1 [0061.739] GetTextAlign (hdc=0xffffffffde0109d2) returned 0x0 [0061.739] GetTextColor (hdc=0xffffffffde0109d2) returned 0x0 [0061.739] SetTextColor (hdc=0xffffffffde0109d2, color=0xf0f0f0) returned 0x0 [0061.739] GetCurrentObject (hdc=0xffffffffde0109d2, type=0x6) returned 0x18a002e [0061.739] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0061.739] SelectObject (hdc=0xffffffffde0109d2, h=0x260a09ba) returned 0x18a002e [0061.739] GetBkMode (hdc=0xffffffffde0109d2) returned 2 [0061.739] SetBkMode (hdc=0xffffffffde0109d2, mode=1) returned 2 [0061.739] DrawTextExW (in: hdc=0xffffffffde0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a99e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0061.739] DrawTextExW (in: hdc=0xffffffffde0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a99e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0061.740] RestoreDC (hdc=0xffffffffde0109d2, nSavedDC=-1) returned 1 [0061.740] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffde0109d2) returned 0x0 [0061.740] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0061.740] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffde0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0061.740] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffde0109d2) returned 0x0 [0061.740] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0061.740] SelectObject (hdc=0xffffffffde0109d2, h=0x185000f) returned 0xffffffffd10509d7 [0061.740] DeleteDC (hdc=0xffffffffde0109d2) returned 1 [0061.740] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0061.740] DeleteObject (ho=0xffffffffd10509d7) returned 1 [0061.744] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0061.744] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.744] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.744] WaitMessage () returned 1 [0061.886] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.886] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.886] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.886] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.886] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.887] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0061.887] GetCurrentThreadId () returned 0xa28 [0061.887] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0061.887] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.887] IsWindowUnicode (hWnd=0x3015e) returned 1 [0061.887] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0061.887] TranslateMessage (lpMsg=0x26ee10) returned 0 [0061.887] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0061.887] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0061.887] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0061.887] CreateCompatibleDC (hdc=0x60109d6) returned 0x100109c0 [0061.887] GetObjectType (h=0x60109d6) returned 0x3 [0061.887] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffd20509d7 [0061.887] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd20509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.887] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd20509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0061.888] DeleteObject (ho=0xffffffffd20509d7) returned 1 [0061.888] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffdf0509d2 [0061.888] SelectObject (hdc=0x100109c0, h=0xffffffffdf0509d2) returned 0x185000f [0061.888] GdipCreateFromHDC (hdc=0x100109c0, graphics=0x26e408) returned 0x0 [0061.888] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0061.888] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0061.888] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0061.888] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0061.888] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0061.888] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.888] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0061.888] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.888] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0061.888] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0061.888] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0061.888] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0061.888] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0061.889] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.889] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.889] GetSystemMetrics (nIndex=42) returned 0 [0061.889] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.889] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.889] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0061.889] IsAppThemed () returned 0x1 [0061.889] GetThemeAppProperties () returned 0x3 [0061.889] GetThemeAppProperties () returned 0x3 [0061.889] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0061.889] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0061.889] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0061.889] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0061.889] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0061.889] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.889] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.889] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.889] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0061.889] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0061.889] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0061.889] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0061.889] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0061.889] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0061.889] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0061.889] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0061.889] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0061.889] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0061.890] GetCurrentObject (hdc=0x100109c0, type=0x1) returned 0x1b00017 [0061.890] GetCurrentObject (hdc=0x100109c0, type=0x2) returned 0x1900010 [0061.890] GetCurrentObject (hdc=0x100109c0, type=0x7) returned 0xffffffffdf0509d2 [0061.890] GetCurrentObject (hdc=0x100109c0, type=0x6) returned 0x18a002e [0061.890] SaveDC (hdc=0x100109c0) returned 1 [0061.890] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3c0409f1 [0061.890] GetClipRgn (hdc=0x100109c0, hrgn=0x3c0409f1) returned 0 [0061.890] SelectClipRgn (hdc=0x100109c0, hrgn=0x630409ff) returned 2 [0061.890] DeleteObject (ho=0x3c0409f1) returned 1 [0061.890] DeleteObject (ho=0x630409ff) returned 1 [0061.890] OffsetViewportOrgEx (in: hdc=0x100109c0, x=0, y=0, lppt=0x27d0928 | out: lppt=0x27d0928) returned 1 [0061.890] OffsetViewportOrgEx (in: hdc=0x100109c0, x=-417, y=-278, lppt=0x27d0940 | out: lppt=0x27d0940) returned 1 [0061.890] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0061.890] GetCurrentObject (hdc=0x100109c0, type=0x1) returned 0x1b00017 [0061.890] GetCurrentObject (hdc=0x100109c0, type=0x2) returned 0x1900010 [0061.890] GetCurrentObject (hdc=0x100109c0, type=0x7) returned 0xffffffffdf0509d2 [0061.890] GetCurrentObject (hdc=0x100109c0, type=0x6) returned 0x18a002e [0061.890] SaveDC (hdc=0x100109c0) returned 2 [0061.890] GetNearestColor (hdc=0x100109c0, color=0x6c4607) returned 0x6c4607 [0061.890] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd6100276 [0061.890] FillRect (hDC=0x100109c0, lprc=0x26de08, hbr=0xffffffffd6100276) returned 1 [0061.897] DeleteObject (ho=0xffffffffd6100276) returned 1 [0061.897] RestoreDC (hdc=0x100109c0, nSavedDC=-1) returned 1 [0061.897] RestoreDC (hdc=0x100109c0, nSavedDC=-1) returned 1 [0061.897] GdipReleaseDC (graphics=0x1b86d040, hdc=0x100109c0) returned 0x0 [0061.897] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc8a0dbd) returned 0x0 [0061.897] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0061.897] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0061.897] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0061.897] GetSystemMetrics (nIndex=42) returned 0 [0061.897] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0061.897] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0061.897] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x0) returned 0x0 [0061.897] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0061.897] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0061.898] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0061.898] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0061.898] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0061.898] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0061.898] GetCurrentObject (hdc=0x100109c0, type=0x1) returned 0x1b00017 [0061.898] GetCurrentObject (hdc=0x100109c0, type=0x2) returned 0x1900010 [0061.898] GetCurrentObject (hdc=0x100109c0, type=0x7) returned 0xffffffffdf0509d2 [0061.898] GetCurrentObject (hdc=0x100109c0, type=0x6) returned 0x18a002e [0061.898] SaveDC (hdc=0x100109c0) returned 1 [0061.898] GetNearestColor (hdc=0x100109c0, color=0xf0f0f0) returned 0xf0f0f0 [0061.898] RestoreDC (hdc=0x100109c0, nSavedDC=-1) returned 1 [0061.898] GdipReleaseDC (graphics=0x1b86d040, hdc=0x100109c0) returned 0x0 [0061.898] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0061.898] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0061.898] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0061.899] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0061.899] GetCurrentObject (hdc=0x100109c0, type=0x1) returned 0x1b00017 [0061.899] GetCurrentObject (hdc=0x100109c0, type=0x2) returned 0x1900010 [0061.899] GetCurrentObject (hdc=0x100109c0, type=0x7) returned 0xffffffffdf0509d2 [0061.899] GetCurrentObject (hdc=0x100109c0, type=0x6) returned 0x18a002e [0061.899] SaveDC (hdc=0x100109c0) returned 1 [0061.899] GetTextAlign (hdc=0x100109c0) returned 0x0 [0061.899] GetTextColor (hdc=0x100109c0) returned 0x0 [0061.899] SetTextColor (hdc=0x100109c0, color=0xf0f0f0) returned 0x0 [0061.899] GetCurrentObject (hdc=0x100109c0, type=0x6) returned 0x18a002e [0061.899] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0061.899] SelectObject (hdc=0x100109c0, h=0x260a09ba) returned 0x18a002e [0061.899] GetBkMode (hdc=0x100109c0) returned 2 [0061.899] SetBkMode (hdc=0x100109c0, mode=1) returned 2 [0061.899] DrawTextExW (in: hdc=0x100109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27d1698 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0061.900] DrawTextExW (in: hdc=0x100109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27d1698 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0061.900] RestoreDC (hdc=0x100109c0, nSavedDC=-1) returned 1 [0061.900] GdipReleaseDC (graphics=0x1b86d040, hdc=0x100109c0) returned 0x0 [0061.900] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0061.900] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x100109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0061.901] GdipReleaseDC (graphics=0x1b86d040, hdc=0x100109c0) returned 0x0 [0061.901] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0061.901] SelectObject (hdc=0x100109c0, h=0x185000f) returned 0xffffffffdf0509d2 [0061.901] DeleteDC (hdc=0x100109c0) returned 1 [0061.901] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0061.901] DeleteObject (ho=0xffffffffdf0509d2) returned 1 [0061.904] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0061.904] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.904] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0061.904] WaitMessage () returned 1 [0062.088] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.088] IsWindowUnicode (hWnd=0x3015e) returned 1 [0062.088] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.088] TranslateMessage (lpMsg=0x26ee10) returned 0 [0062.088] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0062.088] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0062.088] GetCurrentThreadId () returned 0xa28 [0062.088] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0062.088] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.088] IsWindowUnicode (hWnd=0x3015e) returned 1 [0062.088] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.088] TranslateMessage (lpMsg=0x26ee10) returned 0 [0062.089] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0062.089] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0062.089] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0062.089] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffd40109d7 [0062.089] GetObjectType (h=0x60109d6) returned 0x3 [0062.089] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffe00509d2 [0062.089] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe00509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0062.089] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe00509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0062.089] DeleteObject (ho=0xffffffffe00509d2) returned 1 [0062.089] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x110509c0 [0062.089] SelectObject (hdc=0xffffffffd40109d7, h=0x110509c0) returned 0x185000f [0062.089] GdipCreateFromHDC (hdc=0xffffffffd40109d7, graphics=0x26e408) returned 0x0 [0062.089] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0062.089] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0062.090] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0062.090] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0062.090] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0062.090] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.090] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0062.090] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.090] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0062.090] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0062.090] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0062.090] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0062.090] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0062.090] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0062.090] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0062.090] GetSystemMetrics (nIndex=42) returned 0 [0062.090] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0062.090] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0062.090] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0062.090] IsAppThemed () returned 0x1 [0062.090] GetThemeAppProperties () returned 0x3 [0062.090] GetThemeAppProperties () returned 0x3 [0062.090] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0062.090] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0062.090] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0062.090] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0062.090] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0062.090] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.090] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0062.090] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.091] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0062.091] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.091] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0062.091] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.091] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0062.091] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0062.091] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0062.091] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0062.091] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0062.091] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0062.091] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x1) returned 0x1b00017 [0062.091] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x2) returned 0x1900010 [0062.091] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x7) returned 0x110509c0 [0062.091] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x6) returned 0x18a002e [0062.091] SaveDC (hdc=0xffffffffd40109d7) returned 1 [0062.091] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x640409ff [0062.091] GetClipRgn (hdc=0xffffffffd40109d7, hrgn=0x640409ff) returned 0 [0062.091] SelectClipRgn (hdc=0xffffffffd40109d7, hrgn=0x3f0409f1) returned 2 [0062.091] DeleteObject (ho=0x640409ff) returned 1 [0062.091] DeleteObject (ho=0x3f0409f1) returned 1 [0062.091] OffsetViewportOrgEx (in: hdc=0xffffffffd40109d7, x=0, y=0, lppt=0x274b848 | out: lppt=0x274b848) returned 1 [0062.091] OffsetViewportOrgEx (in: hdc=0xffffffffd40109d7, x=-417, y=-278, lppt=0x274b860 | out: lppt=0x274b860) returned 1 [0062.091] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0062.091] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x1) returned 0x1b00017 [0062.091] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x2) returned 0x1900010 [0062.092] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x7) returned 0x110509c0 [0062.092] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x6) returned 0x18a002e [0062.092] SaveDC (hdc=0xffffffffd40109d7) returned 2 [0062.092] GetNearestColor (hdc=0xffffffffd40109d7, color=0x6c4607) returned 0x6c4607 [0062.092] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd7100276 [0062.092] FillRect (hDC=0xffffffffd40109d7, lprc=0x26de08, hbr=0xffffffffd7100276) returned 1 [0062.098] DeleteObject (ho=0xffffffffd7100276) returned 1 [0062.098] RestoreDC (hdc=0xffffffffd40109d7, nSavedDC=-1) returned 1 [0062.098] RestoreDC (hdc=0xffffffffd40109d7, nSavedDC=-1) returned 1 [0062.098] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd40109d7) returned 0x0 [0062.098] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc880dbd) returned 0x0 [0062.098] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0062.098] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0062.098] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0062.098] GetSystemMetrics (nIndex=42) returned 0 [0062.098] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0062.098] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0062.098] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0062.098] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0062.098] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0062.099] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0062.099] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0062.099] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0062.099] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x1) returned 0x1b00017 [0062.099] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x2) returned 0x1900010 [0062.099] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x7) returned 0x110509c0 [0062.099] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x6) returned 0x18a002e [0062.099] SaveDC (hdc=0xffffffffd40109d7) returned 1 [0062.099] GetNearestColor (hdc=0xffffffffd40109d7, color=0xf0f0f0) returned 0xf0f0f0 [0062.099] RestoreDC (hdc=0xffffffffd40109d7, nSavedDC=-1) returned 1 [0062.099] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd40109d7) returned 0x0 [0062.099] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0062.099] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0062.099] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0062.099] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0062.099] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x1) returned 0x1b00017 [0062.099] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x2) returned 0x1900010 [0062.099] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x7) returned 0x110509c0 [0062.100] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x6) returned 0x18a002e [0062.100] SaveDC (hdc=0xffffffffd40109d7) returned 1 [0062.100] GetTextAlign (hdc=0xffffffffd40109d7) returned 0x0 [0062.100] GetTextColor (hdc=0xffffffffd40109d7) returned 0x0 [0062.100] SetTextColor (hdc=0xffffffffd40109d7, color=0xf0f0f0) returned 0x0 [0062.100] GetCurrentObject (hdc=0xffffffffd40109d7, type=0x6) returned 0x18a002e [0062.100] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0062.100] SelectObject (hdc=0xffffffffd40109d7, h=0x260a09ba) returned 0x18a002e [0062.100] GetBkMode (hdc=0xffffffffd40109d7) returned 2 [0062.100] SetBkMode (hdc=0xffffffffd40109d7, mode=1) returned 2 [0062.100] DrawTextExW (in: hdc=0xffffffffd40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x274c510 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0062.100] DrawTextExW (in: hdc=0xffffffffd40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x274c510 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0062.101] RestoreDC (hdc=0xffffffffd40109d7, nSavedDC=-1) returned 1 [0062.101] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd40109d7) returned 0x0 [0062.101] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0062.101] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffd40109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0062.101] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd40109d7) returned 0x0 [0062.101] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0062.101] SelectObject (hdc=0xffffffffd40109d7, h=0x185000f) returned 0x110509c0 [0062.101] DeleteDC (hdc=0xffffffffd40109d7) returned 1 [0062.101] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0062.101] DeleteObject (ho=0x110509c0) returned 1 [0062.108] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0062.108] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0062.108] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0062.108] WaitMessage () returned 1 [0062.321] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.321] IsWindowUnicode (hWnd=0x3015e) returned 1 [0062.321] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.321] TranslateMessage (lpMsg=0x26ee10) returned 0 [0062.321] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0062.321] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0062.321] GetCurrentThreadId () returned 0xa28 [0062.321] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0062.321] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.321] IsWindowUnicode (hWnd=0x3015e) returned 1 [0062.321] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.321] TranslateMessage (lpMsg=0x26ee10) returned 0 [0062.321] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0062.321] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0062.321] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0062.321] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffe20109d2 [0062.321] GetObjectType (h=0x60109d6) returned 0x3 [0062.322] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x120509c0 [0062.322] GetDIBits (in: hdc=0x60109d6, hbm=0x120509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0062.322] GetDIBits (in: hdc=0x60109d6, hbm=0x120509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0062.322] DeleteObject (ho=0x120509c0) returned 1 [0062.322] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffd50509d7 [0062.322] SelectObject (hdc=0xffffffffe20109d2, h=0xffffffffd50509d7) returned 0x185000f [0062.322] GdipCreateFromHDC (hdc=0xffffffffe20109d2, graphics=0x26e408) returned 0x0 [0062.322] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0062.322] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0062.322] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0062.322] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0062.322] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0062.322] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.322] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0062.322] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.323] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0062.323] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0062.323] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0062.323] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0062.323] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0062.323] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0062.323] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0062.323] GetSystemMetrics (nIndex=42) returned 0 [0062.323] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0062.323] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0062.323] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0062.323] IsAppThemed () returned 0x1 [0062.323] GetThemeAppProperties () returned 0x3 [0062.323] GetThemeAppProperties () returned 0x3 [0062.323] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0062.323] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0062.323] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0062.323] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0062.323] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0062.323] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.323] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0062.323] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.323] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0062.323] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.323] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0062.323] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.324] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0062.324] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0062.324] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0062.324] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0062.324] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0062.324] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0062.324] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x1) returned 0x1b00017 [0062.324] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x2) returned 0x1900010 [0062.324] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x7) returned 0xffffffffd50509d7 [0062.324] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x6) returned 0x18a002e [0062.324] SaveDC (hdc=0xffffffffe20109d2) returned 1 [0062.324] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x400409f1 [0062.324] GetClipRgn (hdc=0xffffffffe20109d2, hrgn=0x400409f1) returned 0 [0062.324] SelectClipRgn (hdc=0xffffffffe20109d2, hrgn=0x670409ff) returned 2 [0062.324] DeleteObject (ho=0x400409f1) returned 1 [0062.324] DeleteObject (ho=0x670409ff) returned 1 [0062.324] OffsetViewportOrgEx (in: hdc=0xffffffffe20109d2, x=0, y=0, lppt=0x26b70a8 | out: lppt=0x26b70a8) returned 1 [0062.324] OffsetViewportOrgEx (in: hdc=0xffffffffe20109d2, x=-417, y=-278, lppt=0x26b70c0 | out: lppt=0x26b70c0) returned 1 [0062.324] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0062.324] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x1) returned 0x1b00017 [0062.324] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x2) returned 0x1900010 [0062.324] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x7) returned 0xffffffffd50509d7 [0062.324] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x6) returned 0x18a002e [0062.324] SaveDC (hdc=0xffffffffe20109d2) returned 2 [0062.324] GetNearestColor (hdc=0xffffffffe20109d2, color=0x6c4607) returned 0x6c4607 [0062.325] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd8100276 [0062.325] FillRect (hDC=0xffffffffe20109d2, lprc=0x26de08, hbr=0xffffffffd8100276) returned 1 [0062.331] DeleteObject (ho=0xffffffffd8100276) returned 1 [0062.331] RestoreDC (hdc=0xffffffffe20109d2, nSavedDC=-1) returned 1 [0062.331] RestoreDC (hdc=0xffffffffe20109d2, nSavedDC=-1) returned 1 [0062.331] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe20109d2) returned 0x0 [0062.331] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc860dbd) returned 0x0 [0062.331] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0062.331] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0062.331] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0062.331] GetSystemMetrics (nIndex=42) returned 0 [0062.331] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0062.331] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0062.331] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2) returned 0x0 [0062.332] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0062.332] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0062.332] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0062.332] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0062.332] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0062.332] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0062.332] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x1) returned 0x1b00017 [0062.332] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x2) returned 0x1900010 [0062.332] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x7) returned 0xffffffffd50509d7 [0062.332] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x6) returned 0x18a002e [0062.332] SaveDC (hdc=0xffffffffe20109d2) returned 1 [0062.332] GetNearestColor (hdc=0xffffffffe20109d2, color=0xf0f0f0) returned 0xf0f0f0 [0062.332] RestoreDC (hdc=0xffffffffe20109d2, nSavedDC=-1) returned 1 [0062.332] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe20109d2) returned 0x0 [0062.333] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0062.333] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0062.333] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0062.333] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0062.333] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x1) returned 0x1b00017 [0062.333] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x2) returned 0x1900010 [0062.333] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x7) returned 0xffffffffd50509d7 [0062.333] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x6) returned 0x18a002e [0062.333] SaveDC (hdc=0xffffffffe20109d2) returned 1 [0062.333] GetTextAlign (hdc=0xffffffffe20109d2) returned 0x0 [0062.333] GetTextColor (hdc=0xffffffffe20109d2) returned 0x0 [0062.333] SetTextColor (hdc=0xffffffffe20109d2, color=0xf0f0f0) returned 0x0 [0062.333] GetCurrentObject (hdc=0xffffffffe20109d2, type=0x6) returned 0x18a002e [0062.333] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0062.333] SelectObject (hdc=0xffffffffe20109d2, h=0x260a09ba) returned 0x18a002e [0062.333] GetBkMode (hdc=0xffffffffe20109d2) returned 2 [0062.333] SetBkMode (hdc=0xffffffffe20109d2, mode=1) returned 2 [0062.333] DrawTextExW (in: hdc=0xffffffffe20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26b7eb0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0062.333] DrawTextExW (in: hdc=0xffffffffe20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26b7eb0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0062.334] RestoreDC (hdc=0xffffffffe20109d2, nSavedDC=-1) returned 1 [0062.334] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe20109d2) returned 0x0 [0062.334] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0062.334] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffe20109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0062.334] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe20109d2) returned 0x0 [0062.334] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0062.334] SelectObject (hdc=0xffffffffe20109d2, h=0x185000f) returned 0xffffffffd50509d7 [0062.334] DeleteDC (hdc=0xffffffffe20109d2) returned 1 [0062.334] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0062.334] DeleteObject (ho=0xffffffffd50509d7) returned 1 [0062.337] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0062.337] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0062.337] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0062.337] WaitMessage () returned 1 [0062.556] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.556] IsWindowUnicode (hWnd=0x3015e) returned 1 [0062.556] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.556] TranslateMessage (lpMsg=0x26ee10) returned 0 [0062.556] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0062.556] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0062.556] GetCurrentThreadId () returned 0xa28 [0062.556] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0062.556] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.556] IsWindowUnicode (hWnd=0x3015e) returned 1 [0062.556] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.556] TranslateMessage (lpMsg=0x26ee10) returned 0 [0062.556] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0062.556] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0062.557] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0062.557] CreateCompatibleDC (hdc=0x60109d6) returned 0x140109c0 [0062.557] GetObjectType (h=0x60109d6) returned 0x3 [0062.557] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffd60509d7 [0062.557] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd60509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0062.557] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd60509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0062.557] DeleteObject (ho=0xffffffffd60509d7) returned 1 [0062.557] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffe30509d2 [0062.557] SelectObject (hdc=0x140109c0, h=0xffffffffe30509d2) returned 0x185000f [0062.557] GdipCreateFromHDC (hdc=0x140109c0, graphics=0x26e408) returned 0x0 [0062.557] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0062.557] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0062.557] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0062.557] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0062.557] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0062.557] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.558] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0062.558] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.558] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0062.558] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0062.558] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0062.558] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0062.558] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0062.558] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0062.558] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0062.558] GetSystemMetrics (nIndex=42) returned 0 [0062.558] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0062.558] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0062.558] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0062.558] IsAppThemed () returned 0x1 [0062.558] GetThemeAppProperties () returned 0x3 [0062.558] GetThemeAppProperties () returned 0x3 [0062.558] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0062.558] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0062.558] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0062.558] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0062.558] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0062.558] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.558] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0062.558] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.558] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0062.558] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.558] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0062.558] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.558] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0062.559] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0062.559] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0062.559] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0062.559] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0062.559] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0062.559] GetCurrentObject (hdc=0x140109c0, type=0x1) returned 0x1b00017 [0062.559] GetCurrentObject (hdc=0x140109c0, type=0x2) returned 0x1900010 [0062.559] GetCurrentObject (hdc=0x140109c0, type=0x7) returned 0xffffffffe30509d2 [0062.559] GetCurrentObject (hdc=0x140109c0, type=0x6) returned 0x18a002e [0062.559] SaveDC (hdc=0x140109c0) returned 1 [0062.559] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x680409ff [0062.559] GetClipRgn (hdc=0x140109c0, hrgn=0x680409ff) returned 0 [0062.559] SelectClipRgn (hdc=0x140109c0, hrgn=0x430409f1) returned 2 [0062.559] DeleteObject (ho=0x680409ff) returned 1 [0062.559] DeleteObject (ho=0x430409f1) returned 1 [0062.559] OffsetViewportOrgEx (in: hdc=0x140109c0, x=0, y=0, lppt=0x26bca60 | out: lppt=0x26bca60) returned 1 [0062.559] OffsetViewportOrgEx (in: hdc=0x140109c0, x=-417, y=-278, lppt=0x26bca78 | out: lppt=0x26bca78) returned 1 [0062.559] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0062.559] GetCurrentObject (hdc=0x140109c0, type=0x1) returned 0x1b00017 [0062.559] GetCurrentObject (hdc=0x140109c0, type=0x2) returned 0x1900010 [0062.559] GetCurrentObject (hdc=0x140109c0, type=0x7) returned 0xffffffffe30509d2 [0062.559] GetCurrentObject (hdc=0x140109c0, type=0x6) returned 0x18a002e [0062.559] SaveDC (hdc=0x140109c0) returned 2 [0062.559] GetNearestColor (hdc=0x140109c0, color=0x6c4607) returned 0x6c4607 [0062.559] CreateSolidBrush (color=0x6c4607) returned 0xffffffffd9100276 [0062.559] FillRect (hDC=0x140109c0, lprc=0x26de08, hbr=0xffffffffd9100276) returned 1 [0062.566] DeleteObject (ho=0xffffffffd9100276) returned 1 [0062.566] RestoreDC (hdc=0x140109c0, nSavedDC=-1) returned 1 [0062.566] RestoreDC (hdc=0x140109c0, nSavedDC=-1) returned 1 [0062.566] GdipReleaseDC (graphics=0x1b86d040, hdc=0x140109c0) returned 0x0 [0062.566] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc840dbd) returned 0x0 [0062.566] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0062.566] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0062.566] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0062.566] GetSystemMetrics (nIndex=42) returned 0 [0062.566] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0062.566] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0062.566] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0062.566] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0062.566] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0062.566] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0062.566] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0062.566] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0062.566] GetCurrentObject (hdc=0x140109c0, type=0x1) returned 0x1b00017 [0062.566] GetCurrentObject (hdc=0x140109c0, type=0x2) returned 0x1900010 [0062.566] GetCurrentObject (hdc=0x140109c0, type=0x7) returned 0xffffffffe30509d2 [0062.566] GetCurrentObject (hdc=0x140109c0, type=0x6) returned 0x18a002e [0062.566] SaveDC (hdc=0x140109c0) returned 1 [0062.566] GetNearestColor (hdc=0x140109c0, color=0xf0f0f0) returned 0xf0f0f0 [0062.566] RestoreDC (hdc=0x140109c0, nSavedDC=-1) returned 1 [0062.566] GdipReleaseDC (graphics=0x1b86d040, hdc=0x140109c0) returned 0x0 [0062.567] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0062.567] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0062.567] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0062.567] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0062.567] GetCurrentObject (hdc=0x140109c0, type=0x1) returned 0x1b00017 [0062.567] GetCurrentObject (hdc=0x140109c0, type=0x2) returned 0x1900010 [0062.567] GetCurrentObject (hdc=0x140109c0, type=0x7) returned 0xffffffffe30509d2 [0062.567] GetCurrentObject (hdc=0x140109c0, type=0x6) returned 0x18a002e [0062.567] SaveDC (hdc=0x140109c0) returned 1 [0062.567] GetTextAlign (hdc=0x140109c0) returned 0x0 [0062.567] GetTextColor (hdc=0x140109c0) returned 0x0 [0062.567] SetTextColor (hdc=0x140109c0, color=0xf0f0f0) returned 0x0 [0062.567] GetCurrentObject (hdc=0x140109c0, type=0x6) returned 0x18a002e [0062.567] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0062.567] SelectObject (hdc=0x140109c0, h=0x260a09ba) returned 0x18a002e [0062.567] GetBkMode (hdc=0x140109c0) returned 2 [0062.567] SetBkMode (hdc=0x140109c0, mode=1) returned 2 [0062.567] DrawTextExW (in: hdc=0x140109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26bd728 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0062.567] DrawTextExW (in: hdc=0x140109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26bd728 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0062.568] RestoreDC (hdc=0x140109c0, nSavedDC=-1) returned 1 [0062.568] GdipReleaseDC (graphics=0x1b86d040, hdc=0x140109c0) returned 0x0 [0062.568] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0062.568] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x140109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0062.568] GdipReleaseDC (graphics=0x1b86d040, hdc=0x140109c0) returned 0x0 [0062.568] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0062.568] SelectObject (hdc=0x140109c0, h=0x185000f) returned 0xffffffffe30509d2 [0062.568] DeleteDC (hdc=0x140109c0) returned 1 [0062.568] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0062.568] DeleteObject (ho=0xffffffffe30509d2) returned 1 [0062.575] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0062.576] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0062.576] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0062.576] WaitMessage () returned 1 [0062.868] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.869] IsWindowUnicode (hWnd=0x3015e) returned 1 [0062.869] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.869] TranslateMessage (lpMsg=0x26ee10) returned 0 [0062.869] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0062.869] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0062.869] GetCurrentThreadId () returned 0xa28 [0062.869] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0062.869] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.869] IsWindowUnicode (hWnd=0x3015e) returned 1 [0062.869] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0062.869] TranslateMessage (lpMsg=0x26ee10) returned 0 [0062.869] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0062.869] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0062.869] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0062.869] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffd80109d7 [0062.869] GetObjectType (h=0x60109d6) returned 0x3 [0062.869] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffe40509d2 [0062.869] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe40509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0062.869] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe40509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0062.869] DeleteObject (ho=0xffffffffe40509d2) returned 1 [0062.869] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x150509c0 [0062.870] SelectObject (hdc=0xffffffffd80109d7, h=0x150509c0) returned 0x185000f [0062.870] GdipCreateFromHDC (hdc=0xffffffffd80109d7, graphics=0x26e408) returned 0x0 [0062.870] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0062.870] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0062.870] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0062.870] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0062.870] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0062.870] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.870] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0062.870] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.870] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0062.870] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0062.870] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0062.870] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0062.870] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0062.870] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0062.870] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0062.870] GetSystemMetrics (nIndex=42) returned 0 [0062.870] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0062.870] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0062.870] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0062.870] IsAppThemed () returned 0x1 [0062.870] GetThemeAppProperties () returned 0x3 [0062.870] GetThemeAppProperties () returned 0x3 [0062.871] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0062.871] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0062.871] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0062.871] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0062.871] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0062.871] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.871] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0062.871] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.871] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0062.871] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0062.871] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0062.871] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0062.871] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0062.871] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0062.871] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0062.871] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0062.871] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0062.871] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0062.871] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x1) returned 0x1b00017 [0062.871] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x2) returned 0x1900010 [0062.871] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x7) returned 0x150509c0 [0062.871] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x6) returned 0x18a002e [0062.871] SaveDC (hdc=0xffffffffd80109d7) returned 1 [0062.871] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x440409f1 [0062.871] GetClipRgn (hdc=0xffffffffd80109d7, hrgn=0x440409f1) returned 0 [0062.871] SelectClipRgn (hdc=0xffffffffd80109d7, hrgn=0x6b0409ff) returned 2 [0062.871] DeleteObject (ho=0x440409f1) returned 1 [0062.871] DeleteObject (ho=0x6b0409ff) returned 1 [0062.871] OffsetViewportOrgEx (in: hdc=0xffffffffd80109d7, x=0, y=0, lppt=0x26bf048 | out: lppt=0x26bf048) returned 1 [0062.871] OffsetViewportOrgEx (in: hdc=0xffffffffd80109d7, x=-417, y=-278, lppt=0x26bf060 | out: lppt=0x26bf060) returned 1 [0062.872] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0062.872] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x1) returned 0x1b00017 [0062.872] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x2) returned 0x1900010 [0062.872] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x7) returned 0x150509c0 [0062.872] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x6) returned 0x18a002e [0062.872] SaveDC (hdc=0xffffffffd80109d7) returned 2 [0062.872] GetNearestColor (hdc=0xffffffffd80109d7, color=0x6c4607) returned 0x6c4607 [0062.872] CreateSolidBrush (color=0x6c4607) returned 0xffffffffda100276 [0062.872] FillRect (hDC=0xffffffffd80109d7, lprc=0x26de08, hbr=0xffffffffda100276) returned 1 [0062.878] DeleteObject (ho=0xffffffffda100276) returned 1 [0062.878] RestoreDC (hdc=0xffffffffd80109d7, nSavedDC=-1) returned 1 [0062.878] RestoreDC (hdc=0xffffffffd80109d7, nSavedDC=-1) returned 1 [0062.878] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd80109d7) returned 0x0 [0062.878] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc820dbd) returned 0x0 [0062.878] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0062.878] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0062.878] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0062.878] GetSystemMetrics (nIndex=42) returned 0 [0062.878] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0062.878] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0062.878] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x4) returned 0x0 [0062.879] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0062.879] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0062.879] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0062.879] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0062.879] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0062.879] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0062.879] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x1) returned 0x1b00017 [0062.879] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x2) returned 0x1900010 [0062.879] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x7) returned 0x150509c0 [0062.879] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x6) returned 0x18a002e [0062.879] SaveDC (hdc=0xffffffffd80109d7) returned 1 [0062.879] GetNearestColor (hdc=0xffffffffd80109d7, color=0xf0f0f0) returned 0xf0f0f0 [0062.879] RestoreDC (hdc=0xffffffffd80109d7, nSavedDC=-1) returned 1 [0062.879] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd80109d7) returned 0x0 [0062.880] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0062.880] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0062.880] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0062.880] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0062.880] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x1) returned 0x1b00017 [0062.880] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x2) returned 0x1900010 [0062.880] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x7) returned 0x150509c0 [0062.880] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x6) returned 0x18a002e [0062.880] SaveDC (hdc=0xffffffffd80109d7) returned 1 [0062.880] GetTextAlign (hdc=0xffffffffd80109d7) returned 0x0 [0062.880] GetTextColor (hdc=0xffffffffd80109d7) returned 0x0 [0062.880] SetTextColor (hdc=0xffffffffd80109d7, color=0xf0f0f0) returned 0x0 [0062.880] GetCurrentObject (hdc=0xffffffffd80109d7, type=0x6) returned 0x18a002e [0062.880] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0062.880] SelectObject (hdc=0xffffffffd80109d7, h=0x260a09ba) returned 0x18a002e [0062.880] GetBkMode (hdc=0xffffffffd80109d7) returned 2 [0062.880] SetBkMode (hdc=0xffffffffd80109d7, mode=1) returned 2 [0062.880] DrawTextExW (in: hdc=0xffffffffd80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26bfe88 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0062.881] DrawTextExW (in: hdc=0xffffffffd80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26bfe88 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0062.881] RestoreDC (hdc=0xffffffffd80109d7, nSavedDC=-1) returned 1 [0062.881] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd80109d7) returned 0x0 [0062.881] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0062.881] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffd80109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0062.882] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffd80109d7) returned 0x0 [0062.882] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0062.882] SelectObject (hdc=0xffffffffd80109d7, h=0x185000f) returned 0x150509c0 [0062.882] DeleteDC (hdc=0xffffffffd80109d7) returned 1 [0062.882] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0062.882] DeleteObject (ho=0x150509c0) returned 1 [0062.885] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0062.886] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0062.886] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0062.886] WaitMessage () returned 1 [0063.053] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.053] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.053] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.053] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.053] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.053] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0063.053] GetCurrentThreadId () returned 0xa28 [0063.053] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0063.053] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.054] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.054] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.054] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.054] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.054] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0063.054] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0063.054] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffe60109d2 [0063.054] GetObjectType (h=0x60109d6) returned 0x3 [0063.054] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x160509c0 [0063.054] GetDIBits (in: hdc=0x60109d6, hbm=0x160509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.054] GetDIBits (in: hdc=0x60109d6, hbm=0x160509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.054] DeleteObject (ho=0x160509c0) returned 1 [0063.054] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffd90509d7 [0063.054] SelectObject (hdc=0xffffffffe60109d2, h=0xffffffffd90509d7) returned 0x185000f [0063.054] GdipCreateFromHDC (hdc=0xffffffffe60109d2, graphics=0x26e408) returned 0x0 [0063.054] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0063.055] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0063.055] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0063.055] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0063.055] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0063.055] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.055] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0063.055] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.055] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0063.055] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0063.055] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0063.055] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0063.055] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0063.055] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.055] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.055] GetSystemMetrics (nIndex=42) returned 0 [0063.055] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.055] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.055] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0063.055] IsAppThemed () returned 0x1 [0063.055] GetThemeAppProperties () returned 0x3 [0063.055] GetThemeAppProperties () returned 0x3 [0063.055] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0063.055] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0063.055] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0063.055] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0063.055] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0063.055] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.055] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.055] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.055] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0063.056] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.056] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.056] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.056] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0063.056] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0063.056] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0063.056] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0063.056] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0063.056] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0063.056] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x1) returned 0x1b00017 [0063.056] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x2) returned 0x1900010 [0063.056] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x7) returned 0xffffffffd90509d7 [0063.056] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x6) returned 0x18a002e [0063.056] SaveDC (hdc=0xffffffffe60109d2) returned 1 [0063.056] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6c0409ff [0063.056] GetClipRgn (hdc=0xffffffffe60109d2, hrgn=0x6c0409ff) returned 0 [0063.056] SelectClipRgn (hdc=0xffffffffe60109d2, hrgn=0x470409f1) returned 2 [0063.056] DeleteObject (ho=0x6c0409ff) returned 1 [0063.056] DeleteObject (ho=0x470409f1) returned 1 [0063.056] OffsetViewportOrgEx (in: hdc=0xffffffffe60109d2, x=0, y=0, lppt=0x267cf80 | out: lppt=0x267cf80) returned 1 [0063.056] OffsetViewportOrgEx (in: hdc=0xffffffffe60109d2, x=-417, y=-278, lppt=0x267cf98 | out: lppt=0x267cf98) returned 1 [0063.056] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0063.056] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x1) returned 0x1b00017 [0063.056] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x2) returned 0x1900010 [0063.056] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x7) returned 0xffffffffd90509d7 [0063.056] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x6) returned 0x18a002e [0063.056] SaveDC (hdc=0xffffffffe60109d2) returned 2 [0063.056] GetNearestColor (hdc=0xffffffffe60109d2, color=0x6c4607) returned 0x6c4607 [0063.056] CreateSolidBrush (color=0x6c4607) returned 0xffffffffdb100276 [0063.057] FillRect (hDC=0xffffffffe60109d2, lprc=0x26de08, hbr=0xffffffffdb100276) returned 1 [0063.063] DeleteObject (ho=0xffffffffdb100276) returned 1 [0063.063] RestoreDC (hdc=0xffffffffe60109d2, nSavedDC=-1) returned 1 [0063.063] RestoreDC (hdc=0xffffffffe60109d2, nSavedDC=-1) returned 1 [0063.063] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe60109d2) returned 0x0 [0063.063] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc800dbd) returned 0x0 [0063.063] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0063.063] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.063] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.063] GetSystemMetrics (nIndex=42) returned 0 [0063.063] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.063] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.063] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0063.063] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0063.063] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0063.063] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0063.063] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0063.063] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0063.063] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x1) returned 0x1b00017 [0063.063] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x2) returned 0x1900010 [0063.063] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x7) returned 0xffffffffd90509d7 [0063.063] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x6) returned 0x18a002e [0063.063] SaveDC (hdc=0xffffffffe60109d2) returned 1 [0063.064] GetNearestColor (hdc=0xffffffffe60109d2, color=0xf0f0f0) returned 0xf0f0f0 [0063.064] RestoreDC (hdc=0xffffffffe60109d2, nSavedDC=-1) returned 1 [0063.064] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe60109d2) returned 0x0 [0063.064] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0063.064] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0063.064] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0063.064] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x1) returned 0x1b00017 [0063.064] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x2) returned 0x1900010 [0063.064] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x7) returned 0xffffffffd90509d7 [0063.064] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x6) returned 0x18a002e [0063.064] SaveDC (hdc=0xffffffffe60109d2) returned 1 [0063.064] GetTextAlign (hdc=0xffffffffe60109d2) returned 0x0 [0063.064] GetTextColor (hdc=0xffffffffe60109d2) returned 0x0 [0063.064] SetTextColor (hdc=0xffffffffe60109d2, color=0xf0f0f0) returned 0x0 [0063.064] GetCurrentObject (hdc=0xffffffffe60109d2, type=0x6) returned 0x18a002e [0063.064] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0063.064] SelectObject (hdc=0xffffffffe60109d2, h=0x260a09ba) returned 0x18a002e [0063.064] GetBkMode (hdc=0xffffffffe60109d2) returned 2 [0063.064] SetBkMode (hdc=0xffffffffe60109d2, mode=1) returned 2 [0063.064] DrawTextExW (in: hdc=0xffffffffe60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x267dc48 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0063.065] DrawTextExW (in: hdc=0xffffffffe60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x267dc48 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0063.065] RestoreDC (hdc=0xffffffffe60109d2, nSavedDC=-1) returned 1 [0063.065] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe60109d2) returned 0x0 [0063.065] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0063.065] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffe60109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0063.065] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe60109d2) returned 0x0 [0063.065] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0063.065] SelectObject (hdc=0xffffffffe60109d2, h=0x185000f) returned 0xffffffffd90509d7 [0063.065] DeleteDC (hdc=0xffffffffe60109d2) returned 1 [0063.065] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0063.066] DeleteObject (ho=0xffffffffd90509d7) returned 1 [0063.077] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0063.077] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.077] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.077] WaitMessage () returned 1 [0063.225] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.225] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.225] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.225] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.225] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.225] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0063.225] GetCurrentThreadId () returned 0xa28 [0063.225] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0063.225] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.225] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.225] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.225] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.225] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.225] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0063.226] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0063.226] CreateCompatibleDC (hdc=0x60109d6) returned 0x180109c0 [0063.226] GetObjectType (h=0x60109d6) returned 0x3 [0063.226] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffda0509d7 [0063.226] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffda0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.226] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffda0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.226] DeleteObject (ho=0xffffffffda0509d7) returned 1 [0063.226] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffe70509d2 [0063.226] SelectObject (hdc=0x180109c0, h=0xffffffffe70509d2) returned 0x185000f [0063.226] GdipCreateFromHDC (hdc=0x180109c0, graphics=0x26e408) returned 0x0 [0063.226] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0063.226] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0063.226] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0063.226] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0063.226] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0063.226] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.226] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0063.227] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.227] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0063.227] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0063.227] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0063.227] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0063.227] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0063.227] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.227] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.227] GetSystemMetrics (nIndex=42) returned 0 [0063.227] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.227] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.227] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0063.227] IsAppThemed () returned 0x1 [0063.227] GetThemeAppProperties () returned 0x3 [0063.227] GetThemeAppProperties () returned 0x3 [0063.227] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0063.227] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0063.227] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0063.227] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0063.227] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0063.227] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.227] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.227] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.227] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0063.227] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.227] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.227] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.227] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0063.227] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0063.227] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0063.227] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0063.228] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0063.228] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0063.228] GetCurrentObject (hdc=0x180109c0, type=0x1) returned 0x1b00017 [0063.228] GetCurrentObject (hdc=0x180109c0, type=0x2) returned 0x1900010 [0063.228] GetCurrentObject (hdc=0x180109c0, type=0x7) returned 0xffffffffe70509d2 [0063.228] GetCurrentObject (hdc=0x180109c0, type=0x6) returned 0x18a002e [0063.228] SaveDC (hdc=0x180109c0) returned 1 [0063.228] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x480409f1 [0063.228] GetClipRgn (hdc=0x180109c0, hrgn=0x480409f1) returned 0 [0063.228] SelectClipRgn (hdc=0x180109c0, hrgn=0x6f0409ff) returned 2 [0063.228] DeleteObject (ho=0x480409f1) returned 1 [0063.228] DeleteObject (ho=0x6f0409ff) returned 1 [0063.228] OffsetViewportOrgEx (in: hdc=0x180109c0, x=0, y=0, lppt=0x27111c8 | out: lppt=0x27111c8) returned 1 [0063.228] OffsetViewportOrgEx (in: hdc=0x180109c0, x=-417, y=-278, lppt=0x27111e0 | out: lppt=0x27111e0) returned 1 [0063.228] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0063.228] GetCurrentObject (hdc=0x180109c0, type=0x1) returned 0x1b00017 [0063.228] GetCurrentObject (hdc=0x180109c0, type=0x2) returned 0x1900010 [0063.228] GetCurrentObject (hdc=0x180109c0, type=0x7) returned 0xffffffffe70509d2 [0063.228] GetCurrentObject (hdc=0x180109c0, type=0x6) returned 0x18a002e [0063.228] SaveDC (hdc=0x180109c0) returned 2 [0063.228] GetNearestColor (hdc=0x180109c0, color=0x6c4607) returned 0x6c4607 [0063.228] CreateSolidBrush (color=0x6c4607) returned 0xffffffffdc100276 [0063.228] FillRect (hDC=0x180109c0, lprc=0x26de08, hbr=0xffffffffdc100276) returned 1 [0063.234] DeleteObject (ho=0xffffffffdc100276) returned 1 [0063.234] RestoreDC (hdc=0x180109c0, nSavedDC=-1) returned 1 [0063.234] RestoreDC (hdc=0x180109c0, nSavedDC=-1) returned 1 [0063.234] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109c0) returned 0x0 [0063.235] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc7e0dbd) returned 0x0 [0063.235] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0063.235] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.235] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.235] GetSystemMetrics (nIndex=42) returned 0 [0063.235] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.235] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.235] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x6) returned 0x0 [0063.235] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0063.235] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0063.236] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0063.236] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0063.236] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0063.236] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0063.236] GetCurrentObject (hdc=0x180109c0, type=0x1) returned 0x1b00017 [0063.236] GetCurrentObject (hdc=0x180109c0, type=0x2) returned 0x1900010 [0063.236] GetCurrentObject (hdc=0x180109c0, type=0x7) returned 0xffffffffe70509d2 [0063.236] GetCurrentObject (hdc=0x180109c0, type=0x6) returned 0x18a002e [0063.236] SaveDC (hdc=0x180109c0) returned 1 [0063.236] GetNearestColor (hdc=0x180109c0, color=0xf0f0f0) returned 0xf0f0f0 [0063.236] RestoreDC (hdc=0x180109c0, nSavedDC=-1) returned 1 [0063.236] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109c0) returned 0x0 [0063.236] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0063.236] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0063.236] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0063.236] GetCurrentObject (hdc=0x180109c0, type=0x1) returned 0x1b00017 [0063.236] GetCurrentObject (hdc=0x180109c0, type=0x2) returned 0x1900010 [0063.236] GetCurrentObject (hdc=0x180109c0, type=0x7) returned 0xffffffffe70509d2 [0063.236] GetCurrentObject (hdc=0x180109c0, type=0x6) returned 0x18a002e [0063.236] SaveDC (hdc=0x180109c0) returned 1 [0063.237] GetTextAlign (hdc=0x180109c0) returned 0x0 [0063.237] GetTextColor (hdc=0x180109c0) returned 0x0 [0063.237] SetTextColor (hdc=0x180109c0, color=0xf0f0f0) returned 0x0 [0063.237] GetCurrentObject (hdc=0x180109c0, type=0x6) returned 0x18a002e [0063.237] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0063.237] SelectObject (hdc=0x180109c0, h=0x260a09ba) returned 0x18a002e [0063.237] GetBkMode (hdc=0x180109c0) returned 2 [0063.237] SetBkMode (hdc=0x180109c0, mode=1) returned 2 [0063.237] DrawTextExW (in: hdc=0x180109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2712018 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0063.237] DrawTextExW (in: hdc=0x180109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2712018 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0063.237] RestoreDC (hdc=0x180109c0, nSavedDC=-1) returned 1 [0063.237] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109c0) returned 0x0 [0063.237] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0063.238] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x180109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0063.238] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109c0) returned 0x0 [0063.238] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0063.238] SelectObject (hdc=0x180109c0, h=0x185000f) returned 0xffffffffe70509d2 [0063.238] DeleteDC (hdc=0x180109c0) returned 1 [0063.238] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0063.238] DeleteObject (ho=0xffffffffe70509d2) returned 1 [0063.241] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0063.241] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.241] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.241] WaitMessage () returned 1 [0063.428] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.428] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.428] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.428] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.428] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.428] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0063.428] GetCurrentThreadId () returned 0xa28 [0063.428] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0063.428] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.428] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.428] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.428] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.428] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.429] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0063.429] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0063.429] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffdc0109d7 [0063.429] GetObjectType (h=0x60109d6) returned 0x3 [0063.429] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffe80509d2 [0063.429] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe80509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.429] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe80509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.429] DeleteObject (ho=0xffffffffe80509d2) returned 1 [0063.429] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x190509c0 [0063.429] SelectObject (hdc=0xffffffffdc0109d7, h=0x190509c0) returned 0x185000f [0063.429] GdipCreateFromHDC (hdc=0xffffffffdc0109d7, graphics=0x26e408) returned 0x0 [0063.429] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0063.429] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0063.429] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0063.430] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0063.430] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0063.430] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.430] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0063.430] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.430] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0063.430] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0063.430] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0063.430] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0063.430] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0063.430] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.430] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.430] GetSystemMetrics (nIndex=42) returned 0 [0063.430] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.430] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.430] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0063.430] IsAppThemed () returned 0x1 [0063.430] GetThemeAppProperties () returned 0x3 [0063.430] GetThemeAppProperties () returned 0x3 [0063.430] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0063.430] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0063.430] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0063.430] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0063.430] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0063.430] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.430] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.430] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.430] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0063.430] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.431] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.431] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.431] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0063.431] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0063.431] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0063.431] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0063.431] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0063.431] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0063.431] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x1) returned 0x1b00017 [0063.431] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x2) returned 0x1900010 [0063.431] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x7) returned 0x190509c0 [0063.431] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x6) returned 0x18a002e [0063.431] SaveDC (hdc=0xffffffffdc0109d7) returned 1 [0063.431] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x700409ff [0063.431] GetClipRgn (hdc=0xffffffffdc0109d7, hrgn=0x700409ff) returned 0 [0063.431] SelectClipRgn (hdc=0xffffffffdc0109d7, hrgn=0x4b0409f1) returned 2 [0063.431] DeleteObject (ho=0x700409ff) returned 1 [0063.431] DeleteObject (ho=0x4b0409f1) returned 1 [0063.431] OffsetViewportOrgEx (in: hdc=0xffffffffdc0109d7, x=0, y=0, lppt=0x26a6b88 | out: lppt=0x26a6b88) returned 1 [0063.431] OffsetViewportOrgEx (in: hdc=0xffffffffdc0109d7, x=-417, y=-278, lppt=0x26a6ba0 | out: lppt=0x26a6ba0) returned 1 [0063.431] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0063.431] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x1) returned 0x1b00017 [0063.431] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x2) returned 0x1900010 [0063.431] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x7) returned 0x190509c0 [0063.431] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x6) returned 0x18a002e [0063.431] SaveDC (hdc=0xffffffffdc0109d7) returned 2 [0063.431] GetNearestColor (hdc=0xffffffffdc0109d7, color=0x6c4607) returned 0x6c4607 [0063.432] CreateSolidBrush (color=0x6c4607) returned 0xffffffffdd100276 [0063.432] FillRect (hDC=0xffffffffdc0109d7, lprc=0x26de08, hbr=0xffffffffdd100276) returned 1 [0063.438] DeleteObject (ho=0xffffffffdd100276) returned 1 [0063.438] RestoreDC (hdc=0xffffffffdc0109d7, nSavedDC=-1) returned 1 [0063.438] RestoreDC (hdc=0xffffffffdc0109d7, nSavedDC=-1) returned 1 [0063.438] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffdc0109d7) returned 0x0 [0063.438] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc7c0dbd) returned 0x0 [0063.438] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0063.438] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.438] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.438] GetSystemMetrics (nIndex=42) returned 0 [0063.438] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.438] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.438] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0063.438] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0063.438] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0063.438] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0063.438] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0063.438] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0063.438] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x1) returned 0x1b00017 [0063.438] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x2) returned 0x1900010 [0063.438] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x7) returned 0x190509c0 [0063.438] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x6) returned 0x18a002e [0063.438] SaveDC (hdc=0xffffffffdc0109d7) returned 1 [0063.439] GetNearestColor (hdc=0xffffffffdc0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0063.439] RestoreDC (hdc=0xffffffffdc0109d7, nSavedDC=-1) returned 1 [0063.439] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffdc0109d7) returned 0x0 [0063.439] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0063.439] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0063.439] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0063.439] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0063.439] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x1) returned 0x1b00017 [0063.439] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x2) returned 0x1900010 [0063.439] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x7) returned 0x190509c0 [0063.439] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x6) returned 0x18a002e [0063.439] SaveDC (hdc=0xffffffffdc0109d7) returned 1 [0063.439] GetTextAlign (hdc=0xffffffffdc0109d7) returned 0x0 [0063.439] GetTextColor (hdc=0xffffffffdc0109d7) returned 0x0 [0063.439] SetTextColor (hdc=0xffffffffdc0109d7, color=0xf0f0f0) returned 0x0 [0063.439] GetCurrentObject (hdc=0xffffffffdc0109d7, type=0x6) returned 0x18a002e [0063.439] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0063.439] SelectObject (hdc=0xffffffffdc0109d7, h=0x260a09ba) returned 0x18a002e [0063.439] GetBkMode (hdc=0xffffffffdc0109d7) returned 2 [0063.440] SetBkMode (hdc=0xffffffffdc0109d7, mode=1) returned 2 [0063.440] DrawTextExW (in: hdc=0xffffffffdc0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a7850 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0063.440] DrawTextExW (in: hdc=0xffffffffdc0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a7850 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0063.440] RestoreDC (hdc=0xffffffffdc0109d7, nSavedDC=-1) returned 1 [0063.440] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffdc0109d7) returned 0x0 [0063.440] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0063.440] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffdc0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0063.440] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffdc0109d7) returned 0x0 [0063.440] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0063.441] SelectObject (hdc=0xffffffffdc0109d7, h=0x185000f) returned 0x190509c0 [0063.441] DeleteDC (hdc=0xffffffffdc0109d7) returned 1 [0063.441] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0063.441] DeleteObject (ho=0x190509c0) returned 1 [0063.447] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0063.447] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.448] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.448] WaitMessage () returned 1 [0063.584] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.584] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.584] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.584] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.584] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.585] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0063.585] GetCurrentThreadId () returned 0xa28 [0063.585] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0063.585] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.585] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.585] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.585] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.585] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.585] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0063.585] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0063.585] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffea0109d2 [0063.585] GetObjectType (h=0x60109d6) returned 0x3 [0063.585] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x1a0509c0 [0063.585] GetDIBits (in: hdc=0x60109d6, hbm=0x1a0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.585] GetDIBits (in: hdc=0x60109d6, hbm=0x1a0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.585] DeleteObject (ho=0x1a0509c0) returned 1 [0063.585] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffdd0509d7 [0063.585] SelectObject (hdc=0xffffffffea0109d2, h=0xffffffffdd0509d7) returned 0x185000f [0063.585] GdipCreateFromHDC (hdc=0xffffffffea0109d2, graphics=0x26e408) returned 0x0 [0063.586] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0063.586] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0063.586] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0063.586] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0063.586] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0063.586] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.586] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0063.586] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.586] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0063.586] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0063.586] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0063.586] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0063.586] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0063.586] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.586] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.586] GetSystemMetrics (nIndex=42) returned 0 [0063.586] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.586] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.586] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0063.586] IsAppThemed () returned 0x1 [0063.586] GetThemeAppProperties () returned 0x3 [0063.586] GetThemeAppProperties () returned 0x3 [0063.586] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0063.586] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0063.586] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0063.586] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0063.586] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0063.586] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.586] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.586] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.586] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0063.587] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.587] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.587] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.587] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0063.587] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0063.587] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0063.587] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0063.587] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0063.587] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0063.587] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x1) returned 0x1b00017 [0063.587] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x2) returned 0x1900010 [0063.587] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x7) returned 0xffffffffdd0509d7 [0063.587] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x6) returned 0x18a002e [0063.587] SaveDC (hdc=0xffffffffea0109d2) returned 1 [0063.587] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4c0409f1 [0063.587] GetClipRgn (hdc=0xffffffffea0109d2, hrgn=0x4c0409f1) returned 0 [0063.587] SelectClipRgn (hdc=0xffffffffea0109d2, hrgn=0x730409ff) returned 2 [0063.587] DeleteObject (ho=0x4c0409f1) returned 1 [0063.587] DeleteObject (ho=0x730409ff) returned 1 [0063.587] OffsetViewportOrgEx (in: hdc=0xffffffffea0109d2, x=0, y=0, lppt=0x2708ed0 | out: lppt=0x2708ed0) returned 1 [0063.587] OffsetViewportOrgEx (in: hdc=0xffffffffea0109d2, x=-417, y=-278, lppt=0x2708ee8 | out: lppt=0x2708ee8) returned 1 [0063.587] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0063.587] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x1) returned 0x1b00017 [0063.587] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x2) returned 0x1900010 [0063.587] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x7) returned 0xffffffffdd0509d7 [0063.587] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x6) returned 0x18a002e [0063.587] SaveDC (hdc=0xffffffffea0109d2) returned 2 [0063.588] GetNearestColor (hdc=0xffffffffea0109d2, color=0x6c4607) returned 0x6c4607 [0063.588] CreateSolidBrush (color=0x6c4607) returned 0xffffffffde100276 [0063.588] FillRect (hDC=0xffffffffea0109d2, lprc=0x26de08, hbr=0xffffffffde100276) returned 1 [0063.594] DeleteObject (ho=0xffffffffde100276) returned 1 [0063.594] RestoreDC (hdc=0xffffffffea0109d2, nSavedDC=-1) returned 1 [0063.594] RestoreDC (hdc=0xffffffffea0109d2, nSavedDC=-1) returned 1 [0063.594] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffea0109d2) returned 0x0 [0063.594] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc7a0dbd) returned 0x0 [0063.594] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0063.594] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.594] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.594] GetSystemMetrics (nIndex=42) returned 0 [0063.594] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.594] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.594] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x8) returned 0x0 [0063.595] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0063.595] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0063.595] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0063.595] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0063.595] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0063.595] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0063.595] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x1) returned 0x1b00017 [0063.595] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x2) returned 0x1900010 [0063.595] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x7) returned 0xffffffffdd0509d7 [0063.595] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x6) returned 0x18a002e [0063.595] SaveDC (hdc=0xffffffffea0109d2) returned 1 [0063.595] GetNearestColor (hdc=0xffffffffea0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0063.595] RestoreDC (hdc=0xffffffffea0109d2, nSavedDC=-1) returned 1 [0063.595] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffea0109d2) returned 0x0 [0063.596] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0063.596] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0063.596] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0063.596] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x1) returned 0x1b00017 [0063.596] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x2) returned 0x1900010 [0063.596] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x7) returned 0xffffffffdd0509d7 [0063.596] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x6) returned 0x18a002e [0063.596] SaveDC (hdc=0xffffffffea0109d2) returned 1 [0063.596] GetTextAlign (hdc=0xffffffffea0109d2) returned 0x0 [0063.596] GetTextColor (hdc=0xffffffffea0109d2) returned 0x0 [0063.596] SetTextColor (hdc=0xffffffffea0109d2, color=0xf0f0f0) returned 0x0 [0063.596] GetCurrentObject (hdc=0xffffffffea0109d2, type=0x6) returned 0x18a002e [0063.596] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0063.596] SelectObject (hdc=0xffffffffea0109d2, h=0x260a09ba) returned 0x18a002e [0063.596] GetBkMode (hdc=0xffffffffea0109d2) returned 2 [0063.596] SetBkMode (hdc=0xffffffffea0109d2, mode=1) returned 2 [0063.596] DrawTextExW (in: hdc=0xffffffffea0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2709d38 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0063.596] DrawTextExW (in: hdc=0xffffffffea0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2709d38 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0063.597] RestoreDC (hdc=0xffffffffea0109d2, nSavedDC=-1) returned 1 [0063.597] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffea0109d2) returned 0x0 [0063.597] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0063.597] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffea0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0063.597] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffea0109d2) returned 0x0 [0063.597] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0063.597] SelectObject (hdc=0xffffffffea0109d2, h=0x185000f) returned 0xffffffffdd0509d7 [0063.597] DeleteDC (hdc=0xffffffffea0109d2) returned 1 [0063.597] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0063.597] DeleteObject (ho=0xffffffffdd0509d7) returned 1 [0063.601] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0063.601] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.601] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.601] WaitMessage () returned 1 [0063.802] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.802] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.802] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.802] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.802] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.802] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0063.802] GetCurrentThreadId () returned 0xa28 [0063.802] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0063.802] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.802] IsWindowUnicode (hWnd=0x3015e) returned 1 [0063.802] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0063.802] TranslateMessage (lpMsg=0x26ee10) returned 0 [0063.802] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0063.802] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0063.802] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0063.802] CreateCompatibleDC (hdc=0x60109d6) returned 0x1c0109c0 [0063.803] GetObjectType (h=0x60109d6) returned 0x3 [0063.803] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffde0509d7 [0063.803] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffde0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.803] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffde0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0063.803] DeleteObject (ho=0xffffffffde0509d7) returned 1 [0063.803] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffeb0509d2 [0063.803] SelectObject (hdc=0x1c0109c0, h=0xffffffffeb0509d2) returned 0x185000f [0063.803] GdipCreateFromHDC (hdc=0x1c0109c0, graphics=0x26e408) returned 0x0 [0063.803] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0063.803] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0063.803] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0063.803] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0063.803] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0063.803] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.803] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0063.803] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.803] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0063.803] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0063.803] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0063.803] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0063.804] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0063.804] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.804] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.804] GetSystemMetrics (nIndex=42) returned 0 [0063.804] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.804] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.804] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0063.804] IsAppThemed () returned 0x1 [0063.804] GetThemeAppProperties () returned 0x3 [0063.804] GetThemeAppProperties () returned 0x3 [0063.804] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0063.804] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0063.804] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0063.804] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0063.804] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0063.804] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.804] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.804] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.804] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0063.804] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0063.804] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0063.804] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0063.804] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0063.804] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0063.804] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0063.804] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0063.804] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0063.804] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0063.804] GetCurrentObject (hdc=0x1c0109c0, type=0x1) returned 0x1b00017 [0063.805] GetCurrentObject (hdc=0x1c0109c0, type=0x2) returned 0x1900010 [0063.805] GetCurrentObject (hdc=0x1c0109c0, type=0x7) returned 0xffffffffeb0509d2 [0063.805] GetCurrentObject (hdc=0x1c0109c0, type=0x6) returned 0x18a002e [0063.805] SaveDC (hdc=0x1c0109c0) returned 1 [0063.805] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x740409ff [0063.805] GetClipRgn (hdc=0x1c0109c0, hrgn=0x740409ff) returned 0 [0063.805] SelectClipRgn (hdc=0x1c0109c0, hrgn=0x4f0409f1) returned 2 [0063.805] DeleteObject (ho=0x740409ff) returned 1 [0063.805] DeleteObject (ho=0x4f0409f1) returned 1 [0063.805] OffsetViewportOrgEx (in: hdc=0x1c0109c0, x=0, y=0, lppt=0x2717040 | out: lppt=0x2717040) returned 1 [0063.805] OffsetViewportOrgEx (in: hdc=0x1c0109c0, x=-417, y=-278, lppt=0x2717058 | out: lppt=0x2717058) returned 1 [0063.805] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0063.805] GetCurrentObject (hdc=0x1c0109c0, type=0x1) returned 0x1b00017 [0063.805] GetCurrentObject (hdc=0x1c0109c0, type=0x2) returned 0x1900010 [0063.805] GetCurrentObject (hdc=0x1c0109c0, type=0x7) returned 0xffffffffeb0509d2 [0063.805] GetCurrentObject (hdc=0x1c0109c0, type=0x6) returned 0x18a002e [0063.805] SaveDC (hdc=0x1c0109c0) returned 2 [0063.805] GetNearestColor (hdc=0x1c0109c0, color=0x6c4607) returned 0x6c4607 [0063.805] CreateSolidBrush (color=0x6c4607) returned 0xffffffffdf100276 [0063.805] FillRect (hDC=0x1c0109c0, lprc=0x26de08, hbr=0xffffffffdf100276) returned 1 [0063.813] DeleteObject (ho=0xffffffffdf100276) returned 1 [0063.813] RestoreDC (hdc=0x1c0109c0, nSavedDC=-1) returned 1 [0063.813] RestoreDC (hdc=0x1c0109c0, nSavedDC=-1) returned 1 [0063.813] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109c0) returned 0x0 [0063.813] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc780dbd) returned 0x0 [0063.813] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0063.813] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0063.813] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0063.813] GetSystemMetrics (nIndex=42) returned 0 [0063.813] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0063.813] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0063.813] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0063.813] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0063.813] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0063.813] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0063.813] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0063.813] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0063.813] GetCurrentObject (hdc=0x1c0109c0, type=0x1) returned 0x1b00017 [0063.813] GetCurrentObject (hdc=0x1c0109c0, type=0x2) returned 0x1900010 [0063.813] GetCurrentObject (hdc=0x1c0109c0, type=0x7) returned 0xffffffffeb0509d2 [0063.814] GetCurrentObject (hdc=0x1c0109c0, type=0x6) returned 0x18a002e [0063.814] SaveDC (hdc=0x1c0109c0) returned 1 [0063.814] GetNearestColor (hdc=0x1c0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0063.814] RestoreDC (hdc=0x1c0109c0, nSavedDC=-1) returned 1 [0063.814] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109c0) returned 0x0 [0063.814] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0063.814] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0063.814] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0063.814] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0063.814] GetCurrentObject (hdc=0x1c0109c0, type=0x1) returned 0x1b00017 [0063.814] GetCurrentObject (hdc=0x1c0109c0, type=0x2) returned 0x1900010 [0063.814] GetCurrentObject (hdc=0x1c0109c0, type=0x7) returned 0xffffffffeb0509d2 [0063.814] GetCurrentObject (hdc=0x1c0109c0, type=0x6) returned 0x18a002e [0063.814] SaveDC (hdc=0x1c0109c0) returned 1 [0063.814] GetTextAlign (hdc=0x1c0109c0) returned 0x0 [0063.814] GetTextColor (hdc=0x1c0109c0) returned 0x0 [0063.814] SetTextColor (hdc=0x1c0109c0, color=0xf0f0f0) returned 0x0 [0063.814] GetCurrentObject (hdc=0x1c0109c0, type=0x6) returned 0x18a002e [0063.814] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0063.815] SelectObject (hdc=0x1c0109c0, h=0x260a09ba) returned 0x18a002e [0063.815] GetBkMode (hdc=0x1c0109c0) returned 2 [0063.815] SetBkMode (hdc=0x1c0109c0, mode=1) returned 2 [0063.815] DrawTextExW (in: hdc=0x1c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2717d08 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0063.815] DrawTextExW (in: hdc=0x1c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2717d08 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0063.815] RestoreDC (hdc=0x1c0109c0, nSavedDC=-1) returned 1 [0063.815] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109c0) returned 0x0 [0063.815] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0063.815] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x1c0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0063.816] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109c0) returned 0x0 [0063.816] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0063.816] SelectObject (hdc=0x1c0109c0, h=0x185000f) returned 0xffffffffeb0509d2 [0063.816] DeleteDC (hdc=0x1c0109c0) returned 1 [0063.816] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0063.816] DeleteObject (ho=0xffffffffeb0509d2) returned 1 [0063.819] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0063.819] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.819] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0063.819] WaitMessage () returned 1 [0064.025] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.025] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.025] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.025] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.025] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.025] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0064.025] GetCurrentThreadId () returned 0xa28 [0064.025] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0064.025] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.025] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.025] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.025] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.025] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.025] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0064.026] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0064.026] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffe00109d7 [0064.026] GetObjectType (h=0x60109d6) returned 0x3 [0064.026] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffec0509d2 [0064.026] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffec0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.026] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffec0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.026] DeleteObject (ho=0xffffffffec0509d2) returned 1 [0064.026] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x1d0509c0 [0064.026] SelectObject (hdc=0xffffffffe00109d7, h=0x1d0509c0) returned 0x185000f [0064.026] GdipCreateFromHDC (hdc=0xffffffffe00109d7, graphics=0x26e408) returned 0x0 [0064.026] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0064.026] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0064.026] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0064.026] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0064.026] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0064.026] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.026] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0064.026] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.027] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0064.027] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0064.027] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0064.027] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0064.027] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0064.027] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.027] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.027] GetSystemMetrics (nIndex=42) returned 0 [0064.027] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.027] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.027] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0064.027] IsAppThemed () returned 0x1 [0064.027] GetThemeAppProperties () returned 0x3 [0064.027] GetThemeAppProperties () returned 0x3 [0064.027] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0064.027] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0064.027] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0064.027] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0064.027] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0064.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.027] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.027] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.027] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0064.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.027] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.027] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.027] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0064.027] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0064.027] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0064.028] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0064.028] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0064.028] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0064.028] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x1) returned 0x1b00017 [0064.028] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x2) returned 0x1900010 [0064.028] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x7) returned 0x1d0509c0 [0064.028] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x6) returned 0x18a002e [0064.028] SaveDC (hdc=0xffffffffe00109d7) returned 1 [0064.028] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x500409f1 [0064.028] GetClipRgn (hdc=0xffffffffe00109d7, hrgn=0x500409f1) returned 0 [0064.028] SelectClipRgn (hdc=0xffffffffe00109d7, hrgn=0x770409ff) returned 2 [0064.028] DeleteObject (ho=0x500409f1) returned 1 [0064.028] DeleteObject (ho=0x770409ff) returned 1 [0064.028] OffsetViewportOrgEx (in: hdc=0xffffffffe00109d7, x=0, y=0, lppt=0x26a7b20 | out: lppt=0x26a7b20) returned 1 [0064.028] OffsetViewportOrgEx (in: hdc=0xffffffffe00109d7, x=-417, y=-278, lppt=0x26a7b38 | out: lppt=0x26a7b38) returned 1 [0064.028] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0064.028] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x1) returned 0x1b00017 [0064.028] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x2) returned 0x1900010 [0064.028] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x7) returned 0x1d0509c0 [0064.028] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x6) returned 0x18a002e [0064.028] SaveDC (hdc=0xffffffffe00109d7) returned 2 [0064.028] GetNearestColor (hdc=0xffffffffe00109d7, color=0x6c4607) returned 0x6c4607 [0064.028] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe0100276 [0064.028] FillRect (hDC=0xffffffffe00109d7, lprc=0x26de08, hbr=0xffffffffe0100276) returned 1 [0064.034] DeleteObject (ho=0xffffffffe0100276) returned 1 [0064.035] RestoreDC (hdc=0xffffffffe00109d7, nSavedDC=-1) returned 1 [0064.035] RestoreDC (hdc=0xffffffffe00109d7, nSavedDC=-1) returned 1 [0064.035] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe00109d7) returned 0x0 [0064.035] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc760dbd) returned 0x0 [0064.035] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0064.035] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.035] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.035] GetSystemMetrics (nIndex=42) returned 0 [0064.035] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.035] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.035] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xa) returned 0x0 [0064.036] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0064.036] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0064.036] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0064.036] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0064.036] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0064.036] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0064.036] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x1) returned 0x1b00017 [0064.036] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x2) returned 0x1900010 [0064.036] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x7) returned 0x1d0509c0 [0064.036] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x6) returned 0x18a002e [0064.036] SaveDC (hdc=0xffffffffe00109d7) returned 1 [0064.036] GetNearestColor (hdc=0xffffffffe00109d7, color=0xf0f0f0) returned 0xf0f0f0 [0064.036] RestoreDC (hdc=0xffffffffe00109d7, nSavedDC=-1) returned 1 [0064.036] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe00109d7) returned 0x0 [0064.037] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0064.037] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0064.037] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0064.037] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x1) returned 0x1b00017 [0064.037] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x2) returned 0x1900010 [0064.037] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x7) returned 0x1d0509c0 [0064.037] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x6) returned 0x18a002e [0064.037] SaveDC (hdc=0xffffffffe00109d7) returned 1 [0064.037] GetTextAlign (hdc=0xffffffffe00109d7) returned 0x0 [0064.037] GetTextColor (hdc=0xffffffffe00109d7) returned 0x0 [0064.037] SetTextColor (hdc=0xffffffffe00109d7, color=0xf0f0f0) returned 0x0 [0064.037] GetCurrentObject (hdc=0xffffffffe00109d7, type=0x6) returned 0x18a002e [0064.037] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0064.037] SelectObject (hdc=0xffffffffe00109d7, h=0x260a09ba) returned 0x18a002e [0064.037] GetBkMode (hdc=0xffffffffe00109d7) returned 2 [0064.037] SetBkMode (hdc=0xffffffffe00109d7, mode=1) returned 2 [0064.037] DrawTextExW (in: hdc=0xffffffffe00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a89c0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0064.037] DrawTextExW (in: hdc=0xffffffffe00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a89c0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0064.038] RestoreDC (hdc=0xffffffffe00109d7, nSavedDC=-1) returned 1 [0064.038] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe00109d7) returned 0x0 [0064.038] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0064.038] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffe00109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0064.038] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe00109d7) returned 0x0 [0064.038] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0064.038] SelectObject (hdc=0xffffffffe00109d7, h=0x185000f) returned 0x1d0509c0 [0064.038] DeleteDC (hdc=0xffffffffe00109d7) returned 1 [0064.038] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0064.038] DeleteObject (ho=0x1d0509c0) returned 1 [0064.041] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0064.041] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.041] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.041] WaitMessage () returned 1 [0064.286] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.286] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.286] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.286] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.286] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.286] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0064.286] GetCurrentThreadId () returned 0xa28 [0064.286] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0064.286] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.286] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.286] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.286] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.286] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.286] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0064.287] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0064.287] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffee0109d2 [0064.287] GetObjectType (h=0x60109d6) returned 0x3 [0064.287] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x1e0509c0 [0064.287] GetDIBits (in: hdc=0x60109d6, hbm=0x1e0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.287] GetDIBits (in: hdc=0x60109d6, hbm=0x1e0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.287] DeleteObject (ho=0x1e0509c0) returned 1 [0064.287] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffe10509d7 [0064.287] SelectObject (hdc=0xffffffffee0109d2, h=0xffffffffe10509d7) returned 0x185000f [0064.287] GdipCreateFromHDC (hdc=0xffffffffee0109d2, graphics=0x26e408) returned 0x0 [0064.287] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0064.287] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0064.287] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0064.287] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0064.287] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0064.287] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.287] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0064.288] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.288] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0064.288] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0064.288] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0064.288] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0064.288] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0064.288] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.288] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.288] GetSystemMetrics (nIndex=42) returned 0 [0064.288] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.288] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.288] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0064.288] IsAppThemed () returned 0x1 [0064.288] GetThemeAppProperties () returned 0x3 [0064.288] GetThemeAppProperties () returned 0x3 [0064.288] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0064.288] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0064.288] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0064.288] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0064.288] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0064.288] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.288] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.288] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.288] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0064.288] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.288] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.288] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.288] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0064.288] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0064.288] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0064.288] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0064.289] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0064.289] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0064.289] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x1) returned 0x1b00017 [0064.289] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x2) returned 0x1900010 [0064.289] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x7) returned 0xffffffffe10509d7 [0064.289] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x6) returned 0x18a002e [0064.289] SaveDC (hdc=0xffffffffee0109d2) returned 1 [0064.289] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x780409ff [0064.289] GetClipRgn (hdc=0xffffffffee0109d2, hrgn=0x780409ff) returned 0 [0064.289] SelectClipRgn (hdc=0xffffffffee0109d2, hrgn=0x530409f1) returned 2 [0064.289] DeleteObject (ho=0x780409ff) returned 1 [0064.289] DeleteObject (ho=0x530409f1) returned 1 [0064.289] OffsetViewportOrgEx (in: hdc=0xffffffffee0109d2, x=0, y=0, lppt=0x2734a40 | out: lppt=0x2734a40) returned 1 [0064.289] OffsetViewportOrgEx (in: hdc=0xffffffffee0109d2, x=-417, y=-278, lppt=0x2734a58 | out: lppt=0x2734a58) returned 1 [0064.289] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0064.289] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x1) returned 0x1b00017 [0064.289] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x2) returned 0x1900010 [0064.289] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x7) returned 0xffffffffe10509d7 [0064.289] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x6) returned 0x18a002e [0064.289] SaveDC (hdc=0xffffffffee0109d2) returned 2 [0064.289] GetNearestColor (hdc=0xffffffffee0109d2, color=0x6c4607) returned 0x6c4607 [0064.289] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe1100276 [0064.289] FillRect (hDC=0xffffffffee0109d2, lprc=0x26de08, hbr=0xffffffffe1100276) returned 1 [0064.296] DeleteObject (ho=0xffffffffe1100276) returned 1 [0064.296] RestoreDC (hdc=0xffffffffee0109d2, nSavedDC=-1) returned 1 [0064.296] RestoreDC (hdc=0xffffffffee0109d2, nSavedDC=-1) returned 1 [0064.296] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffee0109d2) returned 0x0 [0064.296] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc740dbd) returned 0x0 [0064.296] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0064.296] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.296] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.296] GetSystemMetrics (nIndex=42) returned 0 [0064.296] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.296] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.296] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0064.296] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0064.296] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0064.296] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0064.296] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0064.296] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0064.296] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x1) returned 0x1b00017 [0064.296] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x2) returned 0x1900010 [0064.296] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x7) returned 0xffffffffe10509d7 [0064.296] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x6) returned 0x18a002e [0064.296] SaveDC (hdc=0xffffffffee0109d2) returned 1 [0064.296] GetNearestColor (hdc=0xffffffffee0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0064.297] RestoreDC (hdc=0xffffffffee0109d2, nSavedDC=-1) returned 1 [0064.297] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffee0109d2) returned 0x0 [0064.297] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0064.297] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0064.297] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0064.297] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0064.297] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x1) returned 0x1b00017 [0064.297] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x2) returned 0x1900010 [0064.297] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x7) returned 0xffffffffe10509d7 [0064.297] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x6) returned 0x18a002e [0064.297] SaveDC (hdc=0xffffffffee0109d2) returned 1 [0064.297] GetTextAlign (hdc=0xffffffffee0109d2) returned 0x0 [0064.297] GetTextColor (hdc=0xffffffffee0109d2) returned 0x0 [0064.297] SetTextColor (hdc=0xffffffffee0109d2, color=0xf0f0f0) returned 0x0 [0064.297] GetCurrentObject (hdc=0xffffffffee0109d2, type=0x6) returned 0x18a002e [0064.297] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0064.297] SelectObject (hdc=0xffffffffee0109d2, h=0x260a09ba) returned 0x18a002e [0064.297] GetBkMode (hdc=0xffffffffee0109d2) returned 2 [0064.297] SetBkMode (hdc=0xffffffffee0109d2, mode=1) returned 2 [0064.297] DrawTextExW (in: hdc=0xffffffffee0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2735708 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0064.298] DrawTextExW (in: hdc=0xffffffffee0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2735708 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0064.298] RestoreDC (hdc=0xffffffffee0109d2, nSavedDC=-1) returned 1 [0064.298] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffee0109d2) returned 0x0 [0064.298] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0064.298] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffee0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0064.298] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffee0109d2) returned 0x0 [0064.299] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0064.299] SelectObject (hdc=0xffffffffee0109d2, h=0x185000f) returned 0xffffffffe10509d7 [0064.299] DeleteDC (hdc=0xffffffffee0109d2) returned 1 [0064.299] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0064.299] DeleteObject (ho=0xffffffffe10509d7) returned 1 [0064.302] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0064.302] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.302] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.302] WaitMessage () returned 1 [0064.468] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.468] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.468] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.468] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.468] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.468] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0064.468] GetCurrentThreadId () returned 0xa28 [0064.468] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0064.468] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.468] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.469] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.469] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.469] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.469] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0064.469] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0064.469] CreateCompatibleDC (hdc=0x60109d6) returned 0x200109c0 [0064.469] GetObjectType (h=0x60109d6) returned 0x3 [0064.469] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffe20509d7 [0064.469] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe20509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.469] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe20509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.469] DeleteObject (ho=0xffffffffe20509d7) returned 1 [0064.469] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffef0509d2 [0064.469] SelectObject (hdc=0x200109c0, h=0xffffffffef0509d2) returned 0x185000f [0064.469] GdipCreateFromHDC (hdc=0x200109c0, graphics=0x26e408) returned 0x0 [0064.470] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0064.470] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0064.470] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0064.470] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0064.470] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0064.470] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.470] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0064.470] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.470] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0064.470] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0064.470] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0064.470] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0064.470] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0064.470] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.470] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.470] GetSystemMetrics (nIndex=42) returned 0 [0064.470] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.470] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.470] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0064.470] IsAppThemed () returned 0x1 [0064.470] GetThemeAppProperties () returned 0x3 [0064.470] GetThemeAppProperties () returned 0x3 [0064.470] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0064.470] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0064.470] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0064.470] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0064.470] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0064.470] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.471] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.471] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.471] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0064.471] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.471] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.471] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.471] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0064.471] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0064.471] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0064.471] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0064.471] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0064.471] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0064.471] GetCurrentObject (hdc=0x200109c0, type=0x1) returned 0x1b00017 [0064.471] GetCurrentObject (hdc=0x200109c0, type=0x2) returned 0x1900010 [0064.471] GetCurrentObject (hdc=0x200109c0, type=0x7) returned 0xffffffffef0509d2 [0064.471] GetCurrentObject (hdc=0x200109c0, type=0x6) returned 0x18a002e [0064.471] SaveDC (hdc=0x200109c0) returned 1 [0064.471] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x540409f1 [0064.471] GetClipRgn (hdc=0x200109c0, hrgn=0x540409f1) returned 0 [0064.471] SelectClipRgn (hdc=0x200109c0, hrgn=0x7b0409ff) returned 2 [0064.471] DeleteObject (ho=0x540409f1) returned 1 [0064.471] DeleteObject (ho=0x7b0409ff) returned 1 [0064.471] OffsetViewportOrgEx (in: hdc=0x200109c0, x=0, y=0, lppt=0x26e7a00 | out: lppt=0x26e7a00) returned 1 [0064.471] OffsetViewportOrgEx (in: hdc=0x200109c0, x=-417, y=-278, lppt=0x26e7a18 | out: lppt=0x26e7a18) returned 1 [0064.471] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0064.471] GetCurrentObject (hdc=0x200109c0, type=0x1) returned 0x1b00017 [0064.471] GetCurrentObject (hdc=0x200109c0, type=0x2) returned 0x1900010 [0064.471] GetCurrentObject (hdc=0x200109c0, type=0x7) returned 0xffffffffef0509d2 [0064.472] GetCurrentObject (hdc=0x200109c0, type=0x6) returned 0x18a002e [0064.472] SaveDC (hdc=0x200109c0) returned 2 [0064.472] GetNearestColor (hdc=0x200109c0, color=0x6c4607) returned 0x6c4607 [0064.472] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe2100276 [0064.472] FillRect (hDC=0x200109c0, lprc=0x26de08, hbr=0xffffffffe2100276) returned 1 [0064.478] DeleteObject (ho=0xffffffffe2100276) returned 1 [0064.478] RestoreDC (hdc=0x200109c0, nSavedDC=-1) returned 1 [0064.478] RestoreDC (hdc=0x200109c0, nSavedDC=-1) returned 1 [0064.478] GdipReleaseDC (graphics=0x1b86d040, hdc=0x200109c0) returned 0x0 [0064.478] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc720dbd) returned 0x0 [0064.478] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0064.478] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.479] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.479] GetSystemMetrics (nIndex=42) returned 0 [0064.479] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.479] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.479] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xc) returned 0x0 [0064.479] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0064.479] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0064.479] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0064.479] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0064.479] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0064.480] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0064.480] GetCurrentObject (hdc=0x200109c0, type=0x1) returned 0x1b00017 [0064.480] GetCurrentObject (hdc=0x200109c0, type=0x2) returned 0x1900010 [0064.480] GetCurrentObject (hdc=0x200109c0, type=0x7) returned 0xffffffffef0509d2 [0064.480] GetCurrentObject (hdc=0x200109c0, type=0x6) returned 0x18a002e [0064.480] SaveDC (hdc=0x200109c0) returned 1 [0064.480] GetNearestColor (hdc=0x200109c0, color=0xf0f0f0) returned 0xf0f0f0 [0064.480] RestoreDC (hdc=0x200109c0, nSavedDC=-1) returned 1 [0064.480] GdipReleaseDC (graphics=0x1b86d040, hdc=0x200109c0) returned 0x0 [0064.480] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0064.480] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0064.480] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0064.480] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0064.480] GetCurrentObject (hdc=0x200109c0, type=0x1) returned 0x1b00017 [0064.480] GetCurrentObject (hdc=0x200109c0, type=0x2) returned 0x1900010 [0064.480] GetCurrentObject (hdc=0x200109c0, type=0x7) returned 0xffffffffef0509d2 [0064.480] GetCurrentObject (hdc=0x200109c0, type=0x6) returned 0x18a002e [0064.480] SaveDC (hdc=0x200109c0) returned 1 [0064.481] GetTextAlign (hdc=0x200109c0) returned 0x0 [0064.481] GetTextColor (hdc=0x200109c0) returned 0x0 [0064.481] SetTextColor (hdc=0x200109c0, color=0xf0f0f0) returned 0x0 [0064.481] GetCurrentObject (hdc=0x200109c0, type=0x6) returned 0x18a002e [0064.481] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0064.481] SelectObject (hdc=0x200109c0, h=0x260a09ba) returned 0x18a002e [0064.481] GetBkMode (hdc=0x200109c0) returned 2 [0064.481] SetBkMode (hdc=0x200109c0, mode=1) returned 2 [0064.481] DrawTextExW (in: hdc=0x200109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26e88b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0064.481] DrawTextExW (in: hdc=0x200109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26e88b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0064.481] RestoreDC (hdc=0x200109c0, nSavedDC=-1) returned 1 [0064.481] GdipReleaseDC (graphics=0x1b86d040, hdc=0x200109c0) returned 0x0 [0064.482] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0064.482] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x200109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0064.482] GdipReleaseDC (graphics=0x1b86d040, hdc=0x200109c0) returned 0x0 [0064.482] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0064.482] SelectObject (hdc=0x200109c0, h=0x185000f) returned 0xffffffffef0509d2 [0064.482] DeleteDC (hdc=0x200109c0) returned 1 [0064.482] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0064.482] DeleteObject (ho=0xffffffffef0509d2) returned 1 [0064.485] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0064.485] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.485] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.485] WaitMessage () returned 1 [0064.614] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.614] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.614] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.614] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.614] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.614] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0064.614] GetCurrentThreadId () returned 0xa28 [0064.614] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0064.614] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.614] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.614] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.614] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.614] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.614] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0064.614] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0064.614] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffe40109d7 [0064.614] GetObjectType (h=0x60109d6) returned 0x3 [0064.614] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffff00509d2 [0064.615] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff00509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.615] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff00509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.615] DeleteObject (ho=0xfffffffff00509d2) returned 1 [0064.615] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x210509c0 [0064.616] SelectObject (hdc=0xffffffffe40109d7, h=0x210509c0) returned 0x185000f [0064.616] GdipCreateFromHDC (hdc=0xffffffffe40109d7, graphics=0x26e408) returned 0x0 [0064.616] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0064.616] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0064.616] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0064.616] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0064.616] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0064.616] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.616] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0064.616] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.616] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0064.616] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0064.617] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0064.617] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0064.617] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0064.617] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.617] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.617] GetSystemMetrics (nIndex=42) returned 0 [0064.617] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.617] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.617] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0064.617] IsAppThemed () returned 0x1 [0064.617] GetThemeAppProperties () returned 0x3 [0064.617] GetThemeAppProperties () returned 0x3 [0064.617] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0064.617] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0064.617] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0064.617] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0064.617] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0064.617] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.617] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.617] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.617] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0064.617] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.617] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.617] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.617] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0064.617] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0064.617] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0064.617] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0064.618] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0064.618] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0064.618] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x1) returned 0x1b00017 [0064.618] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x2) returned 0x1900010 [0064.618] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x7) returned 0x210509c0 [0064.618] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x6) returned 0x18a002e [0064.618] SaveDC (hdc=0xffffffffe40109d7) returned 1 [0064.618] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7c0409ff [0064.618] GetClipRgn (hdc=0xffffffffe40109d7, hrgn=0x7c0409ff) returned 0 [0064.618] SelectClipRgn (hdc=0xffffffffe40109d7, hrgn=0x570409f1) returned 2 [0064.618] DeleteObject (ho=0x7c0409ff) returned 1 [0064.618] DeleteObject (ho=0x570409f1) returned 1 [0064.618] OffsetViewportOrgEx (in: hdc=0xffffffffe40109d7, x=0, y=0, lppt=0x28c06a0 | out: lppt=0x28c06a0) returned 1 [0064.618] OffsetViewportOrgEx (in: hdc=0xffffffffe40109d7, x=-417, y=-278, lppt=0x28c06b8 | out: lppt=0x28c06b8) returned 1 [0064.618] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0064.618] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x1) returned 0x1b00017 [0064.618] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x2) returned 0x1900010 [0064.618] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x7) returned 0x210509c0 [0064.618] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x6) returned 0x18a002e [0064.618] SaveDC (hdc=0xffffffffe40109d7) returned 2 [0064.618] GetNearestColor (hdc=0xffffffffe40109d7, color=0x6c4607) returned 0x6c4607 [0064.618] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe3100276 [0064.618] FillRect (hDC=0xffffffffe40109d7, lprc=0x26de08, hbr=0xffffffffe3100276) returned 1 [0064.625] DeleteObject (ho=0xffffffffe3100276) returned 1 [0064.625] RestoreDC (hdc=0xffffffffe40109d7, nSavedDC=-1) returned 1 [0064.625] RestoreDC (hdc=0xffffffffe40109d7, nSavedDC=-1) returned 1 [0064.625] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe40109d7) returned 0x0 [0064.625] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc700dbd) returned 0x0 [0064.625] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0064.625] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.625] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.625] GetSystemMetrics (nIndex=42) returned 0 [0064.625] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.625] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.625] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xd) returned 0x0 [0064.625] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0064.626] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0064.626] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0064.626] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0064.626] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0064.626] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0064.626] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x1) returned 0x1b00017 [0064.626] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x2) returned 0x1900010 [0064.626] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x7) returned 0x210509c0 [0064.626] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x6) returned 0x18a002e [0064.626] SaveDC (hdc=0xffffffffe40109d7) returned 1 [0064.626] GetNearestColor (hdc=0xffffffffe40109d7, color=0xf0f0f0) returned 0xf0f0f0 [0064.626] RestoreDC (hdc=0xffffffffe40109d7, nSavedDC=-1) returned 1 [0064.626] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe40109d7) returned 0x0 [0064.626] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0064.626] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0064.626] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0064.626] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0064.626] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x1) returned 0x1b00017 [0064.626] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x2) returned 0x1900010 [0064.626] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x7) returned 0x210509c0 [0064.627] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x6) returned 0x18a002e [0064.627] SaveDC (hdc=0xffffffffe40109d7) returned 1 [0064.627] GetTextAlign (hdc=0xffffffffe40109d7) returned 0x0 [0064.627] GetTextColor (hdc=0xffffffffe40109d7) returned 0x0 [0064.627] SetTextColor (hdc=0xffffffffe40109d7, color=0xf0f0f0) returned 0x0 [0064.627] GetCurrentObject (hdc=0xffffffffe40109d7, type=0x6) returned 0x18a002e [0064.627] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0064.627] SelectObject (hdc=0xffffffffe40109d7, h=0x260a09ba) returned 0x18a002e [0064.627] GetBkMode (hdc=0xffffffffe40109d7) returned 2 [0064.627] SetBkMode (hdc=0xffffffffe40109d7, mode=1) returned 2 [0064.627] DrawTextExW (in: hdc=0xffffffffe40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x28c1480 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0064.627] DrawTextExW (in: hdc=0xffffffffe40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x28c1480 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0064.628] RestoreDC (hdc=0xffffffffe40109d7, nSavedDC=-1) returned 1 [0064.628] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe40109d7) returned 0x0 [0064.628] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0064.628] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffe40109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0064.628] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe40109d7) returned 0x0 [0064.628] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0064.628] SelectObject (hdc=0xffffffffe40109d7, h=0x185000f) returned 0x210509c0 [0064.628] DeleteDC (hdc=0xffffffffe40109d7) returned 1 [0064.628] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0064.628] DeleteObject (ho=0x210509c0) returned 1 [0064.632] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0064.632] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.632] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.632] WaitMessage () returned 1 [0064.864] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.864] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.865] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.865] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.865] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.865] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0064.865] GetCurrentThreadId () returned 0xa28 [0064.865] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0064.865] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.865] IsWindowUnicode (hWnd=0x3015e) returned 1 [0064.865] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0064.865] TranslateMessage (lpMsg=0x26ee10) returned 0 [0064.865] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0064.865] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0064.865] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0064.865] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffff20109d2 [0064.865] GetObjectType (h=0x60109d6) returned 0x3 [0064.865] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x220509c0 [0064.865] GetDIBits (in: hdc=0x60109d6, hbm=0x220509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.865] GetDIBits (in: hdc=0x60109d6, hbm=0x220509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0064.865] DeleteObject (ho=0x220509c0) returned 1 [0064.865] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffe50509d7 [0064.865] SelectObject (hdc=0xfffffffff20109d2, h=0xffffffffe50509d7) returned 0x185000f [0064.866] GdipCreateFromHDC (hdc=0xfffffffff20109d2, graphics=0x26e408) returned 0x0 [0064.866] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0064.866] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0064.866] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0064.866] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0064.866] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0064.866] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.866] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0064.866] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.866] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0064.866] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0064.866] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0064.866] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0064.866] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0064.866] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.866] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.866] GetSystemMetrics (nIndex=42) returned 0 [0064.866] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.866] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.866] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0064.866] IsAppThemed () returned 0x1 [0064.867] GetThemeAppProperties () returned 0x3 [0064.867] GetThemeAppProperties () returned 0x3 [0064.867] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0064.867] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0064.867] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0064.867] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0064.867] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0064.867] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.867] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.867] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.867] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0064.867] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0064.867] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0064.867] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0064.867] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0064.867] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0064.867] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0064.867] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0064.867] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0064.867] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0064.867] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x1) returned 0x1b00017 [0064.867] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x2) returned 0x1900010 [0064.867] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x7) returned 0xffffffffe50509d7 [0064.867] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x6) returned 0x18a002e [0064.867] SaveDC (hdc=0xfffffffff20109d2) returned 1 [0064.867] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x580409f1 [0064.867] GetClipRgn (hdc=0xfffffffff20109d2, hrgn=0x580409f1) returned 0 [0064.867] SelectClipRgn (hdc=0xfffffffff20109d2, hrgn=0x7f0409ff) returned 2 [0064.868] DeleteObject (ho=0x580409f1) returned 1 [0064.868] DeleteObject (ho=0x7f0409ff) returned 1 [0064.868] OffsetViewportOrgEx (in: hdc=0xfffffffff20109d2, x=0, y=0, lppt=0x27cdd38 | out: lppt=0x27cdd38) returned 1 [0064.868] OffsetViewportOrgEx (in: hdc=0xfffffffff20109d2, x=-417, y=-278, lppt=0x27cdd50 | out: lppt=0x27cdd50) returned 1 [0064.868] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0064.868] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x1) returned 0x1b00017 [0064.868] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x2) returned 0x1900010 [0064.868] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x7) returned 0xffffffffe50509d7 [0064.868] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x6) returned 0x18a002e [0064.868] SaveDC (hdc=0xfffffffff20109d2) returned 2 [0064.868] GetNearestColor (hdc=0xfffffffff20109d2, color=0x6c4607) returned 0x6c4607 [0064.868] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe4100276 [0064.868] FillRect (hDC=0xfffffffff20109d2, lprc=0x26de08, hbr=0xffffffffe4100276) returned 1 [0064.874] DeleteObject (ho=0xffffffffe4100276) returned 1 [0064.874] RestoreDC (hdc=0xfffffffff20109d2, nSavedDC=-1) returned 1 [0064.874] RestoreDC (hdc=0xfffffffff20109d2, nSavedDC=-1) returned 1 [0064.874] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff20109d2) returned 0x0 [0064.874] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc6e0dbd) returned 0x0 [0064.875] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0064.875] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0064.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0064.875] GetSystemMetrics (nIndex=42) returned 0 [0064.875] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0064.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0064.875] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0064.875] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0064.875] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0064.875] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0064.875] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0064.875] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0064.875] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x1) returned 0x1b00017 [0064.875] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x2) returned 0x1900010 [0064.875] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x7) returned 0xffffffffe50509d7 [0064.875] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x6) returned 0x18a002e [0064.875] SaveDC (hdc=0xfffffffff20109d2) returned 1 [0064.875] GetNearestColor (hdc=0xfffffffff20109d2, color=0xf0f0f0) returned 0xf0f0f0 [0064.875] RestoreDC (hdc=0xfffffffff20109d2, nSavedDC=-1) returned 1 [0064.875] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff20109d2) returned 0x0 [0064.876] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0064.876] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0064.876] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0064.876] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x1) returned 0x1b00017 [0064.876] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x2) returned 0x1900010 [0064.876] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x7) returned 0xffffffffe50509d7 [0064.876] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x6) returned 0x18a002e [0064.876] SaveDC (hdc=0xfffffffff20109d2) returned 1 [0064.876] GetTextAlign (hdc=0xfffffffff20109d2) returned 0x0 [0064.876] GetTextColor (hdc=0xfffffffff20109d2) returned 0x0 [0064.876] SetTextColor (hdc=0xfffffffff20109d2, color=0xf0f0f0) returned 0x0 [0064.876] GetCurrentObject (hdc=0xfffffffff20109d2, type=0x6) returned 0x18a002e [0064.876] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0064.876] SelectObject (hdc=0xfffffffff20109d2, h=0x260a09ba) returned 0x18a002e [0064.876] GetBkMode (hdc=0xfffffffff20109d2) returned 2 [0064.876] SetBkMode (hdc=0xfffffffff20109d2, mode=1) returned 2 [0064.876] DrawTextExW (in: hdc=0xfffffffff20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27cea00 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0064.876] DrawTextExW (in: hdc=0xfffffffff20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27cea00 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0064.877] RestoreDC (hdc=0xfffffffff20109d2, nSavedDC=-1) returned 1 [0064.877] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff20109d2) returned 0x0 [0064.877] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0064.877] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffff20109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0064.877] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff20109d2) returned 0x0 [0064.877] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0064.877] SelectObject (hdc=0xfffffffff20109d2, h=0x185000f) returned 0xffffffffe50509d7 [0064.877] DeleteDC (hdc=0xfffffffff20109d2) returned 1 [0064.877] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0064.877] DeleteObject (ho=0xffffffffe50509d7) returned 1 [0064.881] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0064.881] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.881] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0064.881] WaitMessage () returned 1 [0065.050] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.050] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.050] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.050] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.050] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.050] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0065.050] GetCurrentThreadId () returned 0xa28 [0065.050] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0065.050] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.051] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.051] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.051] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.051] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.051] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0065.051] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0065.051] CreateCompatibleDC (hdc=0x60109d6) returned 0x240109c0 [0065.051] GetObjectType (h=0x60109d6) returned 0x3 [0065.051] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffe60509d7 [0065.051] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe60509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.051] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffe60509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.051] DeleteObject (ho=0xffffffffe60509d7) returned 1 [0065.051] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffff30509d2 [0065.051] SelectObject (hdc=0x240109c0, h=0xfffffffff30509d2) returned 0x185000f [0065.051] GdipCreateFromHDC (hdc=0x240109c0, graphics=0x26e408) returned 0x0 [0065.051] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0065.052] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0065.052] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0065.052] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0065.052] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0065.052] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.052] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0065.052] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.052] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0065.052] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0065.052] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0065.052] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0065.052] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0065.052] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.052] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.052] GetSystemMetrics (nIndex=42) returned 0 [0065.052] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.052] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.052] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0065.052] IsAppThemed () returned 0x1 [0065.052] GetThemeAppProperties () returned 0x3 [0065.052] GetThemeAppProperties () returned 0x3 [0065.052] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0065.052] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0065.052] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0065.052] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0065.052] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0065.052] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.052] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.053] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.053] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0065.053] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.053] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.053] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.053] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0065.053] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0065.053] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0065.053] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0065.053] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0065.053] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0065.053] GetCurrentObject (hdc=0x240109c0, type=0x1) returned 0x1b00017 [0065.053] GetCurrentObject (hdc=0x240109c0, type=0x2) returned 0x1900010 [0065.053] GetCurrentObject (hdc=0x240109c0, type=0x7) returned 0xfffffffff30509d2 [0065.053] GetCurrentObject (hdc=0x240109c0, type=0x6) returned 0x18a002e [0065.053] SaveDC (hdc=0x240109c0) returned 1 [0065.053] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff800409ff [0065.053] GetClipRgn (hdc=0x240109c0, hrgn=0xffffffff800409ff) returned 0 [0065.053] SelectClipRgn (hdc=0x240109c0, hrgn=0x5b0409f1) returned 2 [0065.053] DeleteObject (ho=0xffffffff800409ff) returned 1 [0065.053] DeleteObject (ho=0x5b0409f1) returned 1 [0065.053] OffsetViewportOrgEx (in: hdc=0x240109c0, x=0, y=0, lppt=0x2785818 | out: lppt=0x2785818) returned 1 [0065.053] OffsetViewportOrgEx (in: hdc=0x240109c0, x=-417, y=-278, lppt=0x2785830 | out: lppt=0x2785830) returned 1 [0065.053] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0065.053] GetCurrentObject (hdc=0x240109c0, type=0x1) returned 0x1b00017 [0065.053] GetCurrentObject (hdc=0x240109c0, type=0x2) returned 0x1900010 [0065.053] GetCurrentObject (hdc=0x240109c0, type=0x7) returned 0xfffffffff30509d2 [0065.053] GetCurrentObject (hdc=0x240109c0, type=0x6) returned 0x18a002e [0065.054] SaveDC (hdc=0x240109c0) returned 2 [0065.054] GetNearestColor (hdc=0x240109c0, color=0x6c4607) returned 0x6c4607 [0065.054] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe5100276 [0065.054] FillRect (hDC=0x240109c0, lprc=0x26de08, hbr=0xffffffffe5100276) returned 1 [0065.060] DeleteObject (ho=0xffffffffe5100276) returned 1 [0065.060] RestoreDC (hdc=0x240109c0, nSavedDC=-1) returned 1 [0065.060] RestoreDC (hdc=0x240109c0, nSavedDC=-1) returned 1 [0065.060] GdipReleaseDC (graphics=0x1b86d040, hdc=0x240109c0) returned 0x0 [0065.060] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc6c0dbd) returned 0x0 [0065.060] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0065.060] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.060] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.060] GetSystemMetrics (nIndex=42) returned 0 [0065.060] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.060] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.060] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0xf) returned 0x0 [0065.061] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0065.061] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0065.061] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0065.061] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0065.061] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0065.061] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0065.061] GetCurrentObject (hdc=0x240109c0, type=0x1) returned 0x1b00017 [0065.061] GetCurrentObject (hdc=0x240109c0, type=0x2) returned 0x1900010 [0065.061] GetCurrentObject (hdc=0x240109c0, type=0x7) returned 0xfffffffff30509d2 [0065.061] GetCurrentObject (hdc=0x240109c0, type=0x6) returned 0x18a002e [0065.062] SaveDC (hdc=0x240109c0) returned 1 [0065.062] GetNearestColor (hdc=0x240109c0, color=0xf0f0f0) returned 0xf0f0f0 [0065.062] RestoreDC (hdc=0x240109c0, nSavedDC=-1) returned 1 [0065.062] GdipReleaseDC (graphics=0x1b86d040, hdc=0x240109c0) returned 0x0 [0065.062] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0065.062] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0065.062] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0065.062] GetCurrentObject (hdc=0x240109c0, type=0x1) returned 0x1b00017 [0065.062] GetCurrentObject (hdc=0x240109c0, type=0x2) returned 0x1900010 [0065.062] GetCurrentObject (hdc=0x240109c0, type=0x7) returned 0xfffffffff30509d2 [0065.062] GetCurrentObject (hdc=0x240109c0, type=0x6) returned 0x18a002e [0065.062] SaveDC (hdc=0x240109c0) returned 1 [0065.062] GetTextAlign (hdc=0x240109c0) returned 0x0 [0065.062] GetTextColor (hdc=0x240109c0) returned 0x0 [0065.062] SetTextColor (hdc=0x240109c0, color=0xf0f0f0) returned 0x0 [0065.062] GetCurrentObject (hdc=0x240109c0, type=0x6) returned 0x18a002e [0065.062] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0065.062] SelectObject (hdc=0x240109c0, h=0x260a09ba) returned 0x18a002e [0065.062] GetBkMode (hdc=0x240109c0) returned 2 [0065.062] SetBkMode (hdc=0x240109c0, mode=1) returned 2 [0065.063] DrawTextExW (in: hdc=0x240109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27866e0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0065.063] DrawTextExW (in: hdc=0x240109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27866e0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0065.063] RestoreDC (hdc=0x240109c0, nSavedDC=-1) returned 1 [0065.063] GdipReleaseDC (graphics=0x1b86d040, hdc=0x240109c0) returned 0x0 [0065.063] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0065.063] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x240109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.063] GdipReleaseDC (graphics=0x1b86d040, hdc=0x240109c0) returned 0x0 [0065.064] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0065.064] SelectObject (hdc=0x240109c0, h=0x185000f) returned 0xfffffffff30509d2 [0065.064] DeleteDC (hdc=0x240109c0) returned 1 [0065.064] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0065.064] DeleteObject (ho=0xfffffffff30509d2) returned 1 [0065.077] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0065.077] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.077] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.077] WaitMessage () returned 1 [0065.251] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.251] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.251] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.251] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.251] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.251] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0065.251] GetCurrentThreadId () returned 0xa28 [0065.251] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0065.251] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.251] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.251] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.251] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.251] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.251] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0065.251] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0065.251] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffe80109d7 [0065.251] GetObjectType (h=0x60109d6) returned 0x3 [0065.251] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffff40509d2 [0065.251] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff40509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.252] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff40509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.252] DeleteObject (ho=0xfffffffff40509d2) returned 1 [0065.252] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x250509c0 [0065.252] SelectObject (hdc=0xffffffffe80109d7, h=0x250509c0) returned 0x185000f [0065.252] GdipCreateFromHDC (hdc=0xffffffffe80109d7, graphics=0x26e408) returned 0x0 [0065.252] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0065.252] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0065.252] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0065.252] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0065.252] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0065.252] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.252] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0065.252] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.252] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0065.253] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0065.253] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0065.253] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0065.253] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0065.253] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.253] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.253] GetSystemMetrics (nIndex=42) returned 0 [0065.253] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.253] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.253] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0065.253] IsAppThemed () returned 0x1 [0065.253] GetThemeAppProperties () returned 0x3 [0065.253] GetThemeAppProperties () returned 0x3 [0065.253] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0065.253] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0065.253] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0065.253] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0065.253] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0065.254] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.254] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.254] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.254] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0065.254] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.254] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.254] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.254] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0065.254] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0065.254] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0065.254] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0065.254] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0065.254] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0065.254] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x1) returned 0x1b00017 [0065.254] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x2) returned 0x1900010 [0065.254] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x7) returned 0x250509c0 [0065.254] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x6) returned 0x18a002e [0065.254] SaveDC (hdc=0xffffffffe80109d7) returned 1 [0065.254] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5c0409f1 [0065.254] GetClipRgn (hdc=0xffffffffe80109d7, hrgn=0x5c0409f1) returned 0 [0065.254] SelectClipRgn (hdc=0xffffffffe80109d7, hrgn=0xffffffff830409ff) returned 2 [0065.254] DeleteObject (ho=0x5c0409f1) returned 1 [0065.254] DeleteObject (ho=0xffffffff830409ff) returned 1 [0065.254] OffsetViewportOrgEx (in: hdc=0xffffffffe80109d7, x=0, y=0, lppt=0x26c29c8 | out: lppt=0x26c29c8) returned 1 [0065.254] OffsetViewportOrgEx (in: hdc=0xffffffffe80109d7, x=-417, y=-278, lppt=0x26c29e0 | out: lppt=0x26c29e0) returned 1 [0065.255] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0065.255] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x1) returned 0x1b00017 [0065.255] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x2) returned 0x1900010 [0065.255] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x7) returned 0x250509c0 [0065.255] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x6) returned 0x18a002e [0065.255] SaveDC (hdc=0xffffffffe80109d7) returned 2 [0065.255] GetNearestColor (hdc=0xffffffffe80109d7, color=0x6c4607) returned 0x6c4607 [0065.255] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe6100276 [0065.255] FillRect (hDC=0xffffffffe80109d7, lprc=0x26de08, hbr=0xffffffffe6100276) returned 1 [0065.261] DeleteObject (ho=0xffffffffe6100276) returned 1 [0065.261] RestoreDC (hdc=0xffffffffe80109d7, nSavedDC=-1) returned 1 [0065.261] RestoreDC (hdc=0xffffffffe80109d7, nSavedDC=-1) returned 1 [0065.261] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe80109d7) returned 0x0 [0065.261] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc6a0dbd) returned 0x0 [0065.261] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0065.261] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.261] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.261] GetSystemMetrics (nIndex=42) returned 0 [0065.261] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.261] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.261] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0065.261] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0065.262] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0065.262] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0065.262] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0065.262] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0065.262] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x1) returned 0x1b00017 [0065.262] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x2) returned 0x1900010 [0065.262] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x7) returned 0x250509c0 [0065.262] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x6) returned 0x18a002e [0065.262] SaveDC (hdc=0xffffffffe80109d7) returned 1 [0065.262] GetNearestColor (hdc=0xffffffffe80109d7, color=0xf0f0f0) returned 0xf0f0f0 [0065.262] RestoreDC (hdc=0xffffffffe80109d7, nSavedDC=-1) returned 1 [0065.262] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe80109d7) returned 0x0 [0065.262] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0065.262] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0065.262] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0065.262] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0065.262] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x1) returned 0x1b00017 [0065.262] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x2) returned 0x1900010 [0065.262] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x7) returned 0x250509c0 [0065.262] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x6) returned 0x18a002e [0065.263] SaveDC (hdc=0xffffffffe80109d7) returned 1 [0065.263] GetTextAlign (hdc=0xffffffffe80109d7) returned 0x0 [0065.263] GetTextColor (hdc=0xffffffffe80109d7) returned 0x0 [0065.263] SetTextColor (hdc=0xffffffffe80109d7, color=0xf0f0f0) returned 0x0 [0065.263] GetCurrentObject (hdc=0xffffffffe80109d7, type=0x6) returned 0x18a002e [0065.263] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0065.263] SelectObject (hdc=0xffffffffe80109d7, h=0x260a09ba) returned 0x18a002e [0065.263] GetBkMode (hdc=0xffffffffe80109d7) returned 2 [0065.263] SetBkMode (hdc=0xffffffffe80109d7, mode=1) returned 2 [0065.263] DrawTextExW (in: hdc=0xffffffffe80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c3690 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0065.263] DrawTextExW (in: hdc=0xffffffffe80109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c3690 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0065.264] RestoreDC (hdc=0xffffffffe80109d7, nSavedDC=-1) returned 1 [0065.264] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe80109d7) returned 0x0 [0065.264] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0065.264] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffe80109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.264] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffe80109d7) returned 0x0 [0065.264] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0065.264] SelectObject (hdc=0xffffffffe80109d7, h=0x185000f) returned 0x250509c0 [0065.264] DeleteDC (hdc=0xffffffffe80109d7) returned 1 [0065.264] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0065.264] DeleteObject (ho=0x250509c0) returned 1 [0065.267] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0065.267] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.267] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.267] WaitMessage () returned 1 [0065.424] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.424] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.424] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.424] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.424] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.424] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0065.425] GetCurrentThreadId () returned 0xa28 [0065.425] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0065.425] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.425] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.425] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.425] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.425] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.425] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0065.425] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0065.425] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffff60109d2 [0065.425] GetObjectType (h=0x60109d6) returned 0x3 [0065.425] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x260509c0 [0065.425] GetDIBits (in: hdc=0x60109d6, hbm=0x260509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.425] GetDIBits (in: hdc=0x60109d6, hbm=0x260509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.425] DeleteObject (ho=0x260509c0) returned 1 [0065.425] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffe90509d7 [0065.425] SelectObject (hdc=0xfffffffff60109d2, h=0xffffffffe90509d7) returned 0x185000f [0065.425] GdipCreateFromHDC (hdc=0xfffffffff60109d2, graphics=0x26e408) returned 0x0 [0065.426] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0065.426] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0065.426] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0065.426] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0065.426] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0065.426] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.426] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0065.426] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.426] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0065.426] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0065.426] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0065.426] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0065.426] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0065.426] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.426] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.426] GetSystemMetrics (nIndex=42) returned 0 [0065.426] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.426] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.426] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0065.426] IsAppThemed () returned 0x1 [0065.426] GetThemeAppProperties () returned 0x3 [0065.426] GetThemeAppProperties () returned 0x3 [0065.426] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0065.426] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0065.426] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0065.427] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0065.427] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0065.427] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.427] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.427] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.427] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0065.427] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.427] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.427] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.427] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0065.427] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0065.427] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0065.427] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0065.427] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0065.427] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0065.427] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x1) returned 0x1b00017 [0065.427] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x2) returned 0x1900010 [0065.427] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x7) returned 0xffffffffe90509d7 [0065.427] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x6) returned 0x18a002e [0065.427] SaveDC (hdc=0xfffffffff60109d2) returned 1 [0065.427] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff840409ff [0065.427] GetClipRgn (hdc=0xfffffffff60109d2, hrgn=0xffffffff840409ff) returned 0 [0065.427] SelectClipRgn (hdc=0xfffffffff60109d2, hrgn=0x5f0409f1) returned 2 [0065.427] DeleteObject (ho=0xffffffff840409ff) returned 1 [0065.427] DeleteObject (ho=0x5f0409f1) returned 1 [0065.427] OffsetViewportOrgEx (in: hdc=0xfffffffff60109d2, x=0, y=0, lppt=0x27a1540 | out: lppt=0x27a1540) returned 1 [0065.428] OffsetViewportOrgEx (in: hdc=0xfffffffff60109d2, x=-417, y=-278, lppt=0x27a1558 | out: lppt=0x27a1558) returned 1 [0065.428] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0065.428] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x1) returned 0x1b00017 [0065.428] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x2) returned 0x1900010 [0065.428] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x7) returned 0xffffffffe90509d7 [0065.428] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x6) returned 0x18a002e [0065.428] SaveDC (hdc=0xfffffffff60109d2) returned 2 [0065.428] GetNearestColor (hdc=0xfffffffff60109d2, color=0x6c4607) returned 0x6c4607 [0065.428] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe7100276 [0065.428] FillRect (hDC=0xfffffffff60109d2, lprc=0x26de08, hbr=0xffffffffe7100276) returned 1 [0065.434] DeleteObject (ho=0xffffffffe7100276) returned 1 [0065.434] RestoreDC (hdc=0xfffffffff60109d2, nSavedDC=-1) returned 1 [0065.434] RestoreDC (hdc=0xfffffffff60109d2, nSavedDC=-1) returned 1 [0065.434] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff60109d2) returned 0x0 [0065.434] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc680dbd) returned 0x0 [0065.434] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0065.434] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.434] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.435] GetSystemMetrics (nIndex=42) returned 0 [0065.435] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.435] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.435] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x11) returned 0x0 [0065.435] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0065.435] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0065.435] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0065.435] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0065.435] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0065.436] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0065.436] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x1) returned 0x1b00017 [0065.436] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x2) returned 0x1900010 [0065.436] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x7) returned 0xffffffffe90509d7 [0065.436] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x6) returned 0x18a002e [0065.436] SaveDC (hdc=0xfffffffff60109d2) returned 1 [0065.436] GetNearestColor (hdc=0xfffffffff60109d2, color=0xf0f0f0) returned 0xf0f0f0 [0065.436] RestoreDC (hdc=0xfffffffff60109d2, nSavedDC=-1) returned 1 [0065.436] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff60109d2) returned 0x0 [0065.436] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0065.436] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0065.436] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0065.436] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x1) returned 0x1b00017 [0065.436] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x2) returned 0x1900010 [0065.436] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x7) returned 0xffffffffe90509d7 [0065.436] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x6) returned 0x18a002e [0065.436] SaveDC (hdc=0xfffffffff60109d2) returned 1 [0065.436] GetTextAlign (hdc=0xfffffffff60109d2) returned 0x0 [0065.436] GetTextColor (hdc=0xfffffffff60109d2) returned 0x0 [0065.436] SetTextColor (hdc=0xfffffffff60109d2, color=0xf0f0f0) returned 0x0 [0065.436] GetCurrentObject (hdc=0xfffffffff60109d2, type=0x6) returned 0x18a002e [0065.437] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0065.437] SelectObject (hdc=0xfffffffff60109d2, h=0x260a09ba) returned 0x18a002e [0065.437] GetBkMode (hdc=0xfffffffff60109d2) returned 2 [0065.437] SetBkMode (hdc=0xfffffffff60109d2, mode=1) returned 2 [0065.437] DrawTextExW (in: hdc=0xfffffffff60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27a2408 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0065.437] DrawTextExW (in: hdc=0xfffffffff60109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27a2408 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0065.437] RestoreDC (hdc=0xfffffffff60109d2, nSavedDC=-1) returned 1 [0065.437] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff60109d2) returned 0x0 [0065.437] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0065.437] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffff60109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.438] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff60109d2) returned 0x0 [0065.438] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0065.438] SelectObject (hdc=0xfffffffff60109d2, h=0x185000f) returned 0xffffffffe90509d7 [0065.438] DeleteDC (hdc=0xfffffffff60109d2) returned 1 [0065.438] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0065.438] DeleteObject (ho=0xffffffffe90509d7) returned 1 [0065.445] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0065.445] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.445] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.445] WaitMessage () returned 1 [0065.584] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.584] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.584] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.584] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.584] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.584] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0065.584] GetCurrentThreadId () returned 0xa28 [0065.584] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0065.584] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.584] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.584] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.584] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.584] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.584] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0065.584] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0065.584] CreateCompatibleDC (hdc=0x60109d6) returned 0x280109c0 [0065.584] GetObjectType (h=0x60109d6) returned 0x3 [0065.584] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffea0509d7 [0065.584] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffea0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.585] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffea0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.585] DeleteObject (ho=0xffffffffea0509d7) returned 1 [0065.585] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffff70509d2 [0065.585] SelectObject (hdc=0x280109c0, h=0xfffffffff70509d2) returned 0x185000f [0065.585] GdipCreateFromHDC (hdc=0x280109c0, graphics=0x26e408) returned 0x0 [0065.585] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0065.585] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0065.585] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0065.585] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0065.585] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0065.585] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.585] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0065.585] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.585] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0065.585] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0065.585] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0065.585] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0065.585] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0065.586] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.586] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.586] GetSystemMetrics (nIndex=42) returned 0 [0065.586] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.586] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.586] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0065.586] IsAppThemed () returned 0x1 [0065.586] GetThemeAppProperties () returned 0x3 [0065.586] GetThemeAppProperties () returned 0x3 [0065.586] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0065.586] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0065.586] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0065.586] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0065.586] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0065.586] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.586] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.586] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.586] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0065.586] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.586] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.586] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.586] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0065.586] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0065.586] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0065.586] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0065.586] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0065.586] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0065.586] GetCurrentObject (hdc=0x280109c0, type=0x1) returned 0x1b00017 [0065.587] GetCurrentObject (hdc=0x280109c0, type=0x2) returned 0x1900010 [0065.587] GetCurrentObject (hdc=0x280109c0, type=0x7) returned 0xfffffffff70509d2 [0065.587] GetCurrentObject (hdc=0x280109c0, type=0x6) returned 0x18a002e [0065.587] SaveDC (hdc=0x280109c0) returned 1 [0065.587] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x600409f1 [0065.587] GetClipRgn (hdc=0x280109c0, hrgn=0x600409f1) returned 0 [0065.587] SelectClipRgn (hdc=0x280109c0, hrgn=0xffffffff870409ff) returned 2 [0065.587] DeleteObject (ho=0x600409f1) returned 1 [0065.587] DeleteObject (ho=0xffffffff870409ff) returned 1 [0065.587] OffsetViewportOrgEx (in: hdc=0x280109c0, x=0, y=0, lppt=0x26a9808 | out: lppt=0x26a9808) returned 1 [0065.587] OffsetViewportOrgEx (in: hdc=0x280109c0, x=-417, y=-278, lppt=0x26a9820 | out: lppt=0x26a9820) returned 1 [0065.587] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0065.587] GetCurrentObject (hdc=0x280109c0, type=0x1) returned 0x1b00017 [0065.587] GetCurrentObject (hdc=0x280109c0, type=0x2) returned 0x1900010 [0065.587] GetCurrentObject (hdc=0x280109c0, type=0x7) returned 0xfffffffff70509d2 [0065.587] GetCurrentObject (hdc=0x280109c0, type=0x6) returned 0x18a002e [0065.587] SaveDC (hdc=0x280109c0) returned 2 [0065.587] GetNearestColor (hdc=0x280109c0, color=0x6c4607) returned 0x6c4607 [0065.587] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe8100276 [0065.587] FillRect (hDC=0x280109c0, lprc=0x26de08, hbr=0xffffffffe8100276) returned 1 [0065.594] DeleteObject (ho=0xffffffffe8100276) returned 1 [0065.594] RestoreDC (hdc=0x280109c0, nSavedDC=-1) returned 1 [0065.594] RestoreDC (hdc=0x280109c0, nSavedDC=-1) returned 1 [0065.594] GdipReleaseDC (graphics=0x1b86d040, hdc=0x280109c0) returned 0x0 [0065.594] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc660dbd) returned 0x0 [0065.594] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0065.594] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.594] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.594] GetSystemMetrics (nIndex=42) returned 0 [0065.594] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.594] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.594] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0065.594] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0065.594] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0065.594] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0065.594] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0065.594] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0065.594] GetCurrentObject (hdc=0x280109c0, type=0x1) returned 0x1b00017 [0065.594] GetCurrentObject (hdc=0x280109c0, type=0x2) returned 0x1900010 [0065.594] GetCurrentObject (hdc=0x280109c0, type=0x7) returned 0xfffffffff70509d2 [0065.594] GetCurrentObject (hdc=0x280109c0, type=0x6) returned 0x18a002e [0065.594] SaveDC (hdc=0x280109c0) returned 1 [0065.594] GetNearestColor (hdc=0x280109c0, color=0xf0f0f0) returned 0xf0f0f0 [0065.594] RestoreDC (hdc=0x280109c0, nSavedDC=-1) returned 1 [0065.595] GdipReleaseDC (graphics=0x1b86d040, hdc=0x280109c0) returned 0x0 [0065.595] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0065.595] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0065.595] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0065.595] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0065.595] GetCurrentObject (hdc=0x280109c0, type=0x1) returned 0x1b00017 [0065.595] GetCurrentObject (hdc=0x280109c0, type=0x2) returned 0x1900010 [0065.595] GetCurrentObject (hdc=0x280109c0, type=0x7) returned 0xfffffffff70509d2 [0065.595] GetCurrentObject (hdc=0x280109c0, type=0x6) returned 0x18a002e [0065.595] SaveDC (hdc=0x280109c0) returned 1 [0065.595] GetTextAlign (hdc=0x280109c0) returned 0x0 [0065.595] GetTextColor (hdc=0x280109c0) returned 0x0 [0065.595] SetTextColor (hdc=0x280109c0, color=0xf0f0f0) returned 0x0 [0065.595] GetCurrentObject (hdc=0x280109c0, type=0x6) returned 0x18a002e [0065.595] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0065.595] SelectObject (hdc=0x280109c0, h=0x260a09ba) returned 0x18a002e [0065.595] GetBkMode (hdc=0x280109c0) returned 2 [0065.595] SetBkMode (hdc=0x280109c0, mode=1) returned 2 [0065.595] DrawTextExW (in: hdc=0x280109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26aa4d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0065.596] DrawTextExW (in: hdc=0x280109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26aa4d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0065.596] RestoreDC (hdc=0x280109c0, nSavedDC=-1) returned 1 [0065.596] GdipReleaseDC (graphics=0x1b86d040, hdc=0x280109c0) returned 0x0 [0065.596] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0065.596] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x280109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.597] GdipReleaseDC (graphics=0x1b86d040, hdc=0x280109c0) returned 0x0 [0065.597] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0065.597] SelectObject (hdc=0x280109c0, h=0x185000f) returned 0xfffffffff70509d2 [0065.597] DeleteDC (hdc=0x280109c0) returned 1 [0065.597] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0065.597] DeleteObject (ho=0xfffffffff70509d2) returned 1 [0065.600] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0065.600] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.600] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.600] WaitMessage () returned 1 [0065.737] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.737] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.737] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.737] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.737] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.737] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0065.737] GetCurrentThreadId () returned 0xa28 [0065.737] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0065.738] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.738] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.738] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.738] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.738] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.738] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0065.738] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0065.738] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffec0109d7 [0065.738] GetObjectType (h=0x60109d6) returned 0x3 [0065.738] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffff80509d2 [0065.738] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff80509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.739] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff80509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.739] DeleteObject (ho=0xfffffffff80509d2) returned 1 [0065.739] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x290509c0 [0065.739] SelectObject (hdc=0xffffffffec0109d7, h=0x290509c0) returned 0x185000f [0065.739] GdipCreateFromHDC (hdc=0xffffffffec0109d7, graphics=0x26e408) returned 0x0 [0065.739] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0065.739] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0065.739] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0065.739] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0065.739] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0065.739] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.739] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0065.739] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.739] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0065.739] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0065.739] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0065.739] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0065.739] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0065.739] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.740] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.740] GetSystemMetrics (nIndex=42) returned 0 [0065.740] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.740] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.740] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0065.740] IsAppThemed () returned 0x1 [0065.740] GetThemeAppProperties () returned 0x3 [0065.740] GetThemeAppProperties () returned 0x3 [0065.740] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0065.740] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0065.740] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0065.740] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0065.740] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0065.740] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.740] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.740] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.740] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0065.740] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.740] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.740] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.740] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0065.740] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0065.740] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0065.740] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0065.740] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0065.740] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0065.740] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x1) returned 0x1b00017 [0065.740] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x2) returned 0x1900010 [0065.740] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x7) returned 0x290509c0 [0065.740] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x6) returned 0x18a002e [0065.741] SaveDC (hdc=0xffffffffec0109d7) returned 1 [0065.741] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff880409ff [0065.741] GetClipRgn (hdc=0xffffffffec0109d7, hrgn=0xffffffff880409ff) returned 0 [0065.741] SelectClipRgn (hdc=0xffffffffec0109d7, hrgn=0x630409f1) returned 2 [0065.741] DeleteObject (ho=0xffffffff880409ff) returned 1 [0065.741] DeleteObject (ho=0x630409f1) returned 1 [0065.741] OffsetViewportOrgEx (in: hdc=0xffffffffec0109d7, x=0, y=0, lppt=0x2692328 | out: lppt=0x2692328) returned 1 [0065.741] OffsetViewportOrgEx (in: hdc=0xffffffffec0109d7, x=-417, y=-278, lppt=0x2692340 | out: lppt=0x2692340) returned 1 [0065.741] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0065.741] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x1) returned 0x1b00017 [0065.741] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x2) returned 0x1900010 [0065.741] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x7) returned 0x290509c0 [0065.741] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x6) returned 0x18a002e [0065.741] SaveDC (hdc=0xffffffffec0109d7) returned 2 [0065.741] GetNearestColor (hdc=0xffffffffec0109d7, color=0x6c4607) returned 0x6c4607 [0065.741] CreateSolidBrush (color=0x6c4607) returned 0xffffffffe9100276 [0065.741] FillRect (hDC=0xffffffffec0109d7, lprc=0x26de08, hbr=0xffffffffe9100276) returned 1 [0065.747] DeleteObject (ho=0xffffffffe9100276) returned 1 [0065.747] RestoreDC (hdc=0xffffffffec0109d7, nSavedDC=-1) returned 1 [0065.748] RestoreDC (hdc=0xffffffffec0109d7, nSavedDC=-1) returned 1 [0065.748] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffec0109d7) returned 0x0 [0065.748] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc640dbd) returned 0x0 [0065.748] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0065.748] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.748] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.748] GetSystemMetrics (nIndex=42) returned 0 [0065.748] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.748] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.748] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x13) returned 0x0 [0065.749] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0065.749] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0065.749] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0065.749] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0065.749] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0065.749] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0065.749] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x1) returned 0x1b00017 [0065.749] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x2) returned 0x1900010 [0065.749] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x7) returned 0x290509c0 [0065.749] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x6) returned 0x18a002e [0065.749] SaveDC (hdc=0xffffffffec0109d7) returned 1 [0065.749] GetNearestColor (hdc=0xffffffffec0109d7, color=0xf0f0f0) returned 0xf0f0f0 [0065.749] RestoreDC (hdc=0xffffffffec0109d7, nSavedDC=-1) returned 1 [0065.749] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffec0109d7) returned 0x0 [0065.749] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0065.749] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0065.749] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0065.750] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0065.750] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x1) returned 0x1b00017 [0065.750] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x2) returned 0x1900010 [0065.750] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x7) returned 0x290509c0 [0065.750] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x6) returned 0x18a002e [0065.750] SaveDC (hdc=0xffffffffec0109d7) returned 1 [0065.750] GetTextAlign (hdc=0xffffffffec0109d7) returned 0x0 [0065.750] GetTextColor (hdc=0xffffffffec0109d7) returned 0x0 [0065.750] SetTextColor (hdc=0xffffffffec0109d7, color=0xf0f0f0) returned 0x0 [0065.750] GetCurrentObject (hdc=0xffffffffec0109d7, type=0x6) returned 0x18a002e [0065.750] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0065.750] SelectObject (hdc=0xffffffffec0109d7, h=0x260a09ba) returned 0x18a002e [0065.750] GetBkMode (hdc=0xffffffffec0109d7) returned 2 [0065.750] SetBkMode (hdc=0xffffffffec0109d7, mode=1) returned 2 [0065.750] DrawTextExW (in: hdc=0xffffffffec0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26931f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0065.750] DrawTextExW (in: hdc=0xffffffffec0109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26931f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0065.751] RestoreDC (hdc=0xffffffffec0109d7, nSavedDC=-1) returned 1 [0065.751] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffec0109d7) returned 0x0 [0065.751] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0065.751] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffec0109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.751] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffec0109d7) returned 0x0 [0065.751] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0065.751] SelectObject (hdc=0xffffffffec0109d7, h=0x185000f) returned 0x290509c0 [0065.751] DeleteDC (hdc=0xffffffffec0109d7) returned 1 [0065.751] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0065.751] DeleteObject (ho=0x290509c0) returned 1 [0065.755] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0065.755] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.755] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.755] WaitMessage () returned 1 [0065.913] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.913] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.913] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.913] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.913] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.914] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0065.914] GetCurrentThreadId () returned 0xa28 [0065.914] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0065.914] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.914] IsWindowUnicode (hWnd=0x3015e) returned 1 [0065.914] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0065.914] TranslateMessage (lpMsg=0x26ee10) returned 0 [0065.914] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0065.914] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0065.914] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0065.914] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffffa0109d2 [0065.914] GetObjectType (h=0x60109d6) returned 0x3 [0065.914] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x2a0509c0 [0065.914] GetDIBits (in: hdc=0x60109d6, hbm=0x2a0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.914] GetDIBits (in: hdc=0x60109d6, hbm=0x2a0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0065.914] DeleteObject (ho=0x2a0509c0) returned 1 [0065.914] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffed0509d7 [0065.914] SelectObject (hdc=0xfffffffffa0109d2, h=0xffffffffed0509d7) returned 0x185000f [0065.915] GdipCreateFromHDC (hdc=0xfffffffffa0109d2, graphics=0x26e408) returned 0x0 [0065.915] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0065.915] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0065.915] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0065.915] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0065.915] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0065.915] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.915] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0065.915] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.915] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0065.915] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0065.915] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0065.915] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0065.915] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0065.915] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.915] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.915] GetSystemMetrics (nIndex=42) returned 0 [0065.915] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.915] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.915] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0065.915] IsAppThemed () returned 0x1 [0065.915] GetThemeAppProperties () returned 0x3 [0065.916] GetThemeAppProperties () returned 0x3 [0065.916] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0065.916] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0065.916] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0065.916] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0065.916] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0065.916] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.916] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.916] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.916] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0065.916] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0065.916] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0065.916] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0065.916] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0065.916] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0065.916] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0065.916] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0065.916] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0065.916] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0065.916] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x1) returned 0x1b00017 [0065.916] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x2) returned 0x1900010 [0065.916] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x7) returned 0xffffffffed0509d7 [0065.916] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x6) returned 0x18a002e [0065.916] SaveDC (hdc=0xfffffffffa0109d2) returned 1 [0065.916] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x640409f1 [0065.916] GetClipRgn (hdc=0xfffffffffa0109d2, hrgn=0x640409f1) returned 0 [0065.916] SelectClipRgn (hdc=0xfffffffffa0109d2, hrgn=0xffffffff8b0409ff) returned 2 [0065.916] DeleteObject (ho=0x640409f1) returned 1 [0065.917] DeleteObject (ho=0xffffffff8b0409ff) returned 1 [0065.917] OffsetViewportOrgEx (in: hdc=0xfffffffffa0109d2, x=0, y=0, lppt=0x27d33f0 | out: lppt=0x27d33f0) returned 1 [0065.917] OffsetViewportOrgEx (in: hdc=0xfffffffffa0109d2, x=-417, y=-278, lppt=0x27d3408 | out: lppt=0x27d3408) returned 1 [0065.917] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0065.917] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x1) returned 0x1b00017 [0065.917] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x2) returned 0x1900010 [0065.917] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x7) returned 0xffffffffed0509d7 [0065.917] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x6) returned 0x18a002e [0065.917] SaveDC (hdc=0xfffffffffa0109d2) returned 2 [0065.917] GetNearestColor (hdc=0xfffffffffa0109d2, color=0x6c4607) returned 0x6c4607 [0065.917] CreateSolidBrush (color=0x6c4607) returned 0xffffffffea100276 [0065.917] FillRect (hDC=0xfffffffffa0109d2, lprc=0x26de08, hbr=0xffffffffea100276) returned 1 [0065.923] DeleteObject (ho=0xffffffffea100276) returned 1 [0065.924] RestoreDC (hdc=0xfffffffffa0109d2, nSavedDC=-1) returned 1 [0065.924] RestoreDC (hdc=0xfffffffffa0109d2, nSavedDC=-1) returned 1 [0065.924] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffa0109d2) returned 0x0 [0065.924] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc620dbd) returned 0x0 [0065.924] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0065.924] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0065.924] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0065.924] GetSystemMetrics (nIndex=42) returned 0 [0065.924] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0065.924] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0065.924] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0065.924] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0065.924] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0065.924] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0065.924] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0065.924] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0065.924] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x1) returned 0x1b00017 [0065.924] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x2) returned 0x1900010 [0065.924] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x7) returned 0xffffffffed0509d7 [0065.924] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x6) returned 0x18a002e [0065.924] SaveDC (hdc=0xfffffffffa0109d2) returned 1 [0065.924] GetNearestColor (hdc=0xfffffffffa0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0065.924] RestoreDC (hdc=0xfffffffffa0109d2, nSavedDC=-1) returned 1 [0065.924] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffa0109d2) returned 0x0 [0065.925] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0065.925] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0065.925] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0065.925] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x1) returned 0x1b00017 [0065.925] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x2) returned 0x1900010 [0065.925] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x7) returned 0xffffffffed0509d7 [0065.925] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x6) returned 0x18a002e [0065.925] SaveDC (hdc=0xfffffffffa0109d2) returned 1 [0065.925] GetTextAlign (hdc=0xfffffffffa0109d2) returned 0x0 [0065.925] GetTextColor (hdc=0xfffffffffa0109d2) returned 0x0 [0065.925] SetTextColor (hdc=0xfffffffffa0109d2, color=0xf0f0f0) returned 0x0 [0065.925] GetCurrentObject (hdc=0xfffffffffa0109d2, type=0x6) returned 0x18a002e [0065.925] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0065.925] SelectObject (hdc=0xfffffffffa0109d2, h=0x260a09ba) returned 0x18a002e [0065.925] GetBkMode (hdc=0xfffffffffa0109d2) returned 2 [0065.925] SetBkMode (hdc=0xfffffffffa0109d2, mode=1) returned 2 [0065.925] DrawTextExW (in: hdc=0xfffffffffa0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27d40b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0065.925] DrawTextExW (in: hdc=0xfffffffffa0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27d40b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0065.926] RestoreDC (hdc=0xfffffffffa0109d2, nSavedDC=-1) returned 1 [0065.926] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffa0109d2) returned 0x0 [0065.926] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0065.926] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffffa0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.926] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffa0109d2) returned 0x0 [0065.926] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0065.926] SelectObject (hdc=0xfffffffffa0109d2, h=0x185000f) returned 0xffffffffed0509d7 [0065.926] DeleteDC (hdc=0xfffffffffa0109d2) returned 1 [0065.926] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0065.926] DeleteObject (ho=0xffffffffed0509d7) returned 1 [0065.929] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0065.930] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.930] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0065.930] WaitMessage () returned 1 [0066.112] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.112] IsWindowUnicode (hWnd=0x3015e) returned 1 [0066.112] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.112] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.112] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.112] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0066.112] GetCurrentThreadId () returned 0xa28 [0066.112] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0066.112] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.112] IsWindowUnicode (hWnd=0x3015e) returned 1 [0066.112] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.112] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.112] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.112] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0066.112] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0066.112] CreateCompatibleDC (hdc=0x60109d6) returned 0x2c0109c0 [0066.112] GetObjectType (h=0x60109d6) returned 0x3 [0066.112] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffee0509d7 [0066.112] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffee0509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.113] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffee0509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.113] DeleteObject (ho=0xffffffffee0509d7) returned 1 [0066.113] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffffb0509d2 [0066.113] SelectObject (hdc=0x2c0109c0, h=0xfffffffffb0509d2) returned 0x185000f [0066.113] GdipCreateFromHDC (hdc=0x2c0109c0, graphics=0x26e408) returned 0x0 [0066.113] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0066.113] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0066.113] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0066.113] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0066.113] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0066.113] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.114] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0066.114] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.114] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0066.114] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0066.114] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0066.114] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0066.114] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0066.114] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.114] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.114] GetSystemMetrics (nIndex=42) returned 0 [0066.114] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0066.114] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.114] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0066.114] IsAppThemed () returned 0x1 [0066.114] GetThemeAppProperties () returned 0x3 [0066.114] GetThemeAppProperties () returned 0x3 [0066.114] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0066.114] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0066.114] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0066.114] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0066.114] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0066.114] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.114] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.114] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.114] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0066.114] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.114] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.115] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.115] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0066.115] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0066.115] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0066.115] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0066.115] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0066.115] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0066.115] GetCurrentObject (hdc=0x2c0109c0, type=0x1) returned 0x1b00017 [0066.115] GetCurrentObject (hdc=0x2c0109c0, type=0x2) returned 0x1900010 [0066.115] GetCurrentObject (hdc=0x2c0109c0, type=0x7) returned 0xfffffffffb0509d2 [0066.115] GetCurrentObject (hdc=0x2c0109c0, type=0x6) returned 0x18a002e [0066.115] SaveDC (hdc=0x2c0109c0) returned 1 [0066.115] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff8c0409ff [0066.115] GetClipRgn (hdc=0x2c0109c0, hrgn=0xffffffff8c0409ff) returned 0 [0066.115] SelectClipRgn (hdc=0x2c0109c0, hrgn=0x670409f1) returned 2 [0066.115] DeleteObject (ho=0xffffffff8c0409ff) returned 1 [0066.115] DeleteObject (ho=0x670409f1) returned 1 [0066.115] OffsetViewportOrgEx (in: hdc=0x2c0109c0, x=0, y=0, lppt=0x276d888 | out: lppt=0x276d888) returned 1 [0066.115] OffsetViewportOrgEx (in: hdc=0x2c0109c0, x=-417, y=-278, lppt=0x276d8a0 | out: lppt=0x276d8a0) returned 1 [0066.115] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0066.115] GetCurrentObject (hdc=0x2c0109c0, type=0x1) returned 0x1b00017 [0066.115] GetCurrentObject (hdc=0x2c0109c0, type=0x2) returned 0x1900010 [0066.115] GetCurrentObject (hdc=0x2c0109c0, type=0x7) returned 0xfffffffffb0509d2 [0066.115] GetCurrentObject (hdc=0x2c0109c0, type=0x6) returned 0x18a002e [0066.116] SaveDC (hdc=0x2c0109c0) returned 2 [0066.116] GetNearestColor (hdc=0x2c0109c0, color=0x6c4607) returned 0x6c4607 [0066.116] CreateSolidBrush (color=0x6c4607) returned 0xffffffffeb100276 [0066.116] FillRect (hDC=0x2c0109c0, lprc=0x26de08, hbr=0xffffffffeb100276) returned 1 [0066.122] DeleteObject (ho=0xffffffffeb100276) returned 1 [0066.122] RestoreDC (hdc=0x2c0109c0, nSavedDC=-1) returned 1 [0066.122] RestoreDC (hdc=0x2c0109c0, nSavedDC=-1) returned 1 [0066.122] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2c0109c0) returned 0x0 [0066.122] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc600dbd) returned 0x0 [0066.122] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0066.122] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.122] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.122] GetSystemMetrics (nIndex=42) returned 0 [0066.122] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0066.122] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.122] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x15) returned 0x0 [0066.123] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0066.123] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0066.123] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0066.123] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0066.123] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0066.123] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0066.123] GetCurrentObject (hdc=0x2c0109c0, type=0x1) returned 0x1b00017 [0066.123] GetCurrentObject (hdc=0x2c0109c0, type=0x2) returned 0x1900010 [0066.123] GetCurrentObject (hdc=0x2c0109c0, type=0x7) returned 0xfffffffffb0509d2 [0066.123] GetCurrentObject (hdc=0x2c0109c0, type=0x6) returned 0x18a002e [0066.124] SaveDC (hdc=0x2c0109c0) returned 1 [0066.124] GetNearestColor (hdc=0x2c0109c0, color=0xf0f0f0) returned 0xf0f0f0 [0066.124] RestoreDC (hdc=0x2c0109c0, nSavedDC=-1) returned 1 [0066.124] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2c0109c0) returned 0x0 [0066.124] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0066.124] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0066.124] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0066.124] GetCurrentObject (hdc=0x2c0109c0, type=0x1) returned 0x1b00017 [0066.124] GetCurrentObject (hdc=0x2c0109c0, type=0x2) returned 0x1900010 [0066.124] GetCurrentObject (hdc=0x2c0109c0, type=0x7) returned 0xfffffffffb0509d2 [0066.124] GetCurrentObject (hdc=0x2c0109c0, type=0x6) returned 0x18a002e [0066.124] SaveDC (hdc=0x2c0109c0) returned 1 [0066.124] GetTextAlign (hdc=0x2c0109c0) returned 0x0 [0066.124] GetTextColor (hdc=0x2c0109c0) returned 0x0 [0066.124] SetTextColor (hdc=0x2c0109c0, color=0xf0f0f0) returned 0x0 [0066.124] GetCurrentObject (hdc=0x2c0109c0, type=0x6) returned 0x18a002e [0066.124] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0066.124] SelectObject (hdc=0x2c0109c0, h=0x260a09ba) returned 0x18a002e [0066.124] GetBkMode (hdc=0x2c0109c0) returned 2 [0066.125] SetBkMode (hdc=0x2c0109c0, mode=1) returned 2 [0066.125] DrawTextExW (in: hdc=0x2c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x276e758 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0066.125] DrawTextExW (in: hdc=0x2c0109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x276e758 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0066.125] RestoreDC (hdc=0x2c0109c0, nSavedDC=-1) returned 1 [0066.125] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2c0109c0) returned 0x0 [0066.125] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0066.125] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x2c0109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0066.126] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2c0109c0) returned 0x0 [0066.126] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0066.126] SelectObject (hdc=0x2c0109c0, h=0x185000f) returned 0xfffffffffb0509d2 [0066.126] DeleteDC (hdc=0x2c0109c0) returned 1 [0066.126] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0066.126] DeleteObject (ho=0xfffffffffb0509d2) returned 1 [0066.130] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0066.130] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.130] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.130] WaitMessage () returned 1 [0066.329] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.329] IsWindowUnicode (hWnd=0x3015e) returned 1 [0066.329] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.329] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.329] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.330] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0066.330] GetCurrentThreadId () returned 0xa28 [0066.330] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0066.330] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.330] IsWindowUnicode (hWnd=0x3015e) returned 1 [0066.330] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.330] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.330] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.330] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0066.330] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0066.330] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffff00109d7 [0066.330] GetObjectType (h=0x60109d6) returned 0x3 [0066.330] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffffc0509d2 [0066.330] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffffc0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.330] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffffc0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.330] DeleteObject (ho=0xfffffffffc0509d2) returned 1 [0066.330] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x2d0509c0 [0066.331] SelectObject (hdc=0xfffffffff00109d7, h=0x2d0509c0) returned 0x185000f [0066.331] GdipCreateFromHDC (hdc=0xfffffffff00109d7, graphics=0x26e408) returned 0x0 [0066.331] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0066.331] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0066.331] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0066.331] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0066.331] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0066.331] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.331] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0066.331] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.331] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0066.331] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0066.331] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0066.331] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0066.331] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0066.331] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.331] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.331] GetSystemMetrics (nIndex=42) returned 0 [0066.331] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0066.331] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.332] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0066.332] IsAppThemed () returned 0x1 [0066.332] GetThemeAppProperties () returned 0x3 [0066.332] GetThemeAppProperties () returned 0x3 [0066.332] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0066.332] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0066.332] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0066.332] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0066.332] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0066.332] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.332] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.332] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.332] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0066.332] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.332] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.332] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.332] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0066.332] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0066.332] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0066.332] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0066.332] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0066.332] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0066.332] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x1) returned 0x1b00017 [0066.332] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x2) returned 0x1900010 [0066.332] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x7) returned 0x2d0509c0 [0066.332] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x6) returned 0x18a002e [0066.332] SaveDC (hdc=0xfffffffff00109d7) returned 1 [0066.332] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x680409f1 [0066.332] GetClipRgn (hdc=0xfffffffff00109d7, hrgn=0x680409f1) returned 0 [0066.333] SelectClipRgn (hdc=0xfffffffff00109d7, hrgn=0xffffffff8f0409ff) returned 2 [0066.333] DeleteObject (ho=0x680409f1) returned 1 [0066.333] DeleteObject (ho=0xffffffff8f0409ff) returned 1 [0066.333] OffsetViewportOrgEx (in: hdc=0xfffffffff00109d7, x=0, y=0, lppt=0x26bc328 | out: lppt=0x26bc328) returned 1 [0066.333] OffsetViewportOrgEx (in: hdc=0xfffffffff00109d7, x=-417, y=-278, lppt=0x26bc340 | out: lppt=0x26bc340) returned 1 [0066.333] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0066.333] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x1) returned 0x1b00017 [0066.333] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x2) returned 0x1900010 [0066.333] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x7) returned 0x2d0509c0 [0066.333] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x6) returned 0x18a002e [0066.333] SaveDC (hdc=0xfffffffff00109d7) returned 2 [0066.333] GetNearestColor (hdc=0xfffffffff00109d7, color=0x6c4607) returned 0x6c4607 [0066.333] CreateSolidBrush (color=0x6c4607) returned 0xffffffffec100276 [0066.333] FillRect (hDC=0xfffffffff00109d7, lprc=0x26de08, hbr=0xffffffffec100276) returned 1 [0066.339] DeleteObject (ho=0xffffffffec100276) returned 1 [0066.339] RestoreDC (hdc=0xfffffffff00109d7, nSavedDC=-1) returned 1 [0066.339] RestoreDC (hdc=0xfffffffff00109d7, nSavedDC=-1) returned 1 [0066.339] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff00109d7) returned 0x0 [0066.340] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc5e0dbd) returned 0x0 [0066.340] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0066.340] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.340] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.340] GetSystemMetrics (nIndex=42) returned 0 [0066.340] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0066.340] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.340] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0066.340] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0066.340] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0066.340] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0066.340] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0066.340] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0066.340] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x1) returned 0x1b00017 [0066.340] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x2) returned 0x1900010 [0066.340] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x7) returned 0x2d0509c0 [0066.340] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x6) returned 0x18a002e [0066.340] SaveDC (hdc=0xfffffffff00109d7) returned 1 [0066.340] GetNearestColor (hdc=0xfffffffff00109d7, color=0xf0f0f0) returned 0xf0f0f0 [0066.340] RestoreDC (hdc=0xfffffffff00109d7, nSavedDC=-1) returned 1 [0066.340] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff00109d7) returned 0x0 [0066.341] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0066.341] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0066.341] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0066.341] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x1) returned 0x1b00017 [0066.341] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x2) returned 0x1900010 [0066.341] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x7) returned 0x2d0509c0 [0066.341] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x6) returned 0x18a002e [0066.341] SaveDC (hdc=0xfffffffff00109d7) returned 1 [0066.341] GetTextAlign (hdc=0xfffffffff00109d7) returned 0x0 [0066.341] GetTextColor (hdc=0xfffffffff00109d7) returned 0x0 [0066.341] SetTextColor (hdc=0xfffffffff00109d7, color=0xf0f0f0) returned 0x0 [0066.341] GetCurrentObject (hdc=0xfffffffff00109d7, type=0x6) returned 0x18a002e [0066.341] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0066.341] SelectObject (hdc=0xfffffffff00109d7, h=0x260a09ba) returned 0x18a002e [0066.341] GetBkMode (hdc=0xfffffffff00109d7) returned 2 [0066.341] SetBkMode (hdc=0xfffffffff00109d7, mode=1) returned 2 [0066.341] DrawTextExW (in: hdc=0xfffffffff00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26bcff0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0066.341] DrawTextExW (in: hdc=0xfffffffff00109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26bcff0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0066.342] RestoreDC (hdc=0xfffffffff00109d7, nSavedDC=-1) returned 1 [0066.342] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff00109d7) returned 0x0 [0066.342] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0066.342] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffff00109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0066.342] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff00109d7) returned 0x0 [0066.342] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0066.342] SelectObject (hdc=0xfffffffff00109d7, h=0x185000f) returned 0x2d0509c0 [0066.342] DeleteDC (hdc=0xfffffffff00109d7) returned 1 [0066.342] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0066.342] DeleteObject (ho=0x2d0509c0) returned 1 [0066.346] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0066.346] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.346] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.346] WaitMessage () returned 1 [0066.564] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.564] IsWindowUnicode (hWnd=0x3015e) returned 1 [0066.564] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.564] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.564] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.564] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0066.564] GetCurrentThreadId () returned 0xa28 [0066.564] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0066.564] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.564] IsWindowUnicode (hWnd=0x3015e) returned 1 [0066.564] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.564] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.564] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.564] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0066.564] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0066.564] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffffe0109d2 [0066.564] GetObjectType (h=0x60109d6) returned 0x3 [0066.564] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x2e0509c0 [0066.564] GetDIBits (in: hdc=0x60109d6, hbm=0x2e0509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.565] GetDIBits (in: hdc=0x60109d6, hbm=0x2e0509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.565] DeleteObject (ho=0x2e0509c0) returned 1 [0066.565] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffff10509d7 [0066.565] SelectObject (hdc=0xfffffffffe0109d2, h=0xfffffffff10509d7) returned 0x185000f [0066.565] GdipCreateFromHDC (hdc=0xfffffffffe0109d2, graphics=0x26e408) returned 0x0 [0066.565] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0066.565] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0066.565] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0066.565] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0066.565] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0066.565] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.565] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0066.565] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.565] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0066.565] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0066.565] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0066.565] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0066.565] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0066.565] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.565] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.565] GetSystemMetrics (nIndex=42) returned 0 [0066.565] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0066.566] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.566] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0066.566] IsAppThemed () returned 0x1 [0066.566] GetThemeAppProperties () returned 0x3 [0066.566] GetThemeAppProperties () returned 0x3 [0066.566] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0066.566] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0066.566] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0066.566] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0066.566] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0066.566] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.566] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.566] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.566] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0066.566] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.566] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.566] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.566] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0066.566] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0066.566] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0066.566] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0066.566] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0066.566] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0066.566] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x1) returned 0x1b00017 [0066.566] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x2) returned 0x1900010 [0066.566] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x7) returned 0xfffffffff10509d7 [0066.566] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x6) returned 0x18a002e [0066.566] SaveDC (hdc=0xfffffffffe0109d2) returned 1 [0066.567] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff900409ff [0066.567] GetClipRgn (hdc=0xfffffffffe0109d2, hrgn=0xffffffff900409ff) returned 0 [0066.567] SelectClipRgn (hdc=0xfffffffffe0109d2, hrgn=0x6b0409f1) returned 2 [0066.567] DeleteObject (ho=0xffffffff900409ff) returned 1 [0066.567] DeleteObject (ho=0x6b0409f1) returned 1 [0066.567] OffsetViewportOrgEx (in: hdc=0xfffffffffe0109d2, x=0, y=0, lppt=0x2749d80 | out: lppt=0x2749d80) returned 1 [0066.567] OffsetViewportOrgEx (in: hdc=0xfffffffffe0109d2, x=-417, y=-278, lppt=0x2749d98 | out: lppt=0x2749d98) returned 1 [0066.567] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0066.567] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x1) returned 0x1b00017 [0066.567] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x2) returned 0x1900010 [0066.567] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x7) returned 0xfffffffff10509d7 [0066.567] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x6) returned 0x18a002e [0066.567] SaveDC (hdc=0xfffffffffe0109d2) returned 2 [0066.567] GetNearestColor (hdc=0xfffffffffe0109d2, color=0x6c4607) returned 0x6c4607 [0066.567] CreateSolidBrush (color=0x6c4607) returned 0xffffffffed100276 [0066.567] FillRect (hDC=0xfffffffffe0109d2, lprc=0x26de08, hbr=0xffffffffed100276) returned 1 [0066.573] DeleteObject (ho=0xffffffffed100276) returned 1 [0066.573] RestoreDC (hdc=0xfffffffffe0109d2, nSavedDC=-1) returned 1 [0066.573] RestoreDC (hdc=0xfffffffffe0109d2, nSavedDC=-1) returned 1 [0066.573] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffe0109d2) returned 0x0 [0066.573] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc5c0dbd) returned 0x0 [0066.573] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0066.573] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.573] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.574] GetSystemMetrics (nIndex=42) returned 0 [0066.574] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0066.574] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.574] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x17) returned 0x0 [0066.574] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0066.574] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0066.574] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0066.574] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0066.574] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0066.575] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0066.575] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x1) returned 0x1b00017 [0066.575] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x2) returned 0x1900010 [0066.575] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x7) returned 0xfffffffff10509d7 [0066.575] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x6) returned 0x18a002e [0066.575] SaveDC (hdc=0xfffffffffe0109d2) returned 1 [0066.575] GetNearestColor (hdc=0xfffffffffe0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0066.575] RestoreDC (hdc=0xfffffffffe0109d2, nSavedDC=-1) returned 1 [0066.575] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffe0109d2) returned 0x0 [0066.575] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0066.575] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0066.575] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0066.575] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x1) returned 0x1b00017 [0066.575] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x2) returned 0x1900010 [0066.575] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x7) returned 0xfffffffff10509d7 [0066.575] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x6) returned 0x18a002e [0066.575] SaveDC (hdc=0xfffffffffe0109d2) returned 1 [0066.575] GetTextAlign (hdc=0xfffffffffe0109d2) returned 0x0 [0066.575] GetTextColor (hdc=0xfffffffffe0109d2) returned 0x0 [0066.575] SetTextColor (hdc=0xfffffffffe0109d2, color=0xf0f0f0) returned 0x0 [0066.575] GetCurrentObject (hdc=0xfffffffffe0109d2, type=0x6) returned 0x18a002e [0066.576] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0066.576] SelectObject (hdc=0xfffffffffe0109d2, h=0x260a09ba) returned 0x18a002e [0066.576] GetBkMode (hdc=0xfffffffffe0109d2) returned 2 [0066.576] SetBkMode (hdc=0xfffffffffe0109d2, mode=1) returned 2 [0066.576] DrawTextExW (in: hdc=0xfffffffffe0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x274ac50 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0066.576] DrawTextExW (in: hdc=0xfffffffffe0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x274ac50 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0066.576] RestoreDC (hdc=0xfffffffffe0109d2, nSavedDC=-1) returned 1 [0066.576] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffe0109d2) returned 0x0 [0066.576] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0066.576] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffffe0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0066.577] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffffe0109d2) returned 0x0 [0066.577] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0066.577] SelectObject (hdc=0xfffffffffe0109d2, h=0x185000f) returned 0xfffffffff10509d7 [0066.577] DeleteDC (hdc=0xfffffffffe0109d2) returned 1 [0066.577] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0066.577] DeleteObject (ho=0xfffffffff10509d7) returned 1 [0066.580] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0066.580] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.580] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.580] WaitMessage () returned 1 [0066.660] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.660] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0066.660] IsWindowUnicode (hWnd=0x50114) returned 1 [0066.660] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.660] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0066.660] SetCursor (hCursor=0x10007) returned 0x10007 [0066.660] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.660] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.660] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0x610185) returned 0x0 [0066.660] GetKeyState (nVirtKey=1) returned 0 [0066.660] GetKeyState (nVirtKey=2) returned 0 [0066.660] GetKeyState (nVirtKey=4) returned 0 [0066.660] GetKeyState (nVirtKey=5) returned 0 [0066.660] GetKeyState (nVirtKey=6) returned 0 [0066.703] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.703] IsWindowUnicode (hWnd=0x5015a) returned 1 [0066.703] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.703] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.703] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.703] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.703] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.703] GetSystemMetrics (nIndex=42) returned 0 [0066.704] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e690, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0066.704] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e690) returned 0x5d [0066.704] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.704] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.704] GetSystemMetrics (nIndex=42) returned 0 [0066.704] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e630, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n3% complete\r\nDo not turn off your computer.") returned 93 [0066.704] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e630) returned 0x5d [0066.704] SetWindowTextW (hWnd=0x3015e, lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 1 [0066.704] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xc, wParam=0x0, lParam=0x27745ec) returned 0x1 [0066.704] GetStockObject (i=5) returned 0x1900015 [0066.704] GetDlgItem (hDlg=0x50114, nIDDlgItem=196958) returned 0x3015e [0066.704] SendMessageW (hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26df90) returned 0x0 [0066.704] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26df90) returned 0x0 [0066.704] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0066.704] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.704] IsWindowUnicode (hWnd=0x3015e) returned 1 [0066.704] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.704] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.704] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.705] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0066.705] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0066.705] CreateCompatibleDC (hdc=0x60109d6) returned 0x300109c0 [0066.705] GetObjectType (h=0x60109d6) returned 0x3 [0066.705] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffff20509d7 [0066.705] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff20509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.705] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff20509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.705] DeleteObject (ho=0xfffffffff20509d7) returned 1 [0066.705] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffff0509d2 [0066.705] SelectObject (hdc=0x300109c0, h=0xffffffffff0509d2) returned 0x185000f [0066.705] GdipCreateFromHDC (hdc=0x300109c0, graphics=0x26e408) returned 0x0 [0066.705] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0066.705] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0066.705] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0066.705] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0066.705] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0066.705] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.706] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0066.706] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.706] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0066.706] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0066.706] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0066.706] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0066.706] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0066.706] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.706] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.706] GetSystemMetrics (nIndex=42) returned 0 [0066.706] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0066.706] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.706] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0066.706] IsAppThemed () returned 0x1 [0066.706] GetThemeAppProperties () returned 0x3 [0066.706] GetThemeAppProperties () returned 0x3 [0066.706] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0066.706] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0066.706] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0066.706] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0066.706] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0066.706] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.706] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.706] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.706] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0066.706] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.706] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.706] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.706] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0066.707] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0066.707] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0066.707] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0066.707] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0066.707] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0066.707] GetCurrentObject (hdc=0x300109c0, type=0x1) returned 0x1b00017 [0066.707] GetCurrentObject (hdc=0x300109c0, type=0x2) returned 0x1900010 [0066.707] GetCurrentObject (hdc=0x300109c0, type=0x7) returned 0xffffffffff0509d2 [0066.707] GetCurrentObject (hdc=0x300109c0, type=0x6) returned 0x18a002e [0066.707] SaveDC (hdc=0x300109c0) returned 1 [0066.707] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6c0409f1 [0066.707] GetClipRgn (hdc=0x300109c0, hrgn=0x6c0409f1) returned 0 [0066.707] SelectClipRgn (hdc=0x300109c0, hrgn=0xffffffff930409ff) returned 2 [0066.707] DeleteObject (ho=0x6c0409f1) returned 1 [0066.707] DeleteObject (ho=0xffffffff930409ff) returned 1 [0066.707] OffsetViewportOrgEx (in: hdc=0x300109c0, x=0, y=0, lppt=0x2776630 | out: lppt=0x2776630) returned 1 [0066.707] OffsetViewportOrgEx (in: hdc=0x300109c0, x=-417, y=-278, lppt=0x2776648 | out: lppt=0x2776648) returned 1 [0066.707] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0066.707] GetCurrentObject (hdc=0x300109c0, type=0x1) returned 0x1b00017 [0066.707] GetCurrentObject (hdc=0x300109c0, type=0x2) returned 0x1900010 [0066.707] GetCurrentObject (hdc=0x300109c0, type=0x7) returned 0xffffffffff0509d2 [0066.707] GetCurrentObject (hdc=0x300109c0, type=0x6) returned 0x18a002e [0066.707] SaveDC (hdc=0x300109c0) returned 2 [0066.707] GetNearestColor (hdc=0x300109c0, color=0x6c4607) returned 0x6c4607 [0066.707] CreateSolidBrush (color=0x6c4607) returned 0xffffffffee100276 [0066.707] FillRect (hDC=0x300109c0, lprc=0x26de08, hbr=0xffffffffee100276) returned 1 [0066.714] DeleteObject (ho=0xffffffffee100276) returned 1 [0066.714] RestoreDC (hdc=0x300109c0, nSavedDC=-1) returned 1 [0066.714] RestoreDC (hdc=0x300109c0, nSavedDC=-1) returned 1 [0066.714] GdipReleaseDC (graphics=0x1b86d040, hdc=0x300109c0) returned 0x0 [0066.714] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc5a0dbd) returned 0x0 [0066.714] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0066.714] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.714] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.714] GetSystemMetrics (nIndex=42) returned 0 [0066.714] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0066.714] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.714] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0066.714] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0066.714] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0066.714] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0066.714] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0066.714] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0066.715] GetCurrentObject (hdc=0x300109c0, type=0x1) returned 0x1b00017 [0066.715] GetCurrentObject (hdc=0x300109c0, type=0x2) returned 0x1900010 [0066.715] GetCurrentObject (hdc=0x300109c0, type=0x7) returned 0xffffffffff0509d2 [0066.715] GetCurrentObject (hdc=0x300109c0, type=0x6) returned 0x18a002e [0066.715] SaveDC (hdc=0x300109c0) returned 1 [0066.715] GetNearestColor (hdc=0x300109c0, color=0xf0f0f0) returned 0xf0f0f0 [0066.715] RestoreDC (hdc=0x300109c0, nSavedDC=-1) returned 1 [0066.715] GdipReleaseDC (graphics=0x1b86d040, hdc=0x300109c0) returned 0x0 [0066.715] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0066.715] DrawTextExW (in: hdc=0xffffffff81010269, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e1c8, format=0x102405, lpdtp=0x2776ea8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e1c8) returned 333 [0066.715] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0066.715] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0066.715] GetCurrentObject (hdc=0x300109c0, type=0x1) returned 0x1b00017 [0066.715] GetCurrentObject (hdc=0x300109c0, type=0x2) returned 0x1900010 [0066.715] GetCurrentObject (hdc=0x300109c0, type=0x7) returned 0xffffffffff0509d2 [0066.716] GetCurrentObject (hdc=0x300109c0, type=0x6) returned 0x18a002e [0066.716] SaveDC (hdc=0x300109c0) returned 1 [0066.716] GetTextAlign (hdc=0x300109c0) returned 0x0 [0066.716] GetTextColor (hdc=0x300109c0) returned 0x0 [0066.716] SetTextColor (hdc=0x300109c0, color=0xf0f0f0) returned 0x0 [0066.716] GetCurrentObject (hdc=0x300109c0, type=0x6) returned 0x18a002e [0066.716] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0066.716] SelectObject (hdc=0x300109c0, h=0x260a09ba) returned 0x18a002e [0066.716] GetBkMode (hdc=0x300109c0) returned 2 [0066.716] SetBkMode (hdc=0x300109c0, mode=1) returned 2 [0066.716] DrawTextExW (in: hdc=0x300109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2777320 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0066.716] DrawTextExW (in: hdc=0x300109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2777320 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0066.717] RestoreDC (hdc=0x300109c0, nSavedDC=-1) returned 1 [0066.717] GdipReleaseDC (graphics=0x1b86d040, hdc=0x300109c0) returned 0x0 [0066.717] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0066.717] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x300109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0066.717] GdipReleaseDC (graphics=0x1b86d040, hdc=0x300109c0) returned 0x0 [0066.717] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0066.717] SelectObject (hdc=0x300109c0, h=0x185000f) returned 0xffffffffff0509d2 [0066.718] DeleteDC (hdc=0x300109c0) returned 1 [0066.718] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0066.718] DeleteObject (ho=0xffffffffff0509d2) returned 1 [0066.721] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0066.721] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.721] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.721] WaitMessage () returned 1 [0066.819] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.819] IsWindowUnicode (hWnd=0x3015e) returned 1 [0066.819] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.819] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.819] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.819] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0066.819] GetCurrentThreadId () returned 0xa28 [0066.819] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0066.819] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.819] IsWindowUnicode (hWnd=0x3015e) returned 1 [0066.819] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0066.819] TranslateMessage (lpMsg=0x26ee10) returned 0 [0066.819] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0066.820] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0066.820] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0066.820] CreateCompatibleDC (hdc=0x60109d6) returned 0xfffffffff40109d7 [0066.820] GetObjectType (h=0x60109d6) returned 0x3 [0066.820] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x509d2 [0066.820] GetDIBits (in: hdc=0x60109d6, hbm=0x509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.820] GetDIBits (in: hdc=0x60109d6, hbm=0x509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0066.820] DeleteObject (ho=0x509d2) returned 1 [0066.820] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x310509c0 [0066.820] SelectObject (hdc=0xfffffffff40109d7, h=0x310509c0) returned 0x185000f [0066.820] GdipCreateFromHDC (hdc=0xfffffffff40109d7, graphics=0x26e408) returned 0x0 [0066.820] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0066.821] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0066.821] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0066.821] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0066.821] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0066.821] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.821] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0066.821] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.821] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0066.821] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0066.821] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0066.821] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0066.821] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0066.821] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.821] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.821] GetSystemMetrics (nIndex=42) returned 0 [0066.821] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0066.821] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.821] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0066.821] IsAppThemed () returned 0x1 [0066.821] GetThemeAppProperties () returned 0x3 [0066.821] GetThemeAppProperties () returned 0x3 [0066.821] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0066.821] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0066.821] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0066.821] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0066.821] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0066.821] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.821] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.822] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.822] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0066.822] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0066.822] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0066.822] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0066.822] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0066.822] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0066.822] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0066.822] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0066.822] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0066.822] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0066.822] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x1) returned 0x1b00017 [0066.822] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x2) returned 0x1900010 [0066.822] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x7) returned 0x310509c0 [0066.822] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x6) returned 0x18a002e [0066.822] SaveDC (hdc=0xfffffffff40109d7) returned 1 [0066.822] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff940409ff [0066.822] GetClipRgn (hdc=0xfffffffff40109d7, hrgn=0xffffffff940409ff) returned 0 [0066.822] SelectClipRgn (hdc=0xfffffffff40109d7, hrgn=0x700409f1) returned 2 [0066.822] DeleteObject (ho=0xffffffff940409ff) returned 1 [0066.822] DeleteObject (ho=0x700409f1) returned 1 [0066.822] OffsetViewportOrgEx (in: hdc=0xfffffffff40109d7, x=0, y=0, lppt=0x26948d8 | out: lppt=0x26948d8) returned 1 [0066.822] OffsetViewportOrgEx (in: hdc=0xfffffffff40109d7, x=-417, y=-278, lppt=0x26948f0 | out: lppt=0x26948f0) returned 1 [0066.822] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0066.822] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x1) returned 0x1b00017 [0066.822] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x2) returned 0x1900010 [0066.822] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x7) returned 0x310509c0 [0066.823] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x6) returned 0x18a002e [0066.823] SaveDC (hdc=0xfffffffff40109d7) returned 2 [0066.823] GetNearestColor (hdc=0xfffffffff40109d7, color=0x6c4607) returned 0x6c4607 [0066.823] CreateSolidBrush (color=0x6c4607) returned 0xffffffffef100276 [0066.823] FillRect (hDC=0xfffffffff40109d7, lprc=0x26de08, hbr=0xffffffffef100276) returned 1 [0066.829] DeleteObject (ho=0xffffffffef100276) returned 1 [0066.829] RestoreDC (hdc=0xfffffffff40109d7, nSavedDC=-1) returned 1 [0066.829] RestoreDC (hdc=0xfffffffff40109d7, nSavedDC=-1) returned 1 [0066.829] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff40109d7) returned 0x0 [0066.829] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc580dbd) returned 0x0 [0066.829] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0066.829] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0066.829] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0066.829] GetSystemMetrics (nIndex=42) returned 0 [0066.829] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0066.829] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0066.829] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0066.829] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0066.829] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0066.829] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0066.830] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0066.830] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0066.830] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x1) returned 0x1b00017 [0066.830] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x2) returned 0x1900010 [0066.830] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x7) returned 0x310509c0 [0066.830] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x6) returned 0x18a002e [0066.830] SaveDC (hdc=0xfffffffff40109d7) returned 1 [0066.830] GetNearestColor (hdc=0xfffffffff40109d7, color=0xf0f0f0) returned 0xf0f0f0 [0066.830] RestoreDC (hdc=0xfffffffff40109d7, nSavedDC=-1) returned 1 [0066.830] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff40109d7) returned 0x0 [0066.830] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0066.830] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0066.830] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0066.830] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0066.830] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x1) returned 0x1b00017 [0066.831] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x2) returned 0x1900010 [0066.831] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x7) returned 0x310509c0 [0066.831] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x6) returned 0x18a002e [0066.831] SaveDC (hdc=0xfffffffff40109d7) returned 1 [0066.831] GetTextAlign (hdc=0xfffffffff40109d7) returned 0x0 [0066.831] GetTextColor (hdc=0xfffffffff40109d7) returned 0x0 [0066.831] SetTextColor (hdc=0xfffffffff40109d7, color=0xf0f0f0) returned 0x0 [0066.831] GetCurrentObject (hdc=0xfffffffff40109d7, type=0x6) returned 0x18a002e [0066.831] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0066.831] SelectObject (hdc=0xfffffffff40109d7, h=0x260a09ba) returned 0x18a002e [0066.831] GetBkMode (hdc=0xfffffffff40109d7) returned 2 [0066.831] SetBkMode (hdc=0xfffffffff40109d7, mode=1) returned 2 [0066.831] DrawTextExW (in: hdc=0xfffffffff40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2695ef0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0066.831] DrawTextExW (in: hdc=0xfffffffff40109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2695ef0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0066.832] RestoreDC (hdc=0xfffffffff40109d7, nSavedDC=-1) returned 1 [0066.832] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff40109d7) returned 0x0 [0066.832] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0066.832] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xfffffffff40109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0066.833] GdipReleaseDC (graphics=0x1b86d040, hdc=0xfffffffff40109d7) returned 0x0 [0066.833] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0066.833] SelectObject (hdc=0xfffffffff40109d7, h=0x185000f) returned 0x310509c0 [0066.833] DeleteDC (hdc=0xfffffffff40109d7) returned 1 [0066.833] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0066.833] DeleteObject (ho=0x310509c0) returned 1 [0066.836] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0066.836] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.836] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0066.836] WaitMessage () returned 1 [0067.001] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.001] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.001] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.001] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.001] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.001] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0067.001] GetCurrentThreadId () returned 0xa28 [0067.001] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0067.001] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.001] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.001] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.001] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.001] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.001] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0067.001] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0067.001] CreateCompatibleDC (hdc=0x60109d6) returned 0x20109d2 [0067.001] GetObjectType (h=0x60109d6) returned 0x3 [0067.001] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x320509c0 [0067.001] GetDIBits (in: hdc=0x60109d6, hbm=0x320509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.001] GetDIBits (in: hdc=0x60109d6, hbm=0x320509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.001] DeleteObject (ho=0x320509c0) returned 1 [0067.002] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffff50509d7 [0067.002] SelectObject (hdc=0x20109d2, h=0xfffffffff50509d7) returned 0x185000f [0067.002] GdipCreateFromHDC (hdc=0x20109d2, graphics=0x26e408) returned 0x0 [0067.002] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0067.002] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0067.002] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0067.002] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0067.002] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0067.002] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.002] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0067.002] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.002] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0067.002] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0067.002] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0067.002] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0067.002] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0067.002] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.002] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.002] GetSystemMetrics (nIndex=42) returned 0 [0067.002] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.002] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.003] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0067.003] IsAppThemed () returned 0x1 [0067.003] GetThemeAppProperties () returned 0x3 [0067.003] GetThemeAppProperties () returned 0x3 [0067.003] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0067.003] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0067.003] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0067.003] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0067.003] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0067.003] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.003] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.003] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.003] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0067.003] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.003] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.003] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.003] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0067.003] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0067.003] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0067.003] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0067.003] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0067.003] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0067.003] GetCurrentObject (hdc=0x20109d2, type=0x1) returned 0x1b00017 [0067.003] GetCurrentObject (hdc=0x20109d2, type=0x2) returned 0x1900010 [0067.003] GetCurrentObject (hdc=0x20109d2, type=0x7) returned 0xfffffffff50509d7 [0067.003] GetCurrentObject (hdc=0x20109d2, type=0x6) returned 0x18a002e [0067.003] SaveDC (hdc=0x20109d2) returned 1 [0067.003] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x710409f1 [0067.003] GetClipRgn (hdc=0x20109d2, hrgn=0x710409f1) returned 0 [0067.004] SelectClipRgn (hdc=0x20109d2, hrgn=0xffffffff970409ff) returned 2 [0067.004] DeleteObject (ho=0x710409f1) returned 1 [0067.004] DeleteObject (ho=0xffffffff970409ff) returned 1 [0067.004] OffsetViewportOrgEx (in: hdc=0x20109d2, x=0, y=0, lppt=0x26d43f0 | out: lppt=0x26d43f0) returned 1 [0067.004] OffsetViewportOrgEx (in: hdc=0x20109d2, x=-417, y=-278, lppt=0x26d4408 | out: lppt=0x26d4408) returned 1 [0067.004] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0067.004] GetCurrentObject (hdc=0x20109d2, type=0x1) returned 0x1b00017 [0067.004] GetCurrentObject (hdc=0x20109d2, type=0x2) returned 0x1900010 [0067.004] GetCurrentObject (hdc=0x20109d2, type=0x7) returned 0xfffffffff50509d7 [0067.004] GetCurrentObject (hdc=0x20109d2, type=0x6) returned 0x18a002e [0067.004] SaveDC (hdc=0x20109d2) returned 2 [0067.004] GetNearestColor (hdc=0x20109d2, color=0x6c4607) returned 0x6c4607 [0067.004] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff0100276 [0067.004] FillRect (hDC=0x20109d2, lprc=0x26de08, hbr=0xfffffffff0100276) returned 1 [0067.010] DeleteObject (ho=0xfffffffff0100276) returned 1 [0067.010] RestoreDC (hdc=0x20109d2, nSavedDC=-1) returned 1 [0067.010] RestoreDC (hdc=0x20109d2, nSavedDC=-1) returned 1 [0067.010] GdipReleaseDC (graphics=0x1b86d040, hdc=0x20109d2) returned 0x0 [0067.010] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc560dbd) returned 0x0 [0067.010] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0067.010] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.011] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.011] GetSystemMetrics (nIndex=42) returned 0 [0067.011] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.011] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.011] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x19) returned 0x0 [0067.011] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0067.011] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0067.011] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0067.011] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0067.011] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0067.012] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0067.012] GetCurrentObject (hdc=0x20109d2, type=0x1) returned 0x1b00017 [0067.012] GetCurrentObject (hdc=0x20109d2, type=0x2) returned 0x1900010 [0067.012] GetCurrentObject (hdc=0x20109d2, type=0x7) returned 0xfffffffff50509d7 [0067.012] GetCurrentObject (hdc=0x20109d2, type=0x6) returned 0x18a002e [0067.012] SaveDC (hdc=0x20109d2) returned 1 [0067.012] GetNearestColor (hdc=0x20109d2, color=0xf0f0f0) returned 0xf0f0f0 [0067.012] RestoreDC (hdc=0x20109d2, nSavedDC=-1) returned 1 [0067.012] GdipReleaseDC (graphics=0x1b86d040, hdc=0x20109d2) returned 0x0 [0067.012] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0067.012] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0067.012] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0067.012] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0067.012] GetCurrentObject (hdc=0x20109d2, type=0x1) returned 0x1b00017 [0067.012] GetCurrentObject (hdc=0x20109d2, type=0x2) returned 0x1900010 [0067.012] GetCurrentObject (hdc=0x20109d2, type=0x7) returned 0xfffffffff50509d7 [0067.012] GetCurrentObject (hdc=0x20109d2, type=0x6) returned 0x18a002e [0067.012] SaveDC (hdc=0x20109d2) returned 1 [0067.012] GetTextAlign (hdc=0x20109d2) returned 0x0 [0067.012] GetTextColor (hdc=0x20109d2) returned 0x0 [0067.013] SetTextColor (hdc=0x20109d2, color=0xf0f0f0) returned 0x0 [0067.013] GetCurrentObject (hdc=0x20109d2, type=0x6) returned 0x18a002e [0067.013] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0067.013] SelectObject (hdc=0x20109d2, h=0x260a09ba) returned 0x18a002e [0067.013] GetBkMode (hdc=0x20109d2) returned 2 [0067.013] SetBkMode (hdc=0x20109d2, mode=1) returned 2 [0067.013] DrawTextExW (in: hdc=0x20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26d52b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0067.013] DrawTextExW (in: hdc=0x20109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26d52b8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0067.013] RestoreDC (hdc=0x20109d2, nSavedDC=-1) returned 1 [0067.013] GdipReleaseDC (graphics=0x1b86d040, hdc=0x20109d2) returned 0x0 [0067.013] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0067.013] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x20109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0067.014] GdipReleaseDC (graphics=0x1b86d040, hdc=0x20109d2) returned 0x0 [0067.014] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0067.014] SelectObject (hdc=0x20109d2, h=0x185000f) returned 0xfffffffff50509d7 [0067.014] DeleteDC (hdc=0x20109d2) returned 1 [0067.014] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0067.014] DeleteObject (ho=0xfffffffff50509d7) returned 1 [0067.017] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0067.017] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.017] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.017] WaitMessage () returned 1 [0067.191] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.191] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.191] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.191] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.191] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.191] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0067.191] GetCurrentThreadId () returned 0xa28 [0067.191] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0067.191] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.191] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.191] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.191] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.191] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.192] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0067.192] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0067.192] CreateCompatibleDC (hdc=0x60109d6) returned 0x340109c0 [0067.192] GetObjectType (h=0x60109d6) returned 0x3 [0067.192] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xfffffffff60509d7 [0067.192] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff60509d7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.192] GetDIBits (in: hdc=0x60109d6, hbm=0xfffffffff60509d7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.192] DeleteObject (ho=0xfffffffff60509d7) returned 1 [0067.192] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x30509d2 [0067.192] SelectObject (hdc=0x340109c0, h=0x30509d2) returned 0x185000f [0067.192] GdipCreateFromHDC (hdc=0x340109c0, graphics=0x26e408) returned 0x0 [0067.193] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0067.193] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0067.193] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0067.193] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0067.193] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0067.193] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.193] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0067.193] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.193] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0067.193] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0067.193] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0067.193] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0067.193] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0067.193] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.193] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.193] GetSystemMetrics (nIndex=42) returned 0 [0067.193] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.193] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.193] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0067.193] IsAppThemed () returned 0x1 [0067.193] GetThemeAppProperties () returned 0x3 [0067.193] GetThemeAppProperties () returned 0x3 [0067.193] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0067.193] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0067.193] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0067.193] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0067.194] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0067.194] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.194] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.194] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.194] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0067.194] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.194] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.194] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.194] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0067.194] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0067.194] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0067.194] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0067.194] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0067.194] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0067.194] GetCurrentObject (hdc=0x340109c0, type=0x1) returned 0x1b00017 [0067.194] GetCurrentObject (hdc=0x340109c0, type=0x2) returned 0x1900010 [0067.194] GetCurrentObject (hdc=0x340109c0, type=0x7) returned 0x30509d2 [0067.194] GetCurrentObject (hdc=0x340109c0, type=0x6) returned 0x18a002e [0067.194] SaveDC (hdc=0x340109c0) returned 1 [0067.194] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff980409ff [0067.194] GetClipRgn (hdc=0x340109c0, hrgn=0xffffffff980409ff) returned 0 [0067.194] SelectClipRgn (hdc=0x340109c0, hrgn=0x740409f1) returned 2 [0067.194] DeleteObject (ho=0xffffffff980409ff) returned 1 [0067.194] DeleteObject (ho=0x740409f1) returned 1 [0067.195] OffsetViewportOrgEx (in: hdc=0x340109c0, x=0, y=0, lppt=0x2693e20 | out: lppt=0x2693e20) returned 1 [0067.195] OffsetViewportOrgEx (in: hdc=0x340109c0, x=-417, y=-278, lppt=0x2693e38 | out: lppt=0x2693e38) returned 1 [0067.195] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0067.195] GetCurrentObject (hdc=0x340109c0, type=0x1) returned 0x1b00017 [0067.195] GetCurrentObject (hdc=0x340109c0, type=0x2) returned 0x1900010 [0067.195] GetCurrentObject (hdc=0x340109c0, type=0x7) returned 0x30509d2 [0067.195] GetCurrentObject (hdc=0x340109c0, type=0x6) returned 0x18a002e [0067.195] SaveDC (hdc=0x340109c0) returned 2 [0067.195] GetNearestColor (hdc=0x340109c0, color=0x6c4607) returned 0x6c4607 [0067.195] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff1100276 [0067.195] FillRect (hDC=0x340109c0, lprc=0x26de08, hbr=0xfffffffff1100276) returned 1 [0067.201] DeleteObject (ho=0xfffffffff1100276) returned 1 [0067.201] RestoreDC (hdc=0x340109c0, nSavedDC=-1) returned 1 [0067.201] RestoreDC (hdc=0x340109c0, nSavedDC=-1) returned 1 [0067.201] GdipReleaseDC (graphics=0x1b86d040, hdc=0x340109c0) returned 0x0 [0067.201] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc540dbd) returned 0x0 [0067.201] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0067.201] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.201] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.202] GetSystemMetrics (nIndex=42) returned 0 [0067.202] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.202] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.202] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0067.202] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0067.202] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0067.202] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0067.202] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0067.202] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0067.202] GetCurrentObject (hdc=0x340109c0, type=0x1) returned 0x1b00017 [0067.202] GetCurrentObject (hdc=0x340109c0, type=0x2) returned 0x1900010 [0067.202] GetCurrentObject (hdc=0x340109c0, type=0x7) returned 0x30509d2 [0067.202] GetCurrentObject (hdc=0x340109c0, type=0x6) returned 0x18a002e [0067.202] SaveDC (hdc=0x340109c0) returned 1 [0067.202] GetNearestColor (hdc=0x340109c0, color=0xf0f0f0) returned 0xf0f0f0 [0067.202] RestoreDC (hdc=0x340109c0, nSavedDC=-1) returned 1 [0067.202] GdipReleaseDC (graphics=0x1b86d040, hdc=0x340109c0) returned 0x0 [0067.202] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0067.203] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0067.203] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0067.203] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0067.203] GetCurrentObject (hdc=0x340109c0, type=0x1) returned 0x1b00017 [0067.203] GetCurrentObject (hdc=0x340109c0, type=0x2) returned 0x1900010 [0067.203] GetCurrentObject (hdc=0x340109c0, type=0x7) returned 0x30509d2 [0067.203] GetCurrentObject (hdc=0x340109c0, type=0x6) returned 0x18a002e [0067.203] SaveDC (hdc=0x340109c0) returned 1 [0067.203] GetTextAlign (hdc=0x340109c0) returned 0x0 [0067.203] GetTextColor (hdc=0x340109c0) returned 0x0 [0067.203] SetTextColor (hdc=0x340109c0, color=0xf0f0f0) returned 0x0 [0067.203] GetCurrentObject (hdc=0x340109c0, type=0x6) returned 0x18a002e [0067.203] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0067.203] SelectObject (hdc=0x340109c0, h=0x260a09ba) returned 0x18a002e [0067.203] GetBkMode (hdc=0x340109c0) returned 2 [0067.203] SetBkMode (hdc=0x340109c0, mode=1) returned 2 [0067.203] DrawTextExW (in: hdc=0x340109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2694ae8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0067.203] DrawTextExW (in: hdc=0x340109c0, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2694ae8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0067.204] RestoreDC (hdc=0x340109c0, nSavedDC=-1) returned 1 [0067.204] GdipReleaseDC (graphics=0x1b86d040, hdc=0x340109c0) returned 0x0 [0067.204] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0067.204] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x340109c0, x1=0, y1=0, rop=0xcc0020) returned 1 [0067.204] GdipReleaseDC (graphics=0x1b86d040, hdc=0x340109c0) returned 0x0 [0067.204] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0067.204] SelectObject (hdc=0x340109c0, h=0x185000f) returned 0x30509d2 [0067.204] DeleteDC (hdc=0x340109c0) returned 1 [0067.204] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0067.204] DeleteObject (ho=0x30509d2) returned 1 [0067.208] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0067.208] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.208] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.208] WaitMessage () returned 1 [0067.304] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.304] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x88, wParam=0x4, lParam=0x0) returned 0x0 [0067.304] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0067.304] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26df58 | out: lpwndpl=0x26df58) returned 1 [0067.316] GetClientRect (in: hWnd=0x50114, lpRect=0x26de70 | out: lpRect=0x26de70) returned 1 [0067.375] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0067.375] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.375] GetSystemMetrics (nIndex=42) returned 0 [0067.375] GetWindowTextW (in: hWnd=0x50114, lpString=0x26dbe0, nMaxCount=6 | out: lpString="Form1") returned 5 [0067.375] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26dbe0) returned 0x5 [0067.375] GetClientRect (in: hWnd=0x50114, lpRect=0x26dc58 | out: lpRect=0x26dc58) returned 1 [0067.375] GetCurrentObject (hdc=0x350109dd, type=0x1) returned 0x1b00017 [0067.375] GetCurrentObject (hdc=0x350109dd, type=0x2) returned 0x1900010 [0067.375] GetCurrentObject (hdc=0x350109dd, type=0x7) returned 0x1050032 [0067.375] GetCurrentObject (hdc=0x350109dd, type=0x6) returned 0x18a002e [0067.375] SaveDC (hdc=0x350109dd) returned 1 [0067.375] GetNearestColor (hdc=0x350109dd, color=0x6c4607) returned 0x6c4607 [0067.375] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff2100276 [0067.375] FillRect (hDC=0x350109dd, lprc=0x26d948, hbr=0xfffffffff2100276) returned 1 [0067.375] DeleteObject (ho=0xfffffffff2100276) returned 1 [0067.375] RestoreDC (hdc=0x350109dd, nSavedDC=-1) returned 1 [0067.385] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0067.386] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0067.386] IsWindowUnicode (hWnd=0x50114) returned 1 [0067.386] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.386] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0067.386] SetCursor (hCursor=0x10007) returned 0x10007 [0067.386] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.386] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.386] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0x610185) returned 0x0 [0067.386] GetKeyState (nVirtKey=1) returned 0 [0067.386] GetKeyState (nVirtKey=2) returned 0 [0067.386] GetKeyState (nVirtKey=4) returned 0 [0067.386] GetKeyState (nVirtKey=5) returned 0 [0067.386] GetKeyState (nVirtKey=6) returned 0 [0067.386] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.386] IsWindowUnicode (hWnd=0x50114) returned 1 [0067.386] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.386] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.386] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.386] BeginPaint (in: hWnd=0x50114, lpPaint=0x26e548 | out: lpPaint=0x26e548) returned 0x350109dd [0067.386] SelectPalette (hdc=0x350109dd, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0067.386] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0067.386] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.386] GetSystemMetrics (nIndex=42) returned 0 [0067.386] GetWindowTextW (in: hWnd=0x50114, lpString=0x26e3f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0067.386] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26e3f0) returned 0x5 [0067.387] SelectPalette (hdc=0x350109dd, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0067.387] EndPaint (hWnd=0x50114, lpPaint=0x26e4e8) returned 1 [0067.387] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.387] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.387] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.387] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.387] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.387] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0067.387] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0067.387] CreateCompatibleDC (hdc=0x60109d6) returned 0x180109d7 [0067.387] GetObjectType (h=0x60109d6) returned 0x3 [0067.387] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x1a0509d2 [0067.387] GetDIBits (in: hdc=0x60109d6, hbm=0x1a0509d2, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.387] GetDIBits (in: hdc=0x60109d6, hbm=0x1a0509d2, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.387] DeleteObject (ho=0x1a0509d2) returned 1 [0067.387] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x360509c0 [0067.387] SelectObject (hdc=0x180109d7, h=0x360509c0) returned 0x185000f [0067.387] GdipCreateFromHDC (hdc=0x180109d7, graphics=0x26e408) returned 0x0 [0067.388] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0067.388] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0067.388] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0067.388] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0067.388] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0067.388] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.388] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0067.388] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.388] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0067.388] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0067.388] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0067.388] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0067.388] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0067.388] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.388] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.388] GetSystemMetrics (nIndex=42) returned 0 [0067.388] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.388] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.388] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0067.388] IsAppThemed () returned 0x1 [0067.388] GetThemeAppProperties () returned 0x3 [0067.388] GetThemeAppProperties () returned 0x3 [0067.388] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0067.388] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0067.388] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0067.388] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0067.388] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0067.388] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.389] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.389] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.389] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0067.389] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.389] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.389] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.389] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0067.389] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0067.389] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0067.389] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0067.389] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0067.389] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0067.389] GetCurrentObject (hdc=0x180109d7, type=0x1) returned 0x1b00017 [0067.389] GetCurrentObject (hdc=0x180109d7, type=0x2) returned 0x1900010 [0067.389] GetCurrentObject (hdc=0x180109d7, type=0x7) returned 0x360509c0 [0067.389] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0067.389] SaveDC (hdc=0x180109d7) returned 1 [0067.389] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x750409f1 [0067.389] GetClipRgn (hdc=0x180109d7, hrgn=0x750409f1) returned 0 [0067.389] SelectClipRgn (hdc=0x180109d7, hrgn=0xffffffff9b0409ff) returned 2 [0067.389] DeleteObject (ho=0x750409f1) returned 1 [0067.389] DeleteObject (ho=0xffffffff9b0409ff) returned 1 [0067.389] OffsetViewportOrgEx (in: hdc=0x180109d7, x=0, y=0, lppt=0x26930d0 | out: lppt=0x26930d0) returned 1 [0067.389] OffsetViewportOrgEx (in: hdc=0x180109d7, x=-417, y=-278, lppt=0x26930e8 | out: lppt=0x26930e8) returned 1 [0067.389] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0067.389] GetCurrentObject (hdc=0x180109d7, type=0x1) returned 0x1b00017 [0067.389] GetCurrentObject (hdc=0x180109d7, type=0x2) returned 0x1900010 [0067.390] GetCurrentObject (hdc=0x180109d7, type=0x7) returned 0x360509c0 [0067.390] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0067.390] SaveDC (hdc=0x180109d7) returned 2 [0067.390] GetNearestColor (hdc=0x180109d7, color=0x6c4607) returned 0x6c4607 [0067.390] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff3100276 [0067.390] FillRect (hDC=0x180109d7, lprc=0x26de08, hbr=0xfffffffff3100276) returned 1 [0067.396] DeleteObject (ho=0xfffffffff3100276) returned 1 [0067.396] RestoreDC (hdc=0x180109d7, nSavedDC=-1) returned 1 [0067.396] RestoreDC (hdc=0x180109d7, nSavedDC=-1) returned 1 [0067.396] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109d7) returned 0x0 [0067.396] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc520dbd) returned 0x0 [0067.397] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0067.397] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.397] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.397] GetSystemMetrics (nIndex=42) returned 0 [0067.397] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.397] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.397] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1a) returned 0x0 [0067.397] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0067.397] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0067.397] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0067.397] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0067.397] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0067.397] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0067.397] GetCurrentObject (hdc=0x180109d7, type=0x1) returned 0x1b00017 [0067.398] GetCurrentObject (hdc=0x180109d7, type=0x2) returned 0x1900010 [0067.398] GetCurrentObject (hdc=0x180109d7, type=0x7) returned 0x360509c0 [0067.398] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0067.398] SaveDC (hdc=0x180109d7) returned 1 [0067.398] GetNearestColor (hdc=0x180109d7, color=0xf0f0f0) returned 0xf0f0f0 [0067.398] RestoreDC (hdc=0x180109d7, nSavedDC=-1) returned 1 [0067.398] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109d7) returned 0x0 [0067.398] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0067.398] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0067.398] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0067.398] GetCurrentObject (hdc=0x180109d7, type=0x1) returned 0x1b00017 [0067.398] GetCurrentObject (hdc=0x180109d7, type=0x2) returned 0x1900010 [0067.398] GetCurrentObject (hdc=0x180109d7, type=0x7) returned 0x360509c0 [0067.398] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0067.398] SaveDC (hdc=0x180109d7) returned 1 [0067.398] GetTextAlign (hdc=0x180109d7) returned 0x0 [0067.398] GetTextColor (hdc=0x180109d7) returned 0x0 [0067.398] SetTextColor (hdc=0x180109d7, color=0xf0f0f0) returned 0x0 [0067.398] GetCurrentObject (hdc=0x180109d7, type=0x6) returned 0x18a002e [0067.399] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0067.399] SelectObject (hdc=0x180109d7, h=0x260a09ba) returned 0x18a002e [0067.399] GetBkMode (hdc=0x180109d7) returned 2 [0067.399] SetBkMode (hdc=0x180109d7, mode=1) returned 2 [0067.399] DrawTextExW (in: hdc=0x180109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2693eb0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0067.399] DrawTextExW (in: hdc=0x180109d7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2693eb0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0067.399] RestoreDC (hdc=0x180109d7, nSavedDC=-1) returned 1 [0067.399] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109d7) returned 0x0 [0067.399] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0067.399] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x180109d7, x1=0, y1=0, rop=0xcc0020) returned 1 [0067.400] GdipReleaseDC (graphics=0x1b86d040, hdc=0x180109d7) returned 0x0 [0067.400] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0067.400] SelectObject (hdc=0x180109d7, h=0x185000f) returned 0x360509c0 [0067.400] DeleteDC (hdc=0x180109d7) returned 1 [0067.400] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0067.400] DeleteObject (ho=0x360509c0) returned 1 [0067.403] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0067.403] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.403] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.403] WaitMessage () returned 1 [0067.404] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.404] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.404] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.404] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.404] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.404] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0067.404] GetCurrentThreadId () returned 0xa28 [0067.404] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0067.404] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.404] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.404] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.404] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.404] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.404] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0067.404] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0067.404] CreateCompatibleDC (hdc=0x60109d6) returned 0x1c0109d2 [0067.404] GetObjectType (h=0x60109d6) returned 0x3 [0067.404] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x370509c0 [0067.404] GetDIBits (in: hdc=0x60109d6, hbm=0x370509c0, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.404] GetDIBits (in: hdc=0x60109d6, hbm=0x370509c0, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.404] DeleteObject (ho=0x370509c0) returned 1 [0067.404] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x190509d7 [0067.404] SelectObject (hdc=0x1c0109d2, h=0x190509d7) returned 0x185000f [0067.405] GdipCreateFromHDC (hdc=0x1c0109d2, graphics=0x26e408) returned 0x0 [0067.405] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0067.405] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0067.405] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0067.405] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0067.405] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0067.405] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.405] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0067.405] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.405] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0067.405] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0067.405] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0067.405] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0067.406] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0067.406] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.406] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.406] GetSystemMetrics (nIndex=42) returned 0 [0067.406] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.406] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.406] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0067.406] IsAppThemed () returned 0x1 [0067.406] GetThemeAppProperties () returned 0x3 [0067.406] GetThemeAppProperties () returned 0x3 [0067.406] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0067.406] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0067.406] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0067.406] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0067.406] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0067.406] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.406] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.406] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.406] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0067.406] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.406] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.407] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.407] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0067.407] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0067.407] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0067.407] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0067.407] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0067.407] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0067.407] GetCurrentObject (hdc=0x1c0109d2, type=0x1) returned 0x1b00017 [0067.407] GetCurrentObject (hdc=0x1c0109d2, type=0x2) returned 0x1900010 [0067.407] GetCurrentObject (hdc=0x1c0109d2, type=0x7) returned 0x190509d7 [0067.407] GetCurrentObject (hdc=0x1c0109d2, type=0x6) returned 0x18a002e [0067.407] SaveDC (hdc=0x1c0109d2) returned 1 [0067.407] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff9c0409ff [0067.407] GetClipRgn (hdc=0x1c0109d2, hrgn=0xffffffff9c0409ff) returned 0 [0067.407] SelectClipRgn (hdc=0x1c0109d2, hrgn=0x780409f1) returned 2 [0067.407] DeleteObject (ho=0xffffffff9c0409ff) returned 1 [0067.407] DeleteObject (ho=0x780409f1) returned 1 [0067.407] OffsetViewportOrgEx (in: hdc=0x1c0109d2, x=0, y=0, lppt=0x2695a90 | out: lppt=0x2695a90) returned 1 [0067.407] OffsetViewportOrgEx (in: hdc=0x1c0109d2, x=-417, y=-278, lppt=0x2695aa8 | out: lppt=0x2695aa8) returned 1 [0067.407] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0067.407] GetCurrentObject (hdc=0x1c0109d2, type=0x1) returned 0x1b00017 [0067.407] GetCurrentObject (hdc=0x1c0109d2, type=0x2) returned 0x1900010 [0067.407] GetCurrentObject (hdc=0x1c0109d2, type=0x7) returned 0x190509d7 [0067.407] GetCurrentObject (hdc=0x1c0109d2, type=0x6) returned 0x18a002e [0067.407] SaveDC (hdc=0x1c0109d2) returned 2 [0067.408] GetNearestColor (hdc=0x1c0109d2, color=0x6c4607) returned 0x6c4607 [0067.408] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff4100276 [0067.408] FillRect (hDC=0x1c0109d2, lprc=0x26de08, hbr=0xfffffffff4100276) returned 1 [0067.414] DeleteObject (ho=0xfffffffff4100276) returned 1 [0067.414] RestoreDC (hdc=0x1c0109d2, nSavedDC=-1) returned 1 [0067.414] RestoreDC (hdc=0x1c0109d2, nSavedDC=-1) returned 1 [0067.414] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109d2) returned 0x0 [0067.414] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc500dbd) returned 0x0 [0067.414] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0067.414] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.414] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.414] GetSystemMetrics (nIndex=42) returned 0 [0067.414] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.414] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.414] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0067.414] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0067.414] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0067.414] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0067.414] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0067.414] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0067.415] GetCurrentObject (hdc=0x1c0109d2, type=0x1) returned 0x1b00017 [0067.415] GetCurrentObject (hdc=0x1c0109d2, type=0x2) returned 0x1900010 [0067.415] GetCurrentObject (hdc=0x1c0109d2, type=0x7) returned 0x190509d7 [0067.415] GetCurrentObject (hdc=0x1c0109d2, type=0x6) returned 0x18a002e [0067.415] SaveDC (hdc=0x1c0109d2) returned 1 [0067.415] GetNearestColor (hdc=0x1c0109d2, color=0xf0f0f0) returned 0xf0f0f0 [0067.415] RestoreDC (hdc=0x1c0109d2, nSavedDC=-1) returned 1 [0067.415] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109d2) returned 0x0 [0067.415] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0067.415] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0067.415] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0067.415] GetCurrentObject (hdc=0x1c0109d2, type=0x1) returned 0x1b00017 [0067.415] GetCurrentObject (hdc=0x1c0109d2, type=0x2) returned 0x1900010 [0067.415] GetCurrentObject (hdc=0x1c0109d2, type=0x7) returned 0x190509d7 [0067.415] GetCurrentObject (hdc=0x1c0109d2, type=0x6) returned 0x18a002e [0067.415] SaveDC (hdc=0x1c0109d2) returned 1 [0067.415] GetTextAlign (hdc=0x1c0109d2) returned 0x0 [0067.415] GetTextColor (hdc=0x1c0109d2) returned 0x0 [0067.415] SetTextColor (hdc=0x1c0109d2, color=0xf0f0f0) returned 0x0 [0067.415] GetCurrentObject (hdc=0x1c0109d2, type=0x6) returned 0x18a002e [0067.415] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0067.415] SelectObject (hdc=0x1c0109d2, h=0x260a09ba) returned 0x18a002e [0067.415] GetBkMode (hdc=0x1c0109d2) returned 2 [0067.416] SetBkMode (hdc=0x1c0109d2, mode=1) returned 2 [0067.416] DrawTextExW (in: hdc=0x1c0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2696758 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0067.416] DrawTextExW (in: hdc=0x1c0109d2, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2696758 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0067.416] RestoreDC (hdc=0x1c0109d2, nSavedDC=-1) returned 1 [0067.416] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109d2) returned 0x0 [0067.416] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0067.416] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x1c0109d2, x1=0, y1=0, rop=0xcc0020) returned 1 [0067.417] GdipReleaseDC (graphics=0x1b86d040, hdc=0x1c0109d2) returned 0x0 [0067.417] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0067.417] SelectObject (hdc=0x1c0109d2, h=0x185000f) returned 0x190509d7 [0067.417] DeleteDC (hdc=0x1c0109d2) returned 1 [0067.417] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0067.417] DeleteObject (ho=0x190509d7) returned 1 [0067.420] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0067.420] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.420] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.420] WaitMessage () returned 1 [0067.522] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.522] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0067.537] IsWindowUnicode (hWnd=0x50114) returned 1 [0067.537] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.542] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0067.542] SetCursor (hCursor=0x10007) returned 0x10007 [0067.542] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.542] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.542] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0x610185) returned 0x0 [0067.542] GetKeyState (nVirtKey=1) returned 0 [0067.545] GetKeyState (nVirtKey=2) returned 0 [0067.545] GetKeyState (nVirtKey=4) returned 0 [0067.545] GetKeyState (nVirtKey=5) returned 0 [0067.545] GetKeyState (nVirtKey=6) returned 0 [0067.608] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.608] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x88, wParam=0x4, lParam=0x0) returned 0x0 [0067.609] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0067.609] GetWindowPlacement (in: hWnd=0x50114, lpwndpl=0x26df58 | out: lpwndpl=0x26df58) returned 1 [0067.609] GetClientRect (in: hWnd=0x50114, lpRect=0x26de70 | out: lpRect=0x26de70) returned 1 [0067.609] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0067.609] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.609] GetSystemMetrics (nIndex=42) returned 0 [0067.609] GetWindowTextW (in: hWnd=0x50114, lpString=0x26dbe0, nMaxCount=6 | out: lpString="Form1") returned 5 [0067.609] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26dbe0) returned 0x5 [0067.609] GetClientRect (in: hWnd=0x50114, lpRect=0x26dc58 | out: lpRect=0x26dc58) returned 1 [0067.609] GetCurrentObject (hdc=0x60109d6, type=0x1) returned 0x1b00017 [0067.609] GetCurrentObject (hdc=0x60109d6, type=0x2) returned 0x1900010 [0067.610] GetCurrentObject (hdc=0x60109d6, type=0x7) returned 0x1050032 [0067.610] GetCurrentObject (hdc=0x60109d6, type=0x6) returned 0x18a002e [0067.610] SaveDC (hdc=0x60109d6) returned 1 [0067.610] GetNearestColor (hdc=0x60109d6, color=0x6c4607) returned 0x6c4607 [0067.610] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff5100276 [0067.610] FillRect (hDC=0x60109d6, lprc=0x26d948, hbr=0xfffffffff5100276) returned 1 [0067.610] DeleteObject (ho=0xfffffffff5100276) returned 1 [0067.610] RestoreDC (hdc=0x60109d6, nSavedDC=-1) returned 1 [0067.611] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0067.612] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.612] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.612] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.612] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.612] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0067.612] GetCurrentThreadId () returned 0xa28 [0067.612] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0067.612] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.612] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0067.612] IsWindowUnicode (hWnd=0x50114) returned 1 [0067.612] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.612] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0067.612] SetCursor (hCursor=0x10007) returned 0x10007 [0067.612] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.612] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.612] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0x610185) returned 0x0 [0067.612] GetKeyState (nVirtKey=1) returned 0 [0067.612] GetKeyState (nVirtKey=2) returned 0 [0067.612] GetKeyState (nVirtKey=4) returned 0 [0067.612] GetKeyState (nVirtKey=5) returned 0 [0067.612] GetKeyState (nVirtKey=6) returned 0 [0067.612] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.612] IsWindowUnicode (hWnd=0x50114) returned 1 [0067.612] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.613] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.613] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.613] BeginPaint (in: hWnd=0x50114, lpPaint=0x26e548 | out: lpPaint=0x26e548) returned 0x60109d6 [0067.613] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0067.613] GetWindowTextLengthW (hWnd=0x50114) returned 5 [0067.613] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.613] GetSystemMetrics (nIndex=42) returned 0 [0067.613] GetWindowTextW (in: hWnd=0x50114, lpString=0x26e3f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0067.613] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0xd, wParam=0x6, lParam=0x26e3f0) returned 0x5 [0067.613] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0067.613] EndPaint (hWnd=0x50114, lpPaint=0x26e4e8) returned 1 [0067.613] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.613] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.613] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.613] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.613] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.613] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0067.613] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0067.613] CreateCompatibleDC (hdc=0x150109ce) returned 0x420109e7 [0067.613] GetObjectType (h=0x150109ce) returned 0x3 [0067.613] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x3e05026a [0067.614] GetDIBits (in: hdc=0x150109ce, hbm=0x3e05026a, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.614] GetDIBits (in: hdc=0x150109ce, hbm=0x3e05026a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.614] DeleteObject (ho=0x3e05026a) returned 1 [0067.614] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x280509e8 [0067.614] SelectObject (hdc=0x420109e7, h=0x280509e8) returned 0x185000f [0067.614] GdipCreateFromHDC (hdc=0x420109e7, graphics=0x26e408) returned 0x0 [0067.614] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0067.614] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0067.614] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0067.615] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0067.615] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0067.615] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.615] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0067.615] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.615] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0067.615] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0067.615] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0067.615] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0067.615] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0067.615] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.615] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.615] GetSystemMetrics (nIndex=42) returned 0 [0067.615] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.615] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.615] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0067.615] IsAppThemed () returned 0x1 [0067.615] GetThemeAppProperties () returned 0x3 [0067.615] GetThemeAppProperties () returned 0x3 [0067.615] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0067.615] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0067.615] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0067.615] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0067.615] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0067.616] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.616] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.616] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.616] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0067.616] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.616] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.616] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.616] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0067.616] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0067.616] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0067.616] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0067.616] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0067.616] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0067.616] GetCurrentObject (hdc=0x420109e7, type=0x1) returned 0x1b00017 [0067.616] GetCurrentObject (hdc=0x420109e7, type=0x2) returned 0x1900010 [0067.616] GetCurrentObject (hdc=0x420109e7, type=0x7) returned 0x280509e8 [0067.616] GetCurrentObject (hdc=0x420109e7, type=0x6) returned 0x18a002e [0067.616] SaveDC (hdc=0x420109e7) returned 1 [0067.616] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x790409f1 [0067.616] GetClipRgn (hdc=0x420109e7, hrgn=0x790409f1) returned 0 [0067.616] SelectClipRgn (hdc=0x420109e7, hrgn=0xffffffff9f0409ff) returned 2 [0067.616] DeleteObject (ho=0x790409f1) returned 1 [0067.616] DeleteObject (ho=0xffffffff9f0409ff) returned 1 [0067.616] OffsetViewportOrgEx (in: hdc=0x420109e7, x=0, y=0, lppt=0x26946d0 | out: lppt=0x26946d0) returned 1 [0067.617] OffsetViewportOrgEx (in: hdc=0x420109e7, x=-417, y=-278, lppt=0x26946e8 | out: lppt=0x26946e8) returned 1 [0067.617] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0067.617] GetCurrentObject (hdc=0x420109e7, type=0x1) returned 0x1b00017 [0067.617] GetCurrentObject (hdc=0x420109e7, type=0x2) returned 0x1900010 [0067.617] GetCurrentObject (hdc=0x420109e7, type=0x7) returned 0x280509e8 [0067.617] GetCurrentObject (hdc=0x420109e7, type=0x6) returned 0x18a002e [0067.617] SaveDC (hdc=0x420109e7) returned 2 [0067.617] GetNearestColor (hdc=0x420109e7, color=0x6c4607) returned 0x6c4607 [0067.617] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff6100276 [0067.617] FillRect (hDC=0x420109e7, lprc=0x26de08, hbr=0xfffffffff6100276) returned 1 [0067.660] DeleteObject (ho=0xfffffffff6100276) returned 1 [0067.661] RestoreDC (hdc=0x420109e7, nSavedDC=-1) returned 1 [0067.661] RestoreDC (hdc=0x420109e7, nSavedDC=-1) returned 1 [0067.661] GdipReleaseDC (graphics=0x1b86d040, hdc=0x420109e7) returned 0x0 [0067.661] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc4e0dbd) returned 0x0 [0067.661] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0067.661] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.661] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.661] GetSystemMetrics (nIndex=42) returned 0 [0067.661] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.661] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.661] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1c) returned 0x0 [0067.663] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0067.663] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0067.663] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0067.663] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0067.664] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0067.664] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0067.664] GetCurrentObject (hdc=0x420109e7, type=0x1) returned 0x1b00017 [0067.664] GetCurrentObject (hdc=0x420109e7, type=0x2) returned 0x1900010 [0067.664] GetCurrentObject (hdc=0x420109e7, type=0x7) returned 0x280509e8 [0067.664] GetCurrentObject (hdc=0x420109e7, type=0x6) returned 0x18a002e [0067.664] SaveDC (hdc=0x420109e7) returned 1 [0067.664] GetNearestColor (hdc=0x420109e7, color=0xf0f0f0) returned 0xf0f0f0 [0067.664] RestoreDC (hdc=0x420109e7, nSavedDC=-1) returned 1 [0067.664] GdipReleaseDC (graphics=0x1b86d040, hdc=0x420109e7) returned 0x0 [0067.665] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0067.665] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0067.665] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0067.665] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0067.665] GetCurrentObject (hdc=0x420109e7, type=0x1) returned 0x1b00017 [0067.665] GetCurrentObject (hdc=0x420109e7, type=0x2) returned 0x1900010 [0067.665] GetCurrentObject (hdc=0x420109e7, type=0x7) returned 0x280509e8 [0067.665] GetCurrentObject (hdc=0x420109e7, type=0x6) returned 0x18a002e [0067.665] SaveDC (hdc=0x420109e7) returned 1 [0067.665] GetTextAlign (hdc=0x420109e7) returned 0x0 [0067.665] GetTextColor (hdc=0x420109e7) returned 0x0 [0067.665] SetTextColor (hdc=0x420109e7, color=0xf0f0f0) returned 0x0 [0067.665] GetCurrentObject (hdc=0x420109e7, type=0x6) returned 0x18a002e [0067.665] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0067.665] SelectObject (hdc=0x420109e7, h=0x260a09ba) returned 0x18a002e [0067.665] GetBkMode (hdc=0x420109e7) returned 2 [0067.665] SetBkMode (hdc=0x420109e7, mode=1) returned 2 [0067.665] DrawTextExW (in: hdc=0x420109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2698188 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0067.666] DrawTextExW (in: hdc=0x420109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2698188 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0067.666] RestoreDC (hdc=0x420109e7, nSavedDC=-1) returned 1 [0067.666] GdipReleaseDC (graphics=0x1b86d040, hdc=0x420109e7) returned 0x0 [0067.666] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0067.666] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x420109e7, x1=0, y1=0, rop=0xcc0020) returned 1 [0067.667] GdipReleaseDC (graphics=0x1b86d040, hdc=0x420109e7) returned 0x0 [0067.667] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0067.667] SelectObject (hdc=0x420109e7, h=0x185000f) returned 0x280509e8 [0067.667] DeleteDC (hdc=0x420109e7) returned 1 [0067.667] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0067.667] DeleteObject (ho=0x280509e8) returned 1 [0067.670] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0067.670] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.670] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.670] WaitMessage () returned 1 [0067.812] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.812] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.812] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.812] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.812] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.812] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0067.812] GetCurrentThreadId () returned 0xa28 [0067.812] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0067.812] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.812] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.812] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.812] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.812] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.812] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0067.812] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0067.812] CreateCompatibleDC (hdc=0x150109ce) returned 0x4001026a [0067.812] GetObjectType (h=0x150109ce) returned 0x3 [0067.812] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x290509e8 [0067.813] GetDIBits (in: hdc=0x150109ce, hbm=0x290509e8, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.813] GetDIBits (in: hdc=0x150109ce, hbm=0x290509e8, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.813] DeleteObject (ho=0x290509e8) returned 1 [0067.813] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x430509e7 [0067.813] SelectObject (hdc=0x4001026a, h=0x430509e7) returned 0x185000f [0067.813] GdipCreateFromHDC (hdc=0x4001026a, graphics=0x26e408) returned 0x0 [0067.813] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0067.813] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0067.813] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0067.813] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0067.813] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0067.813] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.813] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0067.813] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.813] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0067.813] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0067.813] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0067.813] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0067.814] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0067.814] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.814] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.814] GetSystemMetrics (nIndex=42) returned 0 [0067.814] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.814] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.814] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0067.814] IsAppThemed () returned 0x1 [0067.814] GetThemeAppProperties () returned 0x3 [0067.814] GetThemeAppProperties () returned 0x3 [0067.814] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0067.814] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0067.814] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0067.814] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0067.814] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0067.814] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.814] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.814] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.814] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0067.814] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.814] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.814] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.814] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0067.814] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0067.814] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0067.814] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0067.814] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0067.815] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0067.815] GetCurrentObject (hdc=0x4001026a, type=0x1) returned 0x1b00017 [0067.815] GetCurrentObject (hdc=0x4001026a, type=0x2) returned 0x1900010 [0067.815] GetCurrentObject (hdc=0x4001026a, type=0x7) returned 0x430509e7 [0067.815] GetCurrentObject (hdc=0x4001026a, type=0x6) returned 0x18a002e [0067.815] SaveDC (hdc=0x4001026a) returned 1 [0067.815] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa00409ff [0067.815] GetClipRgn (hdc=0x4001026a, hrgn=0xffffffffa00409ff) returned 0 [0067.815] SelectClipRgn (hdc=0x4001026a, hrgn=0x7c0409f1) returned 2 [0067.815] DeleteObject (ho=0xffffffffa00409ff) returned 1 [0067.815] DeleteObject (ho=0x7c0409f1) returned 1 [0067.815] OffsetViewportOrgEx (in: hdc=0x4001026a, x=0, y=0, lppt=0x269bf60 | out: lppt=0x269bf60) returned 1 [0067.815] OffsetViewportOrgEx (in: hdc=0x4001026a, x=-417, y=-278, lppt=0x269bf78 | out: lppt=0x269bf78) returned 1 [0067.815] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0067.815] GetCurrentObject (hdc=0x4001026a, type=0x1) returned 0x1b00017 [0067.815] GetCurrentObject (hdc=0x4001026a, type=0x2) returned 0x1900010 [0067.815] GetCurrentObject (hdc=0x4001026a, type=0x7) returned 0x430509e7 [0067.815] GetCurrentObject (hdc=0x4001026a, type=0x6) returned 0x18a002e [0067.815] SaveDC (hdc=0x4001026a) returned 2 [0067.815] GetNearestColor (hdc=0x4001026a, color=0x6c4607) returned 0x6c4607 [0067.815] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff7100276 [0067.815] FillRect (hDC=0x4001026a, lprc=0x26de08, hbr=0xfffffffff7100276) returned 1 [0067.822] DeleteObject (ho=0xfffffffff7100276) returned 1 [0067.822] RestoreDC (hdc=0x4001026a, nSavedDC=-1) returned 1 [0067.822] RestoreDC (hdc=0x4001026a, nSavedDC=-1) returned 1 [0067.822] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4001026a) returned 0x0 [0067.822] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc4c0dbd) returned 0x0 [0067.822] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0067.822] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.822] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.822] GetSystemMetrics (nIndex=42) returned 0 [0067.822] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.822] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.822] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0067.822] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0067.822] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0067.822] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0067.822] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0067.822] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0067.822] GetCurrentObject (hdc=0x4001026a, type=0x1) returned 0x1b00017 [0067.822] GetCurrentObject (hdc=0x4001026a, type=0x2) returned 0x1900010 [0067.822] GetCurrentObject (hdc=0x4001026a, type=0x7) returned 0x430509e7 [0067.823] GetCurrentObject (hdc=0x4001026a, type=0x6) returned 0x18a002e [0067.823] SaveDC (hdc=0x4001026a) returned 1 [0067.823] GetNearestColor (hdc=0x4001026a, color=0xf0f0f0) returned 0xf0f0f0 [0067.823] RestoreDC (hdc=0x4001026a, nSavedDC=-1) returned 1 [0067.823] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4001026a) returned 0x0 [0067.823] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0067.823] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0067.823] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0067.823] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0067.823] GetCurrentObject (hdc=0x4001026a, type=0x1) returned 0x1b00017 [0067.823] GetCurrentObject (hdc=0x4001026a, type=0x2) returned 0x1900010 [0067.823] GetCurrentObject (hdc=0x4001026a, type=0x7) returned 0x430509e7 [0067.823] GetCurrentObject (hdc=0x4001026a, type=0x6) returned 0x18a002e [0067.823] SaveDC (hdc=0x4001026a) returned 1 [0067.823] GetTextAlign (hdc=0x4001026a) returned 0x0 [0067.823] GetTextColor (hdc=0x4001026a) returned 0x0 [0067.823] SetTextColor (hdc=0x4001026a, color=0xf0f0f0) returned 0x0 [0067.823] GetCurrentObject (hdc=0x4001026a, type=0x6) returned 0x18a002e [0067.824] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0067.824] SelectObject (hdc=0x4001026a, h=0x260a09ba) returned 0x18a002e [0067.824] GetBkMode (hdc=0x4001026a) returned 2 [0067.824] SetBkMode (hdc=0x4001026a, mode=1) returned 2 [0067.824] DrawTextExW (in: hdc=0x4001026a, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x269cc28 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0067.824] DrawTextExW (in: hdc=0x4001026a, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x269cc28 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0067.824] RestoreDC (hdc=0x4001026a, nSavedDC=-1) returned 1 [0067.824] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4001026a) returned 0x0 [0067.824] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0067.824] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x4001026a, x1=0, y1=0, rop=0xcc0020) returned 1 [0067.825] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4001026a) returned 0x0 [0067.825] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0067.825] SelectObject (hdc=0x4001026a, h=0x185000f) returned 0x430509e7 [0067.825] DeleteDC (hdc=0x4001026a) returned 1 [0067.825] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0067.825] DeleteObject (ho=0x430509e7) returned 1 [0067.828] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0067.828] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.828] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0067.828] WaitMessage () returned 1 [0067.994] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.994] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.994] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.994] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.995] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.995] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0067.995] GetCurrentThreadId () returned 0xa28 [0067.995] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0067.995] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.995] IsWindowUnicode (hWnd=0x3015e) returned 1 [0067.995] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0067.995] TranslateMessage (lpMsg=0x26ee10) returned 0 [0067.995] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0067.995] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0067.995] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0067.995] CreateCompatibleDC (hdc=0x150109ce) returned 0x2b0109e8 [0067.995] GetObjectType (h=0x150109ce) returned 0x3 [0067.995] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x440509e7 [0067.995] GetDIBits (in: hdc=0x150109ce, hbm=0x440509e7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.995] GetDIBits (in: hdc=0x150109ce, hbm=0x440509e7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0067.995] DeleteObject (ho=0x440509e7) returned 1 [0067.995] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4105026a [0067.995] SelectObject (hdc=0x2b0109e8, h=0x4105026a) returned 0x185000f [0067.996] GdipCreateFromHDC (hdc=0x2b0109e8, graphics=0x26e408) returned 0x0 [0067.996] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0067.996] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0067.996] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0067.996] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0067.996] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0067.996] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.996] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0067.996] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.996] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0067.996] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0067.996] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0067.996] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0067.996] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0067.996] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0067.996] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0067.996] GetSystemMetrics (nIndex=42) returned 0 [0067.996] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0067.996] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0067.996] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0067.996] IsAppThemed () returned 0x1 [0067.996] GetThemeAppProperties () returned 0x3 [0067.997] GetThemeAppProperties () returned 0x3 [0067.997] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0067.997] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0067.997] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0067.997] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0067.997] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0067.997] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.997] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.997] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.997] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0067.997] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0067.997] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0067.997] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0067.997] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0067.997] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0067.997] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0067.997] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0067.997] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0067.997] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0067.997] GetCurrentObject (hdc=0x2b0109e8, type=0x1) returned 0x1b00017 [0067.997] GetCurrentObject (hdc=0x2b0109e8, type=0x2) returned 0x1900010 [0067.997] GetCurrentObject (hdc=0x2b0109e8, type=0x7) returned 0x4105026a [0067.997] GetCurrentObject (hdc=0x2b0109e8, type=0x6) returned 0x18a002e [0067.997] SaveDC (hdc=0x2b0109e8) returned 1 [0067.997] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x7d0409f1 [0067.997] GetClipRgn (hdc=0x2b0109e8, hrgn=0x7d0409f1) returned 0 [0067.997] SelectClipRgn (hdc=0x2b0109e8, hrgn=0xffffffffa30409ff) returned 2 [0067.998] DeleteObject (ho=0x7d0409f1) returned 1 [0067.998] DeleteObject (ho=0xffffffffa30409ff) returned 1 [0067.998] OffsetViewportOrgEx (in: hdc=0x2b0109e8, x=0, y=0, lppt=0x27008b8 | out: lppt=0x27008b8) returned 1 [0067.998] OffsetViewportOrgEx (in: hdc=0x2b0109e8, x=-417, y=-278, lppt=0x27008d0 | out: lppt=0x27008d0) returned 1 [0067.998] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0067.998] GetCurrentObject (hdc=0x2b0109e8, type=0x1) returned 0x1b00017 [0067.998] GetCurrentObject (hdc=0x2b0109e8, type=0x2) returned 0x1900010 [0067.998] GetCurrentObject (hdc=0x2b0109e8, type=0x7) returned 0x4105026a [0067.998] GetCurrentObject (hdc=0x2b0109e8, type=0x6) returned 0x18a002e [0067.998] SaveDC (hdc=0x2b0109e8) returned 2 [0067.998] GetNearestColor (hdc=0x2b0109e8, color=0x6c4607) returned 0x6c4607 [0067.998] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff8100276 [0067.998] FillRect (hDC=0x2b0109e8, lprc=0x26de08, hbr=0xfffffffff8100276) returned 1 [0068.005] DeleteObject (ho=0xfffffffff8100276) returned 1 [0068.005] RestoreDC (hdc=0x2b0109e8, nSavedDC=-1) returned 1 [0068.005] RestoreDC (hdc=0x2b0109e8, nSavedDC=-1) returned 1 [0068.005] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2b0109e8) returned 0x0 [0068.005] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc4a0dbd) returned 0x0 [0068.005] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0068.005] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0068.005] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0068.005] GetSystemMetrics (nIndex=42) returned 0 [0068.005] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0068.005] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0068.005] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x1e) returned 0x0 [0068.006] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0068.006] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0068.006] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0068.006] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0068.006] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0068.006] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0068.006] GetCurrentObject (hdc=0x2b0109e8, type=0x1) returned 0x1b00017 [0068.006] GetCurrentObject (hdc=0x2b0109e8, type=0x2) returned 0x1900010 [0068.006] GetCurrentObject (hdc=0x2b0109e8, type=0x7) returned 0x4105026a [0068.006] GetCurrentObject (hdc=0x2b0109e8, type=0x6) returned 0x18a002e [0068.006] SaveDC (hdc=0x2b0109e8) returned 1 [0068.006] GetNearestColor (hdc=0x2b0109e8, color=0xf0f0f0) returned 0xf0f0f0 [0068.006] RestoreDC (hdc=0x2b0109e8, nSavedDC=-1) returned 1 [0068.006] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2b0109e8) returned 0x0 [0068.006] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0068.007] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0068.007] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0068.007] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0068.007] GetCurrentObject (hdc=0x2b0109e8, type=0x1) returned 0x1b00017 [0068.007] GetCurrentObject (hdc=0x2b0109e8, type=0x2) returned 0x1900010 [0068.007] GetCurrentObject (hdc=0x2b0109e8, type=0x7) returned 0x4105026a [0068.007] GetCurrentObject (hdc=0x2b0109e8, type=0x6) returned 0x18a002e [0068.007] SaveDC (hdc=0x2b0109e8) returned 1 [0068.007] GetTextAlign (hdc=0x2b0109e8) returned 0x0 [0068.007] GetTextColor (hdc=0x2b0109e8) returned 0x0 [0068.007] SetTextColor (hdc=0x2b0109e8, color=0xf0f0f0) returned 0x0 [0068.007] GetCurrentObject (hdc=0x2b0109e8, type=0x6) returned 0x18a002e [0068.007] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0068.007] SelectObject (hdc=0x2b0109e8, h=0x260a09ba) returned 0x18a002e [0068.007] GetBkMode (hdc=0x2b0109e8) returned 2 [0068.007] SetBkMode (hdc=0x2b0109e8, mode=1) returned 2 [0068.007] DrawTextExW (in: hdc=0x2b0109e8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2701788 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0068.007] DrawTextExW (in: hdc=0x2b0109e8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2701788 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0068.008] RestoreDC (hdc=0x2b0109e8, nSavedDC=-1) returned 1 [0068.008] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2b0109e8) returned 0x0 [0068.008] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0068.008] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x2b0109e8, x1=0, y1=0, rop=0xcc0020) returned 1 [0068.008] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2b0109e8) returned 0x0 [0068.008] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0068.008] SelectObject (hdc=0x2b0109e8, h=0x185000f) returned 0x4105026a [0068.008] DeleteDC (hdc=0x2b0109e8) returned 1 [0068.008] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0068.008] DeleteObject (ho=0x4105026a) returned 1 [0068.011] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0068.012] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.012] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.012] WaitMessage () returned 1 [0068.186] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.186] IsWindowUnicode (hWnd=0x3015e) returned 1 [0068.186] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.186] TranslateMessage (lpMsg=0x26ee10) returned 0 [0068.186] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0068.186] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0068.186] GetCurrentThreadId () returned 0xa28 [0068.186] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0068.186] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.186] IsWindowUnicode (hWnd=0x3015e) returned 1 [0068.186] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.186] TranslateMessage (lpMsg=0x26ee10) returned 0 [0068.186] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0068.186] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0068.187] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0068.187] CreateCompatibleDC (hdc=0x150109ce) returned 0x460109e7 [0068.187] GetObjectType (h=0x150109ce) returned 0x3 [0068.187] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x4205026a [0068.187] GetDIBits (in: hdc=0x150109ce, hbm=0x4205026a, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0068.187] GetDIBits (in: hdc=0x150109ce, hbm=0x4205026a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0068.187] DeleteObject (ho=0x4205026a) returned 1 [0068.187] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x2c0509e8 [0068.187] SelectObject (hdc=0x460109e7, h=0x2c0509e8) returned 0x185000f [0068.187] GdipCreateFromHDC (hdc=0x460109e7, graphics=0x26e408) returned 0x0 [0068.187] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0068.187] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0068.187] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0068.188] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0068.188] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0068.188] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.188] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0068.188] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.188] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0068.188] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0068.188] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0068.188] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0068.188] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0068.188] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0068.188] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0068.188] GetSystemMetrics (nIndex=42) returned 0 [0068.188] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0068.188] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0068.188] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0068.188] IsAppThemed () returned 0x1 [0068.188] GetThemeAppProperties () returned 0x3 [0068.188] GetThemeAppProperties () returned 0x3 [0068.188] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0068.188] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0068.188] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0068.188] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0068.188] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0068.188] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.188] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0068.188] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.189] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0068.189] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.189] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0068.189] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.189] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0068.189] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0068.189] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0068.189] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0068.189] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0068.189] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0068.189] GetCurrentObject (hdc=0x460109e7, type=0x1) returned 0x1b00017 [0068.189] GetCurrentObject (hdc=0x460109e7, type=0x2) returned 0x1900010 [0068.189] GetCurrentObject (hdc=0x460109e7, type=0x7) returned 0x2c0509e8 [0068.189] GetCurrentObject (hdc=0x460109e7, type=0x6) returned 0x18a002e [0068.189] SaveDC (hdc=0x460109e7) returned 1 [0068.189] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa40409ff [0068.189] GetClipRgn (hdc=0x460109e7, hrgn=0xffffffffa40409ff) returned 0 [0068.189] SelectClipRgn (hdc=0x460109e7, hrgn=0xffffffff800409f1) returned 2 [0068.189] DeleteObject (ho=0xffffffffa40409ff) returned 1 [0068.189] DeleteObject (ho=0xffffffff800409f1) returned 1 [0068.189] OffsetViewportOrgEx (in: hdc=0x460109e7, x=0, y=0, lppt=0x270e930 | out: lppt=0x270e930) returned 1 [0068.189] OffsetViewportOrgEx (in: hdc=0x460109e7, x=-417, y=-278, lppt=0x270e948 | out: lppt=0x270e948) returned 1 [0068.189] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0068.189] GetCurrentObject (hdc=0x460109e7, type=0x1) returned 0x1b00017 [0068.189] GetCurrentObject (hdc=0x460109e7, type=0x2) returned 0x1900010 [0068.189] GetCurrentObject (hdc=0x460109e7, type=0x7) returned 0x2c0509e8 [0068.190] GetCurrentObject (hdc=0x460109e7, type=0x6) returned 0x18a002e [0068.190] SaveDC (hdc=0x460109e7) returned 2 [0068.190] GetNearestColor (hdc=0x460109e7, color=0x6c4607) returned 0x6c4607 [0068.190] CreateSolidBrush (color=0x6c4607) returned 0xfffffffff9100276 [0068.190] FillRect (hDC=0x460109e7, lprc=0x26de08, hbr=0xfffffffff9100276) returned 1 [0068.196] DeleteObject (ho=0xfffffffff9100276) returned 1 [0068.196] RestoreDC (hdc=0x460109e7, nSavedDC=-1) returned 1 [0068.196] RestoreDC (hdc=0x460109e7, nSavedDC=-1) returned 1 [0068.196] GdipReleaseDC (graphics=0x1b86d040, hdc=0x460109e7) returned 0x0 [0068.196] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc480dbd) returned 0x0 [0068.196] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0068.196] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0068.196] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0068.196] GetSystemMetrics (nIndex=42) returned 0 [0068.196] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0068.196] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0068.196] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0068.196] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0068.196] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0068.196] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0068.197] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0068.197] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0068.197] GetCurrentObject (hdc=0x460109e7, type=0x1) returned 0x1b00017 [0068.197] GetCurrentObject (hdc=0x460109e7, type=0x2) returned 0x1900010 [0068.197] GetCurrentObject (hdc=0x460109e7, type=0x7) returned 0x2c0509e8 [0068.197] GetCurrentObject (hdc=0x460109e7, type=0x6) returned 0x18a002e [0068.197] SaveDC (hdc=0x460109e7) returned 1 [0068.197] GetNearestColor (hdc=0x460109e7, color=0xf0f0f0) returned 0xf0f0f0 [0068.197] RestoreDC (hdc=0x460109e7, nSavedDC=-1) returned 1 [0068.197] GdipReleaseDC (graphics=0x1b86d040, hdc=0x460109e7) returned 0x0 [0068.197] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0068.197] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0068.197] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0068.197] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0068.197] GetCurrentObject (hdc=0x460109e7, type=0x1) returned 0x1b00017 [0068.197] GetCurrentObject (hdc=0x460109e7, type=0x2) returned 0x1900010 [0068.197] GetCurrentObject (hdc=0x460109e7, type=0x7) returned 0x2c0509e8 [0068.197] GetCurrentObject (hdc=0x460109e7, type=0x6) returned 0x18a002e [0068.197] SaveDC (hdc=0x460109e7) returned 1 [0068.198] GetTextAlign (hdc=0x460109e7) returned 0x0 [0068.198] GetTextColor (hdc=0x460109e7) returned 0x0 [0068.198] SetTextColor (hdc=0x460109e7, color=0xf0f0f0) returned 0x0 [0068.198] GetCurrentObject (hdc=0x460109e7, type=0x6) returned 0x18a002e [0068.198] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0068.198] SelectObject (hdc=0x460109e7, h=0x260a09ba) returned 0x18a002e [0068.198] GetBkMode (hdc=0x460109e7) returned 2 [0068.198] SetBkMode (hdc=0x460109e7, mode=1) returned 2 [0068.198] DrawTextExW (in: hdc=0x460109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x270f5f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0068.198] DrawTextExW (in: hdc=0x460109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x270f5f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0068.199] RestoreDC (hdc=0x460109e7, nSavedDC=-1) returned 1 [0068.199] GdipReleaseDC (graphics=0x1b86d040, hdc=0x460109e7) returned 0x0 [0068.199] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0068.199] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x460109e7, x1=0, y1=0, rop=0xcc0020) returned 1 [0068.199] GdipReleaseDC (graphics=0x1b86d040, hdc=0x460109e7) returned 0x0 [0068.199] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0068.199] SelectObject (hdc=0x460109e7, h=0x185000f) returned 0x2c0509e8 [0068.199] DeleteDC (hdc=0x460109e7) returned 1 [0068.199] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0068.199] DeleteObject (ho=0x2c0509e8) returned 1 [0068.202] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0068.202] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.202] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.202] WaitMessage () returned 1 [0068.207] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.207] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0068.207] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0068.207] NtdllDefWindowProc_W (hWnd=0x1c0270, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0068.207] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.207] WaitMessage () returned 1 [0068.353] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.353] IsWindowUnicode (hWnd=0x3015e) returned 1 [0068.353] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.353] TranslateMessage (lpMsg=0x26ee10) returned 0 [0068.353] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0068.353] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0068.353] GetCurrentThreadId () returned 0xa28 [0068.353] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0068.353] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.353] IsWindowUnicode (hWnd=0x3015e) returned 1 [0068.353] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.353] TranslateMessage (lpMsg=0x26ee10) returned 0 [0068.353] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0068.353] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0068.354] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0068.354] CreateCompatibleDC (hdc=0x150109ce) returned 0x4401026a [0068.354] GetObjectType (h=0x150109ce) returned 0x3 [0068.354] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x2d0509e8 [0068.354] GetDIBits (in: hdc=0x150109ce, hbm=0x2d0509e8, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0068.354] GetDIBits (in: hdc=0x150109ce, hbm=0x2d0509e8, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0068.354] DeleteObject (ho=0x2d0509e8) returned 1 [0068.354] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x470509e7 [0068.354] SelectObject (hdc=0x4401026a, h=0x470509e7) returned 0x185000f [0068.354] GdipCreateFromHDC (hdc=0x4401026a, graphics=0x26e408) returned 0x0 [0068.354] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0068.354] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0068.355] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0068.355] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0068.355] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0068.355] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.355] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0068.355] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.355] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0068.355] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0068.355] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0068.355] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0068.355] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0068.355] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0068.355] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0068.355] GetSystemMetrics (nIndex=42) returned 0 [0068.355] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0068.355] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0068.355] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0068.355] IsAppThemed () returned 0x1 [0068.355] GetThemeAppProperties () returned 0x3 [0068.355] GetThemeAppProperties () returned 0x3 [0068.355] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0068.355] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0068.355] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0068.355] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0068.355] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0068.355] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.355] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0068.356] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.356] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0068.356] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.356] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0068.356] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.356] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0068.356] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0068.356] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0068.356] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0068.356] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0068.356] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0068.356] GetCurrentObject (hdc=0x4401026a, type=0x1) returned 0x1b00017 [0068.356] GetCurrentObject (hdc=0x4401026a, type=0x2) returned 0x1900010 [0068.356] GetCurrentObject (hdc=0x4401026a, type=0x7) returned 0x470509e7 [0068.356] GetCurrentObject (hdc=0x4401026a, type=0x6) returned 0x18a002e [0068.356] SaveDC (hdc=0x4401026a) returned 1 [0068.356] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff810409f1 [0068.356] GetClipRgn (hdc=0x4401026a, hrgn=0xffffffff810409f1) returned 0 [0068.356] SelectClipRgn (hdc=0x4401026a, hrgn=0xffffffffa70409ff) returned 2 [0068.356] DeleteObject (ho=0xffffffff810409f1) returned 1 [0068.356] DeleteObject (ho=0xffffffffa70409ff) returned 1 [0068.356] OffsetViewportOrgEx (in: hdc=0x4401026a, x=0, y=0, lppt=0x26d39f0 | out: lppt=0x26d39f0) returned 1 [0068.356] OffsetViewportOrgEx (in: hdc=0x4401026a, x=-417, y=-278, lppt=0x26d3a08 | out: lppt=0x26d3a08) returned 1 [0068.356] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0068.357] GetCurrentObject (hdc=0x4401026a, type=0x1) returned 0x1b00017 [0068.357] GetCurrentObject (hdc=0x4401026a, type=0x2) returned 0x1900010 [0068.357] GetCurrentObject (hdc=0x4401026a, type=0x7) returned 0x470509e7 [0068.357] GetCurrentObject (hdc=0x4401026a, type=0x6) returned 0x18a002e [0068.357] SaveDC (hdc=0x4401026a) returned 2 [0068.357] GetNearestColor (hdc=0x4401026a, color=0x6c4607) returned 0x6c4607 [0068.357] CreateSolidBrush (color=0x6c4607) returned 0xfffffffffa100276 [0068.357] FillRect (hDC=0x4401026a, lprc=0x26de08, hbr=0xfffffffffa100276) returned 1 [0068.363] DeleteObject (ho=0xfffffffffa100276) returned 1 [0068.363] RestoreDC (hdc=0x4401026a, nSavedDC=-1) returned 1 [0068.363] RestoreDC (hdc=0x4401026a, nSavedDC=-1) returned 1 [0068.363] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4401026a) returned 0x0 [0068.363] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc460dbd) returned 0x0 [0068.363] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0068.363] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0068.364] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0068.364] GetSystemMetrics (nIndex=42) returned 0 [0068.364] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0068.364] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0068.364] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x20) returned 0x0 [0068.364] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0068.364] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0068.364] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0068.365] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0068.365] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0068.365] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0068.365] GetCurrentObject (hdc=0x4401026a, type=0x1) returned 0x1b00017 [0068.365] GetCurrentObject (hdc=0x4401026a, type=0x2) returned 0x1900010 [0068.365] GetCurrentObject (hdc=0x4401026a, type=0x7) returned 0x470509e7 [0068.365] GetCurrentObject (hdc=0x4401026a, type=0x6) returned 0x18a002e [0068.365] SaveDC (hdc=0x4401026a) returned 1 [0068.365] GetNearestColor (hdc=0x4401026a, color=0xf0f0f0) returned 0xf0f0f0 [0068.365] RestoreDC (hdc=0x4401026a, nSavedDC=-1) returned 1 [0068.365] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4401026a) returned 0x0 [0068.365] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0068.365] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0068.365] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0068.365] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0068.365] GetCurrentObject (hdc=0x4401026a, type=0x1) returned 0x1b00017 [0068.365] GetCurrentObject (hdc=0x4401026a, type=0x2) returned 0x1900010 [0068.365] GetCurrentObject (hdc=0x4401026a, type=0x7) returned 0x470509e7 [0068.365] GetCurrentObject (hdc=0x4401026a, type=0x6) returned 0x18a002e [0068.365] SaveDC (hdc=0x4401026a) returned 1 [0068.366] GetTextAlign (hdc=0x4401026a) returned 0x0 [0068.366] GetTextColor (hdc=0x4401026a) returned 0x0 [0068.366] SetTextColor (hdc=0x4401026a, color=0xf0f0f0) returned 0x0 [0068.366] GetCurrentObject (hdc=0x4401026a, type=0x6) returned 0x18a002e [0068.366] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0068.366] SelectObject (hdc=0x4401026a, h=0x260a09ba) returned 0x18a002e [0068.366] GetBkMode (hdc=0x4401026a) returned 2 [0068.366] SetBkMode (hdc=0x4401026a, mode=1) returned 2 [0068.366] DrawTextExW (in: hdc=0x4401026a, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26d48b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0068.366] DrawTextExW (in: hdc=0x4401026a, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26d48b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0068.367] RestoreDC (hdc=0x4401026a, nSavedDC=-1) returned 1 [0068.367] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4401026a) returned 0x0 [0068.367] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0068.367] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x4401026a, x1=0, y1=0, rop=0xcc0020) returned 1 [0068.367] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4401026a) returned 0x0 [0068.367] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0068.367] SelectObject (hdc=0x4401026a, h=0x185000f) returned 0x470509e7 [0068.367] DeleteDC (hdc=0x4401026a) returned 1 [0068.367] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0068.367] DeleteObject (ho=0x470509e7) returned 1 [0068.370] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0068.370] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.370] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.370] WaitMessage () returned 1 [0068.545] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.545] IsWindowUnicode (hWnd=0x3015e) returned 1 [0068.545] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.545] TranslateMessage (lpMsg=0x26ee10) returned 0 [0068.545] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0068.545] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0068.545] GetCurrentThreadId () returned 0xa28 [0068.545] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0068.545] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.545] IsWindowUnicode (hWnd=0x3015e) returned 1 [0068.545] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.545] TranslateMessage (lpMsg=0x26ee10) returned 0 [0068.545] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0068.545] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0068.545] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0068.545] CreateCompatibleDC (hdc=0x150109ce) returned 0x2f0109e8 [0068.545] GetObjectType (h=0x150109ce) returned 0x3 [0068.545] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x480509e7 [0068.545] GetDIBits (in: hdc=0x150109ce, hbm=0x480509e7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0068.546] GetDIBits (in: hdc=0x150109ce, hbm=0x480509e7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0068.546] DeleteObject (ho=0x480509e7) returned 1 [0068.546] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4505026a [0068.546] SelectObject (hdc=0x2f0109e8, h=0x4505026a) returned 0x185000f [0068.546] GdipCreateFromHDC (hdc=0x2f0109e8, graphics=0x26e408) returned 0x0 [0068.546] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0068.546] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0068.546] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0068.546] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0068.546] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0068.546] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.546] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0068.546] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.546] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0068.546] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0068.546] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0068.546] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0068.546] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0068.547] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0068.547] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0068.547] GetSystemMetrics (nIndex=42) returned 0 [0068.547] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0068.547] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0068.547] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0068.547] IsAppThemed () returned 0x1 [0068.547] GetThemeAppProperties () returned 0x3 [0068.547] GetThemeAppProperties () returned 0x3 [0068.547] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0068.547] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0068.547] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0068.547] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0068.547] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0068.547] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.547] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0068.547] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.547] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0068.547] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.547] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0068.547] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.547] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0068.547] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0068.547] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0068.547] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0068.547] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0068.547] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0068.547] GetCurrentObject (hdc=0x2f0109e8, type=0x1) returned 0x1b00017 [0068.548] GetCurrentObject (hdc=0x2f0109e8, type=0x2) returned 0x1900010 [0068.548] GetCurrentObject (hdc=0x2f0109e8, type=0x7) returned 0x4505026a [0068.548] GetCurrentObject (hdc=0x2f0109e8, type=0x6) returned 0x18a002e [0068.548] SaveDC (hdc=0x2f0109e8) returned 1 [0068.548] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa80409ff [0068.548] GetClipRgn (hdc=0x2f0109e8, hrgn=0xffffffffa80409ff) returned 0 [0068.548] SelectClipRgn (hdc=0x2f0109e8, hrgn=0xffffffff840409f1) returned 2 [0068.548] DeleteObject (ho=0xffffffffa80409ff) returned 1 [0068.548] DeleteObject (ho=0xffffffff840409f1) returned 1 [0068.548] OffsetViewportOrgEx (in: hdc=0x2f0109e8, x=0, y=0, lppt=0x26a06f8 | out: lppt=0x26a06f8) returned 1 [0068.548] OffsetViewportOrgEx (in: hdc=0x2f0109e8, x=-417, y=-278, lppt=0x26a0710 | out: lppt=0x26a0710) returned 1 [0068.548] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0068.548] GetCurrentObject (hdc=0x2f0109e8, type=0x1) returned 0x1b00017 [0068.548] GetCurrentObject (hdc=0x2f0109e8, type=0x2) returned 0x1900010 [0068.548] GetCurrentObject (hdc=0x2f0109e8, type=0x7) returned 0x4505026a [0068.548] GetCurrentObject (hdc=0x2f0109e8, type=0x6) returned 0x18a002e [0068.548] SaveDC (hdc=0x2f0109e8) returned 2 [0068.548] GetNearestColor (hdc=0x2f0109e8, color=0x6c4607) returned 0x6c4607 [0068.548] CreateSolidBrush (color=0x6c4607) returned 0xfffffffffb100276 [0068.548] FillRect (hDC=0x2f0109e8, lprc=0x26de08, hbr=0xfffffffffb100276) returned 1 [0068.554] DeleteObject (ho=0xfffffffffb100276) returned 1 [0068.554] RestoreDC (hdc=0x2f0109e8, nSavedDC=-1) returned 1 [0068.555] RestoreDC (hdc=0x2f0109e8, nSavedDC=-1) returned 1 [0068.555] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2f0109e8) returned 0x0 [0068.555] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc440dbd) returned 0x0 [0068.555] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0068.555] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0068.555] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0068.555] GetSystemMetrics (nIndex=42) returned 0 [0068.555] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0068.555] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0068.555] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0068.555] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0068.555] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0068.555] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0068.555] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0068.555] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0068.555] GetCurrentObject (hdc=0x2f0109e8, type=0x1) returned 0x1b00017 [0068.555] GetCurrentObject (hdc=0x2f0109e8, type=0x2) returned 0x1900010 [0068.555] GetCurrentObject (hdc=0x2f0109e8, type=0x7) returned 0x4505026a [0068.555] GetCurrentObject (hdc=0x2f0109e8, type=0x6) returned 0x18a002e [0068.555] SaveDC (hdc=0x2f0109e8) returned 1 [0068.555] GetNearestColor (hdc=0x2f0109e8, color=0xf0f0f0) returned 0xf0f0f0 [0068.555] RestoreDC (hdc=0x2f0109e8, nSavedDC=-1) returned 1 [0068.555] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2f0109e8) returned 0x0 [0068.556] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0068.556] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0068.556] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0068.556] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0068.556] GetCurrentObject (hdc=0x2f0109e8, type=0x1) returned 0x1b00017 [0068.556] GetCurrentObject (hdc=0x2f0109e8, type=0x2) returned 0x1900010 [0068.556] GetCurrentObject (hdc=0x2f0109e8, type=0x7) returned 0x4505026a [0068.556] GetCurrentObject (hdc=0x2f0109e8, type=0x6) returned 0x18a002e [0068.556] SaveDC (hdc=0x2f0109e8) returned 1 [0068.556] GetTextAlign (hdc=0x2f0109e8) returned 0x0 [0068.556] GetTextColor (hdc=0x2f0109e8) returned 0x0 [0068.556] SetTextColor (hdc=0x2f0109e8, color=0xf0f0f0) returned 0x0 [0068.556] GetCurrentObject (hdc=0x2f0109e8, type=0x6) returned 0x18a002e [0068.556] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0068.556] SelectObject (hdc=0x2f0109e8, h=0x260a09ba) returned 0x18a002e [0068.556] GetBkMode (hdc=0x2f0109e8) returned 2 [0068.556] SetBkMode (hdc=0x2f0109e8, mode=1) returned 2 [0068.556] DrawTextExW (in: hdc=0x2f0109e8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26a13c0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0068.557] DrawTextExW (in: hdc=0x2f0109e8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26a13c0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0068.557] RestoreDC (hdc=0x2f0109e8, nSavedDC=-1) returned 1 [0068.557] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2f0109e8) returned 0x0 [0068.557] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0068.557] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x2f0109e8, x1=0, y1=0, rop=0xcc0020) returned 1 [0068.557] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2f0109e8) returned 0x0 [0068.557] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0068.557] SelectObject (hdc=0x2f0109e8, h=0x185000f) returned 0x4505026a [0068.558] DeleteDC (hdc=0x2f0109e8) returned 1 [0068.558] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0068.558] DeleteObject (ho=0x4505026a) returned 1 [0068.565] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0068.565] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.565] WaitMessage () returned 1 [0068.873] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.873] IsWindowUnicode (hWnd=0x3015e) returned 1 [0068.873] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.873] TranslateMessage (lpMsg=0x26ee10) returned 0 [0068.873] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0068.873] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0068.873] GetCurrentThreadId () returned 0xa28 [0068.873] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0068.873] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.873] IsWindowUnicode (hWnd=0x3015e) returned 1 [0068.873] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0068.873] TranslateMessage (lpMsg=0x26ee10) returned 0 [0068.873] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0068.873] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0068.873] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0068.874] CreateCompatibleDC (hdc=0x150109ce) returned 0x4a0109e7 [0068.874] GetObjectType (h=0x150109ce) returned 0x3 [0068.874] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x4605026a [0068.874] GetDIBits (in: hdc=0x150109ce, hbm=0x4605026a, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0068.874] GetDIBits (in: hdc=0x150109ce, hbm=0x4605026a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0068.874] DeleteObject (ho=0x4605026a) returned 1 [0068.874] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x300509e8 [0068.874] SelectObject (hdc=0x4a0109e7, h=0x300509e8) returned 0x185000f [0068.874] GdipCreateFromHDC (hdc=0x4a0109e7, graphics=0x26e408) returned 0x0 [0068.874] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0068.874] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0068.874] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0068.874] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0068.874] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0068.875] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.875] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0068.875] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.875] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0068.875] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0068.875] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0068.875] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0068.875] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0068.875] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0068.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0068.875] GetSystemMetrics (nIndex=42) returned 0 [0068.875] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0068.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0068.875] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0068.875] IsAppThemed () returned 0x1 [0068.875] GetThemeAppProperties () returned 0x3 [0068.876] GetThemeAppProperties () returned 0x3 [0068.876] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0068.876] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0068.876] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0068.876] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0068.876] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0068.876] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.876] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0068.876] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.876] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0068.876] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0068.876] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0068.876] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0068.876] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0068.876] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0068.876] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0068.876] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0068.876] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0068.876] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0068.876] GetCurrentObject (hdc=0x4a0109e7, type=0x1) returned 0x1b00017 [0068.876] GetCurrentObject (hdc=0x4a0109e7, type=0x2) returned 0x1900010 [0068.876] GetCurrentObject (hdc=0x4a0109e7, type=0x7) returned 0x300509e8 [0068.876] GetCurrentObject (hdc=0x4a0109e7, type=0x6) returned 0x18a002e [0068.876] SaveDC (hdc=0x4a0109e7) returned 1 [0068.876] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff850409f1 [0068.877] GetClipRgn (hdc=0x4a0109e7, hrgn=0xffffffff850409f1) returned 0 [0068.877] SelectClipRgn (hdc=0x4a0109e7, hrgn=0xffffffffab0409ff) returned 2 [0068.877] DeleteObject (ho=0xffffffff850409f1) returned 1 [0068.877] DeleteObject (ho=0xffffffffab0409ff) returned 1 [0068.877] OffsetViewportOrgEx (in: hdc=0x4a0109e7, x=0, y=0, lppt=0x26b4b48 | out: lppt=0x26b4b48) returned 1 [0068.877] OffsetViewportOrgEx (in: hdc=0x4a0109e7, x=-417, y=-278, lppt=0x26b4bb0 | out: lppt=0x26b4bb0) returned 1 [0068.877] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0068.877] GetCurrentObject (hdc=0x4a0109e7, type=0x1) returned 0x1b00017 [0068.877] GetCurrentObject (hdc=0x4a0109e7, type=0x2) returned 0x1900010 [0068.877] GetCurrentObject (hdc=0x4a0109e7, type=0x7) returned 0x300509e8 [0068.877] GetCurrentObject (hdc=0x4a0109e7, type=0x6) returned 0x18a002e [0068.877] SaveDC (hdc=0x4a0109e7) returned 2 [0068.877] GetNearestColor (hdc=0x4a0109e7, color=0x6c4607) returned 0x6c4607 [0068.877] CreateSolidBrush (color=0x6c4607) returned 0xfffffffffc100276 [0068.877] FillRect (hDC=0x4a0109e7, lprc=0x26de08, hbr=0xfffffffffc100276) returned 1 [0068.883] DeleteObject (ho=0xfffffffffc100276) returned 1 [0068.883] RestoreDC (hdc=0x4a0109e7, nSavedDC=-1) returned 1 [0068.883] RestoreDC (hdc=0x4a0109e7, nSavedDC=-1) returned 1 [0068.884] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4a0109e7) returned 0x0 [0068.884] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc420dbd) returned 0x0 [0068.884] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0068.884] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0068.884] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0068.884] GetSystemMetrics (nIndex=42) returned 0 [0068.884] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0068.884] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0068.884] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x22) returned 0x0 [0068.885] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0068.885] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0068.885] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0068.885] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0068.885] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0068.885] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0068.885] GetCurrentObject (hdc=0x4a0109e7, type=0x1) returned 0x1b00017 [0068.885] GetCurrentObject (hdc=0x4a0109e7, type=0x2) returned 0x1900010 [0068.885] GetCurrentObject (hdc=0x4a0109e7, type=0x7) returned 0x300509e8 [0068.885] GetCurrentObject (hdc=0x4a0109e7, type=0x6) returned 0x18a002e [0068.885] SaveDC (hdc=0x4a0109e7) returned 1 [0068.885] GetNearestColor (hdc=0x4a0109e7, color=0xf0f0f0) returned 0xf0f0f0 [0068.885] RestoreDC (hdc=0x4a0109e7, nSavedDC=-1) returned 1 [0068.885] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4a0109e7) returned 0x0 [0068.886] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0068.886] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0068.886] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0068.886] GetCurrentObject (hdc=0x4a0109e7, type=0x1) returned 0x1b00017 [0068.886] GetCurrentObject (hdc=0x4a0109e7, type=0x2) returned 0x1900010 [0068.886] GetCurrentObject (hdc=0x4a0109e7, type=0x7) returned 0x300509e8 [0068.886] GetCurrentObject (hdc=0x4a0109e7, type=0x6) returned 0x18a002e [0068.886] SaveDC (hdc=0x4a0109e7) returned 1 [0068.886] GetTextAlign (hdc=0x4a0109e7) returned 0x0 [0068.886] GetTextColor (hdc=0x4a0109e7) returned 0x0 [0068.886] SetTextColor (hdc=0x4a0109e7, color=0xf0f0f0) returned 0x0 [0068.886] GetCurrentObject (hdc=0x4a0109e7, type=0x6) returned 0x18a002e [0068.886] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0068.886] SelectObject (hdc=0x4a0109e7, h=0x260a09ba) returned 0x18a002e [0068.886] GetBkMode (hdc=0x4a0109e7) returned 2 [0068.886] SetBkMode (hdc=0x4a0109e7, mode=1) returned 2 [0068.886] DrawTextExW (in: hdc=0x4a0109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26b77b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0068.887] DrawTextExW (in: hdc=0x4a0109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26b77b0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0068.887] RestoreDC (hdc=0x4a0109e7, nSavedDC=-1) returned 1 [0068.887] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4a0109e7) returned 0x0 [0068.887] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0068.887] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x4a0109e7, x1=0, y1=0, rop=0xcc0020) returned 1 [0068.888] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4a0109e7) returned 0x0 [0068.888] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0068.888] SelectObject (hdc=0x4a0109e7, h=0x185000f) returned 0x300509e8 [0068.888] DeleteDC (hdc=0x4a0109e7) returned 1 [0068.888] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0068.888] DeleteObject (ho=0x300509e8) returned 1 [0068.891] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0068.891] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.891] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0068.891] WaitMessage () returned 1 [0069.060] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.061] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.061] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.061] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.061] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.061] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0069.061] GetCurrentThreadId () returned 0xa28 [0069.061] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0069.061] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.061] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.061] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.061] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.061] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.061] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0069.061] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0069.061] CreateCompatibleDC (hdc=0x150109ce) returned 0x4801026a [0069.061] GetObjectType (h=0x150109ce) returned 0x3 [0069.061] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x310509e8 [0069.061] GetDIBits (in: hdc=0x150109ce, hbm=0x310509e8, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.061] GetDIBits (in: hdc=0x150109ce, hbm=0x310509e8, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.061] DeleteObject (ho=0x310509e8) returned 1 [0069.061] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4b0509e7 [0069.062] SelectObject (hdc=0x4801026a, h=0x4b0509e7) returned 0x185000f [0069.062] GdipCreateFromHDC (hdc=0x4801026a, graphics=0x26e408) returned 0x0 [0069.062] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0069.062] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0069.062] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0069.062] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0069.062] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0069.062] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.062] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0069.062] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.062] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0069.062] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0069.062] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0069.062] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0069.062] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0069.062] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.062] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.062] GetSystemMetrics (nIndex=42) returned 0 [0069.062] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.062] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.062] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0069.062] IsAppThemed () returned 0x1 [0069.063] GetThemeAppProperties () returned 0x3 [0069.063] GetThemeAppProperties () returned 0x3 [0069.063] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0069.063] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0069.063] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0069.063] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0069.063] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0069.063] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.063] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.063] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.063] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0069.063] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.063] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.063] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.063] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0069.063] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0069.063] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0069.063] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0069.063] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0069.063] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0069.063] GetCurrentObject (hdc=0x4801026a, type=0x1) returned 0x1b00017 [0069.063] GetCurrentObject (hdc=0x4801026a, type=0x2) returned 0x1900010 [0069.063] GetCurrentObject (hdc=0x4801026a, type=0x7) returned 0x4b0509e7 [0069.063] GetCurrentObject (hdc=0x4801026a, type=0x6) returned 0x18a002e [0069.063] SaveDC (hdc=0x4801026a) returned 1 [0069.063] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffac0409ff [0069.063] GetClipRgn (hdc=0x4801026a, hrgn=0xffffffffac0409ff) returned 0 [0069.063] SelectClipRgn (hdc=0x4801026a, hrgn=0xffffffff880409f1) returned 2 [0069.064] DeleteObject (ho=0xffffffffac0409ff) returned 1 [0069.064] DeleteObject (ho=0xffffffff880409f1) returned 1 [0069.064] OffsetViewportOrgEx (in: hdc=0x4801026a, x=0, y=0, lppt=0x26abb68 | out: lppt=0x26abb68) returned 1 [0069.064] OffsetViewportOrgEx (in: hdc=0x4801026a, x=-417, y=-278, lppt=0x26abb80 | out: lppt=0x26abb80) returned 1 [0069.064] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0069.064] GetCurrentObject (hdc=0x4801026a, type=0x1) returned 0x1b00017 [0069.064] GetCurrentObject (hdc=0x4801026a, type=0x2) returned 0x1900010 [0069.064] GetCurrentObject (hdc=0x4801026a, type=0x7) returned 0x4b0509e7 [0069.064] GetCurrentObject (hdc=0x4801026a, type=0x6) returned 0x18a002e [0069.064] SaveDC (hdc=0x4801026a) returned 2 [0069.064] GetNearestColor (hdc=0x4801026a, color=0x6c4607) returned 0x6c4607 [0069.064] CreateSolidBrush (color=0x6c4607) returned 0xfffffffffd100276 [0069.064] FillRect (hDC=0x4801026a, lprc=0x26de08, hbr=0xfffffffffd100276) returned 1 [0069.070] DeleteObject (ho=0xfffffffffd100276) returned 1 [0069.070] RestoreDC (hdc=0x4801026a, nSavedDC=-1) returned 1 [0069.070] RestoreDC (hdc=0x4801026a, nSavedDC=-1) returned 1 [0069.070] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4801026a) returned 0x0 [0069.070] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc400dbd) returned 0x0 [0069.071] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0069.071] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.071] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.071] GetSystemMetrics (nIndex=42) returned 0 [0069.071] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.071] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.071] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0069.071] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0069.071] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0069.071] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0069.071] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0069.071] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0069.071] GetCurrentObject (hdc=0x4801026a, type=0x1) returned 0x1b00017 [0069.071] GetCurrentObject (hdc=0x4801026a, type=0x2) returned 0x1900010 [0069.071] GetCurrentObject (hdc=0x4801026a, type=0x7) returned 0x4b0509e7 [0069.071] GetCurrentObject (hdc=0x4801026a, type=0x6) returned 0x18a002e [0069.071] SaveDC (hdc=0x4801026a) returned 1 [0069.071] GetNearestColor (hdc=0x4801026a, color=0xf0f0f0) returned 0xf0f0f0 [0069.071] RestoreDC (hdc=0x4801026a, nSavedDC=-1) returned 1 [0069.071] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4801026a) returned 0x0 [0069.072] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0069.072] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0069.072] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0069.072] GetCurrentObject (hdc=0x4801026a, type=0x1) returned 0x1b00017 [0069.072] GetCurrentObject (hdc=0x4801026a, type=0x2) returned 0x1900010 [0069.072] GetCurrentObject (hdc=0x4801026a, type=0x7) returned 0x4b0509e7 [0069.072] GetCurrentObject (hdc=0x4801026a, type=0x6) returned 0x18a002e [0069.072] SaveDC (hdc=0x4801026a) returned 1 [0069.072] GetTextAlign (hdc=0x4801026a) returned 0x0 [0069.072] GetTextColor (hdc=0x4801026a) returned 0x0 [0069.072] SetTextColor (hdc=0x4801026a, color=0xf0f0f0) returned 0x0 [0069.072] GetCurrentObject (hdc=0x4801026a, type=0x6) returned 0x18a002e [0069.072] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0069.072] SelectObject (hdc=0x4801026a, h=0x260a09ba) returned 0x18a002e [0069.072] GetBkMode (hdc=0x4801026a) returned 2 [0069.072] SetBkMode (hdc=0x4801026a, mode=1) returned 2 [0069.072] DrawTextExW (in: hdc=0x4801026a, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26ac830 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0069.072] DrawTextExW (in: hdc=0x4801026a, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26ac830 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0069.073] RestoreDC (hdc=0x4801026a, nSavedDC=-1) returned 1 [0069.073] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4801026a) returned 0x0 [0069.073] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0069.073] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x4801026a, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.073] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4801026a) returned 0x0 [0069.073] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0069.073] SelectObject (hdc=0x4801026a, h=0x185000f) returned 0x4b0509e7 [0069.073] DeleteDC (hdc=0x4801026a) returned 1 [0069.073] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0069.073] DeleteObject (ho=0x4b0509e7) returned 1 [0069.089] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0069.089] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.089] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.089] WaitMessage () returned 1 [0069.278] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.278] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.278] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.278] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.278] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.278] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0069.278] GetCurrentThreadId () returned 0xa28 [0069.278] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0069.278] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.279] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.279] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.279] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.279] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.279] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0069.279] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0069.279] CreateCompatibleDC (hdc=0x150109ce) returned 0x330109e8 [0069.279] GetObjectType (h=0x150109ce) returned 0x3 [0069.279] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x4c0509e7 [0069.280] GetDIBits (in: hdc=0x150109ce, hbm=0x4c0509e7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.280] GetDIBits (in: hdc=0x150109ce, hbm=0x4c0509e7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.280] DeleteObject (ho=0x4c0509e7) returned 1 [0069.280] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4905026a [0069.280] SelectObject (hdc=0x330109e8, h=0x4905026a) returned 0x185000f [0069.280] GdipCreateFromHDC (hdc=0x330109e8, graphics=0x26e408) returned 0x0 [0069.280] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0069.281] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0069.281] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0069.281] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0069.281] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0069.281] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.281] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0069.281] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.281] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0069.281] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0069.281] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0069.281] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0069.281] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0069.281] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.281] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.281] GetSystemMetrics (nIndex=42) returned 0 [0069.281] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.281] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.281] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0069.281] IsAppThemed () returned 0x1 [0069.281] GetThemeAppProperties () returned 0x3 [0069.281] GetThemeAppProperties () returned 0x3 [0069.281] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0069.281] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0069.281] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0069.281] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0069.281] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0069.282] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.282] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.282] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.282] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0069.282] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.282] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.282] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.282] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0069.282] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0069.282] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0069.282] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0069.282] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0069.282] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0069.282] GetCurrentObject (hdc=0x330109e8, type=0x1) returned 0x1b00017 [0069.282] GetCurrentObject (hdc=0x330109e8, type=0x2) returned 0x1900010 [0069.282] GetCurrentObject (hdc=0x330109e8, type=0x7) returned 0x4905026a [0069.282] GetCurrentObject (hdc=0x330109e8, type=0x6) returned 0x18a002e [0069.282] SaveDC (hdc=0x330109e8) returned 1 [0069.282] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff890409f1 [0069.282] GetClipRgn (hdc=0x330109e8, hrgn=0xffffffff890409f1) returned 0 [0069.282] SelectClipRgn (hdc=0x330109e8, hrgn=0xffffffffaf0409ff) returned 2 [0069.282] DeleteObject (ho=0xffffffff890409f1) returned 1 [0069.282] DeleteObject (ho=0xffffffffaf0409ff) returned 1 [0069.283] OffsetViewportOrgEx (in: hdc=0x330109e8, x=0, y=0, lppt=0x284ea98 | out: lppt=0x284ea98) returned 1 [0069.283] OffsetViewportOrgEx (in: hdc=0x330109e8, x=-417, y=-278, lppt=0x284eab0 | out: lppt=0x284eab0) returned 1 [0069.283] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0069.283] GetCurrentObject (hdc=0x330109e8, type=0x1) returned 0x1b00017 [0069.283] GetCurrentObject (hdc=0x330109e8, type=0x2) returned 0x1900010 [0069.283] GetCurrentObject (hdc=0x330109e8, type=0x7) returned 0x4905026a [0069.283] GetCurrentObject (hdc=0x330109e8, type=0x6) returned 0x18a002e [0069.283] SaveDC (hdc=0x330109e8) returned 2 [0069.283] GetNearestColor (hdc=0x330109e8, color=0x6c4607) returned 0x6c4607 [0069.283] CreateSolidBrush (color=0x6c4607) returned 0xfffffffffe100276 [0069.283] FillRect (hDC=0x330109e8, lprc=0x26de08, hbr=0xfffffffffe100276) returned 1 [0069.290] DeleteObject (ho=0xfffffffffe100276) returned 1 [0069.290] RestoreDC (hdc=0x330109e8, nSavedDC=-1) returned 1 [0069.290] RestoreDC (hdc=0x330109e8, nSavedDC=-1) returned 1 [0069.290] GdipReleaseDC (graphics=0x1b86d040, hdc=0x330109e8) returned 0x0 [0069.290] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc3e0dbd) returned 0x0 [0069.290] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0069.290] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.290] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.290] GetSystemMetrics (nIndex=42) returned 0 [0069.290] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.290] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.290] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x24) returned 0x0 [0069.291] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0069.291] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0069.291] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0069.291] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0069.291] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0069.291] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0069.291] GetCurrentObject (hdc=0x330109e8, type=0x1) returned 0x1b00017 [0069.291] GetCurrentObject (hdc=0x330109e8, type=0x2) returned 0x1900010 [0069.291] GetCurrentObject (hdc=0x330109e8, type=0x7) returned 0x4905026a [0069.291] GetCurrentObject (hdc=0x330109e8, type=0x6) returned 0x18a002e [0069.291] SaveDC (hdc=0x330109e8) returned 1 [0069.291] GetNearestColor (hdc=0x330109e8, color=0xf0f0f0) returned 0xf0f0f0 [0069.291] RestoreDC (hdc=0x330109e8, nSavedDC=-1) returned 1 [0069.292] GdipReleaseDC (graphics=0x1b86d040, hdc=0x330109e8) returned 0x0 [0069.292] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0069.292] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0069.292] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0069.292] GetCurrentObject (hdc=0x330109e8, type=0x1) returned 0x1b00017 [0069.292] GetCurrentObject (hdc=0x330109e8, type=0x2) returned 0x1900010 [0069.292] GetCurrentObject (hdc=0x330109e8, type=0x7) returned 0x4905026a [0069.292] GetCurrentObject (hdc=0x330109e8, type=0x6) returned 0x18a002e [0069.292] SaveDC (hdc=0x330109e8) returned 1 [0069.292] GetTextAlign (hdc=0x330109e8) returned 0x0 [0069.292] GetTextColor (hdc=0x330109e8) returned 0x0 [0069.292] SetTextColor (hdc=0x330109e8, color=0xf0f0f0) returned 0x0 [0069.292] GetCurrentObject (hdc=0x330109e8, type=0x6) returned 0x18a002e [0069.292] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0069.292] SelectObject (hdc=0x330109e8, h=0x260a09ba) returned 0x18a002e [0069.292] GetBkMode (hdc=0x330109e8) returned 2 [0069.292] SetBkMode (hdc=0x330109e8, mode=1) returned 2 [0069.292] DrawTextExW (in: hdc=0x330109e8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x284f958 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0069.293] DrawTextExW (in: hdc=0x330109e8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x284f958 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0069.294] RestoreDC (hdc=0x330109e8, nSavedDC=-1) returned 1 [0069.294] GdipReleaseDC (graphics=0x1b86d040, hdc=0x330109e8) returned 0x0 [0069.294] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0069.294] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x330109e8, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.298] GdipReleaseDC (graphics=0x1b86d040, hdc=0x330109e8) returned 0x0 [0069.298] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0069.298] SelectObject (hdc=0x330109e8, h=0x185000f) returned 0x4905026a [0069.298] DeleteDC (hdc=0x330109e8) returned 1 [0069.298] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0069.298] DeleteObject (ho=0x4905026a) returned 1 [0069.301] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0069.301] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.301] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.301] WaitMessage () returned 1 [0069.576] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.576] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.576] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.576] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.576] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.576] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0069.576] GetCurrentThreadId () returned 0xa28 [0069.576] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0069.576] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.576] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.576] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.576] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.576] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.576] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0069.576] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0069.576] CreateCompatibleDC (hdc=0x150109ce) returned 0x4e0109e7 [0069.576] GetObjectType (h=0x150109ce) returned 0x3 [0069.577] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x4a05026a [0069.577] GetDIBits (in: hdc=0x150109ce, hbm=0x4a05026a, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.577] GetDIBits (in: hdc=0x150109ce, hbm=0x4a05026a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.577] DeleteObject (ho=0x4a05026a) returned 1 [0069.577] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x340509e8 [0069.577] SelectObject (hdc=0x4e0109e7, h=0x340509e8) returned 0x185000f [0069.577] GdipCreateFromHDC (hdc=0x4e0109e7, graphics=0x26e408) returned 0x0 [0069.577] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0069.577] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0069.577] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0069.577] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0069.577] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0069.577] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.577] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0069.577] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.577] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0069.577] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0069.577] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0069.577] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0069.578] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0069.578] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.578] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.578] GetSystemMetrics (nIndex=42) returned 0 [0069.578] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.578] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.578] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0069.578] IsAppThemed () returned 0x1 [0069.578] GetThemeAppProperties () returned 0x3 [0069.578] GetThemeAppProperties () returned 0x3 [0069.578] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0069.578] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0069.578] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0069.578] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0069.578] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0069.578] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.578] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.578] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.578] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0069.578] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.578] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.578] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.578] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0069.578] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0069.578] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0069.578] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0069.578] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0069.579] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0069.579] GetCurrentObject (hdc=0x4e0109e7, type=0x1) returned 0x1b00017 [0069.579] GetCurrentObject (hdc=0x4e0109e7, type=0x2) returned 0x1900010 [0069.579] GetCurrentObject (hdc=0x4e0109e7, type=0x7) returned 0x340509e8 [0069.579] GetCurrentObject (hdc=0x4e0109e7, type=0x6) returned 0x18a002e [0069.579] SaveDC (hdc=0x4e0109e7) returned 1 [0069.579] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb00409ff [0069.579] GetClipRgn (hdc=0x4e0109e7, hrgn=0xffffffffb00409ff) returned 0 [0069.579] SelectClipRgn (hdc=0x4e0109e7, hrgn=0xffffffff8c0409f1) returned 2 [0069.579] DeleteObject (ho=0xffffffffb00409ff) returned 1 [0069.579] DeleteObject (ho=0xffffffff8c0409f1) returned 1 [0069.579] OffsetViewportOrgEx (in: hdc=0x4e0109e7, x=0, y=0, lppt=0x2707988 | out: lppt=0x2707988) returned 1 [0069.579] OffsetViewportOrgEx (in: hdc=0x4e0109e7, x=-417, y=-278, lppt=0x27079a0 | out: lppt=0x27079a0) returned 1 [0069.579] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0069.579] GetCurrentObject (hdc=0x4e0109e7, type=0x1) returned 0x1b00017 [0069.579] GetCurrentObject (hdc=0x4e0109e7, type=0x2) returned 0x1900010 [0069.579] GetCurrentObject (hdc=0x4e0109e7, type=0x7) returned 0x340509e8 [0069.579] GetCurrentObject (hdc=0x4e0109e7, type=0x6) returned 0x18a002e [0069.579] SaveDC (hdc=0x4e0109e7) returned 2 [0069.579] GetNearestColor (hdc=0x4e0109e7, color=0x6c4607) returned 0x6c4607 [0069.579] CreateSolidBrush (color=0x6c4607) returned 0xffffffffff100276 [0069.579] FillRect (hDC=0x4e0109e7, lprc=0x26de08, hbr=0xffffffffff100276) returned 1 [0069.586] DeleteObject (ho=0xffffffffff100276) returned 1 [0069.586] RestoreDC (hdc=0x4e0109e7, nSavedDC=-1) returned 1 [0069.586] RestoreDC (hdc=0x4e0109e7, nSavedDC=-1) returned 1 [0069.586] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4e0109e7) returned 0x0 [0069.586] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc3c0dbd) returned 0x0 [0069.586] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0069.586] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.586] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.586] GetSystemMetrics (nIndex=42) returned 0 [0069.586] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.586] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.586] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0069.586] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0069.586] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0069.586] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0069.586] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0069.586] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0069.586] GetCurrentObject (hdc=0x4e0109e7, type=0x1) returned 0x1b00017 [0069.586] GetCurrentObject (hdc=0x4e0109e7, type=0x2) returned 0x1900010 [0069.587] GetCurrentObject (hdc=0x4e0109e7, type=0x7) returned 0x340509e8 [0069.587] GetCurrentObject (hdc=0x4e0109e7, type=0x6) returned 0x18a002e [0069.587] SaveDC (hdc=0x4e0109e7) returned 1 [0069.587] GetNearestColor (hdc=0x4e0109e7, color=0xf0f0f0) returned 0xf0f0f0 [0069.587] RestoreDC (hdc=0x4e0109e7, nSavedDC=-1) returned 1 [0069.587] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4e0109e7) returned 0x0 [0069.587] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0069.587] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0069.587] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0069.587] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0069.587] GetCurrentObject (hdc=0x4e0109e7, type=0x1) returned 0x1b00017 [0069.587] GetCurrentObject (hdc=0x4e0109e7, type=0x2) returned 0x1900010 [0069.587] GetCurrentObject (hdc=0x4e0109e7, type=0x7) returned 0x340509e8 [0069.587] GetCurrentObject (hdc=0x4e0109e7, type=0x6) returned 0x18a002e [0069.587] SaveDC (hdc=0x4e0109e7) returned 1 [0069.588] GetTextAlign (hdc=0x4e0109e7) returned 0x0 [0069.588] GetTextColor (hdc=0x4e0109e7) returned 0x0 [0069.588] SetTextColor (hdc=0x4e0109e7, color=0xf0f0f0) returned 0x0 [0069.588] GetCurrentObject (hdc=0x4e0109e7, type=0x6) returned 0x18a002e [0069.588] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0069.588] SelectObject (hdc=0x4e0109e7, h=0x260a09ba) returned 0x18a002e [0069.588] GetBkMode (hdc=0x4e0109e7) returned 2 [0069.588] SetBkMode (hdc=0x4e0109e7, mode=1) returned 2 [0069.588] DrawTextExW (in: hdc=0x4e0109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2708650 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0069.588] DrawTextExW (in: hdc=0x4e0109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2708650 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0069.588] RestoreDC (hdc=0x4e0109e7, nSavedDC=-1) returned 1 [0069.589] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4e0109e7) returned 0x0 [0069.589] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0069.589] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x4e0109e7, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.589] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4e0109e7) returned 0x0 [0069.589] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0069.589] SelectObject (hdc=0x4e0109e7, h=0x185000f) returned 0x340509e8 [0069.589] DeleteDC (hdc=0x4e0109e7) returned 1 [0069.589] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0069.589] DeleteObject (ho=0x340509e8) returned 1 [0069.592] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0069.593] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.593] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.593] WaitMessage () returned 1 [0069.730] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.730] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.730] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.730] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.730] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.730] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0069.730] GetCurrentThreadId () returned 0xa28 [0069.730] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0069.730] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.730] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.730] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.730] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.730] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.731] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0069.731] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0069.731] CreateCompatibleDC (hdc=0x150109ce) returned 0x4c01026a [0069.731] GetObjectType (h=0x150109ce) returned 0x3 [0069.731] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x350509e8 [0069.731] GetDIBits (in: hdc=0x150109ce, hbm=0x350509e8, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.731] GetDIBits (in: hdc=0x150109ce, hbm=0x350509e8, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.731] DeleteObject (ho=0x350509e8) returned 1 [0069.731] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4f0509e7 [0069.731] SelectObject (hdc=0x4c01026a, h=0x4f0509e7) returned 0x185000f [0069.731] GdipCreateFromHDC (hdc=0x4c01026a, graphics=0x26e408) returned 0x0 [0069.731] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0069.731] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0069.731] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0069.732] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0069.732] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0069.732] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.732] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0069.732] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.732] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0069.732] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0069.732] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0069.732] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0069.732] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0069.732] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.732] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.732] GetSystemMetrics (nIndex=42) returned 0 [0069.732] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.732] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.732] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0069.732] IsAppThemed () returned 0x1 [0069.732] GetThemeAppProperties () returned 0x3 [0069.732] GetThemeAppProperties () returned 0x3 [0069.732] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0069.732] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0069.732] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0069.732] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0069.732] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0069.732] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.732] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.732] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.732] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0069.733] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.733] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.733] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.733] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0069.733] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0069.733] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0069.733] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0069.733] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0069.733] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0069.733] GetCurrentObject (hdc=0x4c01026a, type=0x1) returned 0x1b00017 [0069.733] GetCurrentObject (hdc=0x4c01026a, type=0x2) returned 0x1900010 [0069.733] GetCurrentObject (hdc=0x4c01026a, type=0x7) returned 0x4f0509e7 [0069.733] GetCurrentObject (hdc=0x4c01026a, type=0x6) returned 0x18a002e [0069.733] SaveDC (hdc=0x4c01026a) returned 1 [0069.733] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff8d0409f1 [0069.733] GetClipRgn (hdc=0x4c01026a, hrgn=0xffffffff8d0409f1) returned 0 [0069.733] SelectClipRgn (hdc=0x4c01026a, hrgn=0xffffffffb30409ff) returned 2 [0069.733] DeleteObject (ho=0xffffffff8d0409f1) returned 1 [0069.733] DeleteObject (ho=0xffffffffb30409ff) returned 1 [0069.733] OffsetViewportOrgEx (in: hdc=0x4c01026a, x=0, y=0, lppt=0x275cbc0 | out: lppt=0x275cbc0) returned 1 [0069.733] OffsetViewportOrgEx (in: hdc=0x4c01026a, x=-417, y=-278, lppt=0x275cbd8 | out: lppt=0x275cbd8) returned 1 [0069.733] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0069.733] GetCurrentObject (hdc=0x4c01026a, type=0x1) returned 0x1b00017 [0069.733] GetCurrentObject (hdc=0x4c01026a, type=0x2) returned 0x1900010 [0069.733] GetCurrentObject (hdc=0x4c01026a, type=0x7) returned 0x4f0509e7 [0069.733] GetCurrentObject (hdc=0x4c01026a, type=0x6) returned 0x18a002e [0069.734] SaveDC (hdc=0x4c01026a) returned 2 [0069.734] GetNearestColor (hdc=0x4c01026a, color=0x6c4607) returned 0x6c4607 [0069.734] CreateSolidBrush (color=0x6c4607) returned 0x100276 [0069.734] FillRect (hDC=0x4c01026a, lprc=0x26de08, hbr=0x100276) returned 1 [0069.740] DeleteObject (ho=0x100276) returned 1 [0069.740] RestoreDC (hdc=0x4c01026a, nSavedDC=-1) returned 1 [0069.740] RestoreDC (hdc=0x4c01026a, nSavedDC=-1) returned 1 [0069.740] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4c01026a) returned 0x0 [0069.740] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc3a0dbd) returned 0x0 [0069.740] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0069.740] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.740] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.740] GetSystemMetrics (nIndex=42) returned 0 [0069.740] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.740] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.740] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x26) returned 0x0 [0069.741] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0069.741] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0069.741] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0069.741] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0069.741] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0069.741] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0069.741] GetCurrentObject (hdc=0x4c01026a, type=0x1) returned 0x1b00017 [0069.741] GetCurrentObject (hdc=0x4c01026a, type=0x2) returned 0x1900010 [0069.741] GetCurrentObject (hdc=0x4c01026a, type=0x7) returned 0x4f0509e7 [0069.741] GetCurrentObject (hdc=0x4c01026a, type=0x6) returned 0x18a002e [0069.741] SaveDC (hdc=0x4c01026a) returned 1 [0069.742] GetNearestColor (hdc=0x4c01026a, color=0xf0f0f0) returned 0xf0f0f0 [0069.742] RestoreDC (hdc=0x4c01026a, nSavedDC=-1) returned 1 [0069.742] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4c01026a) returned 0x0 [0069.742] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0069.742] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0069.742] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0069.742] GetCurrentObject (hdc=0x4c01026a, type=0x1) returned 0x1b00017 [0069.742] GetCurrentObject (hdc=0x4c01026a, type=0x2) returned 0x1900010 [0069.742] GetCurrentObject (hdc=0x4c01026a, type=0x7) returned 0x4f0509e7 [0069.742] GetCurrentObject (hdc=0x4c01026a, type=0x6) returned 0x18a002e [0069.742] SaveDC (hdc=0x4c01026a) returned 1 [0069.742] GetTextAlign (hdc=0x4c01026a) returned 0x0 [0069.742] GetTextColor (hdc=0x4c01026a) returned 0x0 [0069.742] SetTextColor (hdc=0x4c01026a, color=0xf0f0f0) returned 0x0 [0069.742] GetCurrentObject (hdc=0x4c01026a, type=0x6) returned 0x18a002e [0069.742] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0069.742] SelectObject (hdc=0x4c01026a, h=0x260a09ba) returned 0x18a002e [0069.743] GetBkMode (hdc=0x4c01026a) returned 2 [0069.743] SetBkMode (hdc=0x4c01026a, mode=1) returned 2 [0069.743] DrawTextExW (in: hdc=0x4c01026a, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x275da88 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0069.743] DrawTextExW (in: hdc=0x4c01026a, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x275da88 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0069.743] RestoreDC (hdc=0x4c01026a, nSavedDC=-1) returned 1 [0069.743] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4c01026a) returned 0x0 [0069.743] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0069.743] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x4c01026a, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.744] GdipReleaseDC (graphics=0x1b86d040, hdc=0x4c01026a) returned 0x0 [0069.744] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0069.744] SelectObject (hdc=0x4c01026a, h=0x185000f) returned 0x4f0509e7 [0069.744] DeleteDC (hdc=0x4c01026a) returned 1 [0069.744] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0069.744] DeleteObject (ho=0x4f0509e7) returned 1 [0069.747] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0069.747] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.747] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.747] WaitMessage () returned 1 [0069.871] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.871] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.871] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.871] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.871] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.871] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0069.871] GetCurrentThreadId () returned 0xa28 [0069.871] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0069.871] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.871] IsWindowUnicode (hWnd=0x3015e) returned 1 [0069.871] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0069.871] TranslateMessage (lpMsg=0x26ee10) returned 0 [0069.871] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0069.871] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0069.872] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0069.872] CreateCompatibleDC (hdc=0x150109ce) returned 0x370109e8 [0069.872] GetObjectType (h=0x150109ce) returned 0x3 [0069.872] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x500509e7 [0069.872] GetDIBits (in: hdc=0x150109ce, hbm=0x500509e7, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.872] GetDIBits (in: hdc=0x150109ce, hbm=0x500509e7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0069.872] DeleteObject (ho=0x500509e7) returned 1 [0069.872] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x4d05026a [0069.872] SelectObject (hdc=0x370109e8, h=0x4d05026a) returned 0x185000f [0069.872] GdipCreateFromHDC (hdc=0x370109e8, graphics=0x26e408) returned 0x0 [0069.872] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0069.872] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0069.872] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0069.872] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0069.872] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0069.873] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.873] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0069.873] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.873] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0069.873] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0069.873] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0069.873] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0069.873] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0069.873] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.873] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.873] GetSystemMetrics (nIndex=42) returned 0 [0069.873] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.873] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.873] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0069.873] IsAppThemed () returned 0x1 [0069.873] GetThemeAppProperties () returned 0x3 [0069.873] GetThemeAppProperties () returned 0x3 [0069.873] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0069.873] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0069.873] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0069.873] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0069.873] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0069.873] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.873] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.873] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.873] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0069.873] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0069.873] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0069.874] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0069.874] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0069.874] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0069.874] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0069.874] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0069.874] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0069.874] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0069.874] GetCurrentObject (hdc=0x370109e8, type=0x1) returned 0x1b00017 [0069.874] GetCurrentObject (hdc=0x370109e8, type=0x2) returned 0x1900010 [0069.874] GetCurrentObject (hdc=0x370109e8, type=0x7) returned 0x4d05026a [0069.874] GetCurrentObject (hdc=0x370109e8, type=0x6) returned 0x18a002e [0069.874] SaveDC (hdc=0x370109e8) returned 1 [0069.874] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb40409ff [0069.874] GetClipRgn (hdc=0x370109e8, hrgn=0xffffffffb40409ff) returned 0 [0069.874] SelectClipRgn (hdc=0x370109e8, hrgn=0xffffffff900409f1) returned 2 [0069.874] DeleteObject (ho=0xffffffffb40409ff) returned 1 [0069.874] DeleteObject (ho=0xffffffff900409f1) returned 1 [0069.874] OffsetViewportOrgEx (in: hdc=0x370109e8, x=0, y=0, lppt=0x26c11c0 | out: lppt=0x26c11c0) returned 1 [0069.874] OffsetViewportOrgEx (in: hdc=0x370109e8, x=-417, y=-278, lppt=0x26c11d8 | out: lppt=0x26c11d8) returned 1 [0069.874] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0069.874] GetCurrentObject (hdc=0x370109e8, type=0x1) returned 0x1b00017 [0069.874] GetCurrentObject (hdc=0x370109e8, type=0x2) returned 0x1900010 [0069.874] GetCurrentObject (hdc=0x370109e8, type=0x7) returned 0x4d05026a [0069.874] GetCurrentObject (hdc=0x370109e8, type=0x6) returned 0x18a002e [0069.874] SaveDC (hdc=0x370109e8) returned 2 [0069.875] GetNearestColor (hdc=0x370109e8, color=0x6c4607) returned 0x6c4607 [0069.875] CreateSolidBrush (color=0x6c4607) returned 0x1100276 [0069.875] FillRect (hDC=0x370109e8, lprc=0x26de08, hbr=0x1100276) returned 1 [0069.881] DeleteObject (ho=0x1100276) returned 1 [0069.881] RestoreDC (hdc=0x370109e8, nSavedDC=-1) returned 1 [0069.881] RestoreDC (hdc=0x370109e8, nSavedDC=-1) returned 1 [0069.881] GdipReleaseDC (graphics=0x1b86d040, hdc=0x370109e8) returned 0x0 [0069.881] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc380dbd) returned 0x0 [0069.881] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0069.881] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0069.881] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0069.881] GetSystemMetrics (nIndex=42) returned 0 [0069.881] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0069.881] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0069.881] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0069.881] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0069.881] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0069.881] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0069.882] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0069.882] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0069.882] GetCurrentObject (hdc=0x370109e8, type=0x1) returned 0x1b00017 [0069.882] GetCurrentObject (hdc=0x370109e8, type=0x2) returned 0x1900010 [0069.882] GetCurrentObject (hdc=0x370109e8, type=0x7) returned 0x4d05026a [0069.882] GetCurrentObject (hdc=0x370109e8, type=0x6) returned 0x18a002e [0069.882] SaveDC (hdc=0x370109e8) returned 1 [0069.882] GetNearestColor (hdc=0x370109e8, color=0xf0f0f0) returned 0xf0f0f0 [0069.882] RestoreDC (hdc=0x370109e8, nSavedDC=-1) returned 1 [0069.882] GdipReleaseDC (graphics=0x1b86d040, hdc=0x370109e8) returned 0x0 [0069.882] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0069.882] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0069.882] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0069.882] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0069.882] GetCurrentObject (hdc=0x370109e8, type=0x1) returned 0x1b00017 [0069.882] GetCurrentObject (hdc=0x370109e8, type=0x2) returned 0x1900010 [0069.882] GetCurrentObject (hdc=0x370109e8, type=0x7) returned 0x4d05026a [0069.882] GetCurrentObject (hdc=0x370109e8, type=0x6) returned 0x18a002e [0069.882] SaveDC (hdc=0x370109e8) returned 1 [0069.883] GetTextAlign (hdc=0x370109e8) returned 0x0 [0069.883] GetTextColor (hdc=0x370109e8) returned 0x0 [0069.883] SetTextColor (hdc=0x370109e8, color=0xf0f0f0) returned 0x0 [0069.883] GetCurrentObject (hdc=0x370109e8, type=0x6) returned 0x18a002e [0069.883] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0069.883] SelectObject (hdc=0x370109e8, h=0x260a09ba) returned 0x18a002e [0069.883] GetBkMode (hdc=0x370109e8) returned 2 [0069.883] SetBkMode (hdc=0x370109e8, mode=1) returned 2 [0069.883] DrawTextExW (in: hdc=0x370109e8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c1e88 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0069.883] DrawTextExW (in: hdc=0x370109e8, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c1e88 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0069.884] RestoreDC (hdc=0x370109e8, nSavedDC=-1) returned 1 [0069.884] GdipReleaseDC (graphics=0x1b86d040, hdc=0x370109e8) returned 0x0 [0069.884] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0069.884] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x370109e8, x1=0, y1=0, rop=0xcc0020) returned 1 [0069.884] GdipReleaseDC (graphics=0x1b86d040, hdc=0x370109e8) returned 0x0 [0069.884] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0069.884] SelectObject (hdc=0x370109e8, h=0x185000f) returned 0x4d05026a [0069.884] DeleteDC (hdc=0x370109e8) returned 1 [0069.884] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0069.884] DeleteObject (ho=0x4d05026a) returned 1 [0069.888] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0069.888] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.888] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0069.888] WaitMessage () returned 1 [0070.060] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.060] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.060] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.060] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.060] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.061] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0070.061] GetCurrentThreadId () returned 0xa28 [0070.061] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0070.061] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.061] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.061] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.061] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.061] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.061] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0070.061] SelectPalette (hdc=0x150109ce, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0070.061] CreateCompatibleDC (hdc=0x150109ce) returned 0x520109e7 [0070.061] GetObjectType (h=0x150109ce) returned 0x3 [0070.061] CreateCompatibleBitmap (hdc=0x150109ce, cx=1, cy=1) returned 0x4e05026a [0070.061] GetDIBits (in: hdc=0x150109ce, hbm=0x4e05026a, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.061] GetDIBits (in: hdc=0x150109ce, hbm=0x4e05026a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.061] DeleteObject (ho=0x4e05026a) returned 1 [0070.061] CreateDIBSection (in: hdc=0x150109ce, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x380509e8 [0070.061] SelectObject (hdc=0x520109e7, h=0x380509e8) returned 0x185000f [0070.062] GdipCreateFromHDC (hdc=0x520109e7, graphics=0x26e408) returned 0x0 [0070.062] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0070.062] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0070.062] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0070.062] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0070.062] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0070.062] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.062] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0070.062] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.062] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0070.062] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0070.062] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0070.062] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0070.062] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0070.062] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.062] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.062] GetSystemMetrics (nIndex=42) returned 0 [0070.062] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.062] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.062] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0070.062] IsAppThemed () returned 0x1 [0070.063] GetThemeAppProperties () returned 0x3 [0070.063] GetThemeAppProperties () returned 0x3 [0070.063] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0070.063] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0070.063] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0070.063] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0070.063] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0070.063] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.063] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.063] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.063] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0070.063] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.063] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.063] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.063] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0070.063] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0070.063] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0070.063] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0070.063] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0070.063] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0070.063] GetCurrentObject (hdc=0x520109e7, type=0x1) returned 0x1b00017 [0070.063] GetCurrentObject (hdc=0x520109e7, type=0x2) returned 0x1900010 [0070.063] GetCurrentObject (hdc=0x520109e7, type=0x7) returned 0x380509e8 [0070.063] GetCurrentObject (hdc=0x520109e7, type=0x6) returned 0x18a002e [0070.063] SaveDC (hdc=0x520109e7) returned 1 [0070.063] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff910409f1 [0070.063] GetClipRgn (hdc=0x520109e7, hrgn=0xffffffff910409f1) returned 0 [0070.064] SelectClipRgn (hdc=0x520109e7, hrgn=0xffffffffb70409ff) returned 2 [0070.064] DeleteObject (ho=0xffffffff910409f1) returned 1 [0070.064] DeleteObject (ho=0xffffffffb70409ff) returned 1 [0070.064] OffsetViewportOrgEx (in: hdc=0x520109e7, x=0, y=0, lppt=0x26c0d68 | out: lppt=0x26c0d68) returned 1 [0070.064] OffsetViewportOrgEx (in: hdc=0x520109e7, x=-417, y=-278, lppt=0x26c0d80 | out: lppt=0x26c0d80) returned 1 [0070.064] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0070.064] GetCurrentObject (hdc=0x520109e7, type=0x1) returned 0x1b00017 [0070.064] GetCurrentObject (hdc=0x520109e7, type=0x2) returned 0x1900010 [0070.064] GetCurrentObject (hdc=0x520109e7, type=0x7) returned 0x380509e8 [0070.064] GetCurrentObject (hdc=0x520109e7, type=0x6) returned 0x18a002e [0070.064] SaveDC (hdc=0x520109e7) returned 2 [0070.064] GetNearestColor (hdc=0x520109e7, color=0x6c4607) returned 0x6c4607 [0070.064] CreateSolidBrush (color=0x6c4607) returned 0x2100276 [0070.064] FillRect (hDC=0x520109e7, lprc=0x26de08, hbr=0x2100276) returned 1 [0070.070] DeleteObject (ho=0x2100276) returned 1 [0070.070] RestoreDC (hdc=0x520109e7, nSavedDC=-1) returned 1 [0070.070] RestoreDC (hdc=0x520109e7, nSavedDC=-1) returned 1 [0070.070] GdipReleaseDC (graphics=0x1b86d040, hdc=0x520109e7) returned 0x0 [0070.071] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc360dbd) returned 0x0 [0070.071] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0070.071] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.071] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.071] GetSystemMetrics (nIndex=42) returned 0 [0070.071] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.071] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.071] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x28) returned 0x0 [0070.072] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0070.072] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0070.072] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0070.072] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0070.072] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0070.072] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0070.072] GetCurrentObject (hdc=0x520109e7, type=0x1) returned 0x1b00017 [0070.072] GetCurrentObject (hdc=0x520109e7, type=0x2) returned 0x1900010 [0070.072] GetCurrentObject (hdc=0x520109e7, type=0x7) returned 0x380509e8 [0070.072] GetCurrentObject (hdc=0x520109e7, type=0x6) returned 0x18a002e [0070.072] SaveDC (hdc=0x520109e7) returned 1 [0070.072] GetNearestColor (hdc=0x520109e7, color=0xf0f0f0) returned 0xf0f0f0 [0070.072] RestoreDC (hdc=0x520109e7, nSavedDC=-1) returned 1 [0070.072] GdipReleaseDC (graphics=0x1b86d040, hdc=0x520109e7) returned 0x0 [0070.072] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0070.072] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0070.072] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0070.072] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0070.073] GetCurrentObject (hdc=0x520109e7, type=0x1) returned 0x1b00017 [0070.073] GetCurrentObject (hdc=0x520109e7, type=0x2) returned 0x1900010 [0070.073] GetCurrentObject (hdc=0x520109e7, type=0x7) returned 0x380509e8 [0070.073] GetCurrentObject (hdc=0x520109e7, type=0x6) returned 0x18a002e [0070.073] SaveDC (hdc=0x520109e7) returned 1 [0070.073] GetTextAlign (hdc=0x520109e7) returned 0x0 [0070.073] GetTextColor (hdc=0x520109e7) returned 0x0 [0070.073] SetTextColor (hdc=0x520109e7, color=0xf0f0f0) returned 0x0 [0070.086] GetCurrentObject (hdc=0x520109e7, type=0x6) returned 0x18a002e [0070.086] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0070.086] SelectObject (hdc=0x520109e7, h=0x260a09ba) returned 0x18a002e [0070.086] GetBkMode (hdc=0x520109e7) returned 2 [0070.086] SetBkMode (hdc=0x520109e7, mode=1) returned 2 [0070.086] DrawTextExW (in: hdc=0x520109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26c2458 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0070.086] DrawTextExW (in: hdc=0x520109e7, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26c2458 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0070.087] RestoreDC (hdc=0x520109e7, nSavedDC=-1) returned 1 [0070.087] GdipReleaseDC (graphics=0x1b86d040, hdc=0x520109e7) returned 0x0 [0070.087] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0070.087] BitBlt (hdc=0x150109ce, x=0, y=0, cx=538, cy=325, hdcSrc=0x520109e7, x1=0, y1=0, rop=0xcc0020) returned 1 [0070.087] GdipReleaseDC (graphics=0x1b86d040, hdc=0x520109e7) returned 0x0 [0070.087] SelectPalette (hdc=0x150109ce, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0070.087] SelectObject (hdc=0x520109e7, h=0x185000f) returned 0x380509e8 [0070.087] DeleteDC (hdc=0x520109e7) returned 1 [0070.087] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0070.087] DeleteObject (ho=0x380509e8) returned 1 [0070.091] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0070.091] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.091] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.091] WaitMessage () returned 1 [0070.125] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.125] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0070.126] IsWindowUnicode (hWnd=0x50114) returned 1 [0070.126] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.126] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0070.126] SetCursor (hCursor=0x10007) returned 0x10007 [0070.126] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.126] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.126] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0x610185) returned 0x0 [0070.126] GetKeyState (nVirtKey=1) returned 0 [0070.126] GetKeyState (nVirtKey=2) returned 0 [0070.126] GetKeyState (nVirtKey=4) returned 0 [0070.126] GetKeyState (nVirtKey=5) returned 0 [0070.126] GetKeyState (nVirtKey=6) returned 0 [0070.126] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.126] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.126] WaitMessage () returned 1 [0070.127] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.127] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0070.128] IsWindowUnicode (hWnd=0x50114) returned 1 [0070.128] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.128] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0070.128] SetCursor (hCursor=0x10007) returned 0x10007 [0070.128] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.128] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.128] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0x610185) returned 0x0 [0070.128] GetKeyState (nVirtKey=1) returned 0 [0070.128] GetKeyState (nVirtKey=2) returned 0 [0070.128] GetKeyState (nVirtKey=4) returned 0 [0070.128] GetKeyState (nVirtKey=5) returned 0 [0070.128] GetKeyState (nVirtKey=6) returned 0 [0070.128] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.128] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.128] WaitMessage () returned 1 [0070.230] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.230] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.230] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.230] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.230] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.230] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0070.230] GetCurrentThreadId () returned 0xa28 [0070.230] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0070.230] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.230] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.230] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.230] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.230] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.230] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0070.230] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0070.230] CreateCompatibleDC (hdc=0x60109d6) returned 0x770109c4 [0070.230] GetObjectType (h=0x60109d6) returned 0x3 [0070.230] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffd00509cf [0070.230] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd00509cf, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.231] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffd00509cf, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.231] DeleteObject (ho=0xffffffffd00509cf) returned 1 [0070.231] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x17050730 [0070.231] SelectObject (hdc=0x770109c4, h=0x17050730) returned 0x185000f [0070.231] GdipCreateFromHDC (hdc=0x770109c4, graphics=0x26e408) returned 0x0 [0070.231] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0070.231] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0070.231] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0070.231] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0070.231] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0070.231] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.231] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0070.231] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.231] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0070.231] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0070.231] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0070.231] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0070.231] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0070.232] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.232] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.232] GetSystemMetrics (nIndex=42) returned 0 [0070.232] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.232] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.232] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0070.232] IsAppThemed () returned 0x1 [0070.232] GetThemeAppProperties () returned 0x3 [0070.232] GetThemeAppProperties () returned 0x3 [0070.232] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0070.232] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0070.232] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0070.232] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0070.232] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0070.232] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.232] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.232] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.232] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0070.232] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.232] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.232] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.232] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0070.232] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0070.232] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0070.232] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0070.232] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0070.232] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0070.232] GetCurrentObject (hdc=0x770109c4, type=0x1) returned 0x1b00017 [0070.232] GetCurrentObject (hdc=0x770109c4, type=0x2) returned 0x1900010 [0070.232] GetCurrentObject (hdc=0x770109c4, type=0x7) returned 0x17050730 [0070.233] GetCurrentObject (hdc=0x770109c4, type=0x6) returned 0x18a002e [0070.233] SaveDC (hdc=0x770109c4) returned 1 [0070.233] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffb80409ff [0070.233] GetClipRgn (hdc=0x770109c4, hrgn=0xffffffffb80409ff) returned 0 [0070.233] SelectClipRgn (hdc=0x770109c4, hrgn=0xffffffff940409f1) returned 2 [0070.233] DeleteObject (ho=0xffffffffb80409ff) returned 1 [0070.233] DeleteObject (ho=0xffffffff940409f1) returned 1 [0070.233] OffsetViewportOrgEx (in: hdc=0x770109c4, x=0, y=0, lppt=0x272e090 | out: lppt=0x272e090) returned 1 [0070.233] OffsetViewportOrgEx (in: hdc=0x770109c4, x=-417, y=-278, lppt=0x272e0a8 | out: lppt=0x272e0a8) returned 1 [0070.233] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0070.233] GetCurrentObject (hdc=0x770109c4, type=0x1) returned 0x1b00017 [0070.233] GetCurrentObject (hdc=0x770109c4, type=0x2) returned 0x1900010 [0070.233] GetCurrentObject (hdc=0x770109c4, type=0x7) returned 0x17050730 [0070.233] GetCurrentObject (hdc=0x770109c4, type=0x6) returned 0x18a002e [0070.233] SaveDC (hdc=0x770109c4) returned 2 [0070.233] GetNearestColor (hdc=0x770109c4, color=0x6c4607) returned 0x6c4607 [0070.233] CreateSolidBrush (color=0x6c4607) returned 0x3100276 [0070.233] FillRect (hDC=0x770109c4, lprc=0x26de08, hbr=0x3100276) returned 1 [0070.239] DeleteObject (ho=0x3100276) returned 1 [0070.239] RestoreDC (hdc=0x770109c4, nSavedDC=-1) returned 1 [0070.239] RestoreDC (hdc=0x770109c4, nSavedDC=-1) returned 1 [0070.239] GdipReleaseDC (graphics=0x1b86d040, hdc=0x770109c4) returned 0x0 [0070.239] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc340dbd) returned 0x0 [0070.240] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0070.240] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.240] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.240] GetSystemMetrics (nIndex=42) returned 0 [0070.240] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.240] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.240] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0070.240] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0070.240] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0070.240] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0070.240] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0070.240] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0070.240] GetCurrentObject (hdc=0x770109c4, type=0x1) returned 0x1b00017 [0070.240] GetCurrentObject (hdc=0x770109c4, type=0x2) returned 0x1900010 [0070.240] GetCurrentObject (hdc=0x770109c4, type=0x7) returned 0x17050730 [0070.240] GetCurrentObject (hdc=0x770109c4, type=0x6) returned 0x18a002e [0070.240] SaveDC (hdc=0x770109c4) returned 1 [0070.240] GetNearestColor (hdc=0x770109c4, color=0xf0f0f0) returned 0xf0f0f0 [0070.240] RestoreDC (hdc=0x770109c4, nSavedDC=-1) returned 1 [0070.240] GdipReleaseDC (graphics=0x1b86d040, hdc=0x770109c4) returned 0x0 [0070.241] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0070.241] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0070.241] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0070.241] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0070.241] GetCurrentObject (hdc=0x770109c4, type=0x1) returned 0x1b00017 [0070.241] GetCurrentObject (hdc=0x770109c4, type=0x2) returned 0x1900010 [0070.241] GetCurrentObject (hdc=0x770109c4, type=0x7) returned 0x17050730 [0070.241] GetCurrentObject (hdc=0x770109c4, type=0x6) returned 0x18a002e [0070.241] SaveDC (hdc=0x770109c4) returned 1 [0070.241] GetTextAlign (hdc=0x770109c4) returned 0x0 [0070.241] GetTextColor (hdc=0x770109c4) returned 0x0 [0070.241] SetTextColor (hdc=0x770109c4, color=0xf0f0f0) returned 0x0 [0070.241] GetCurrentObject (hdc=0x770109c4, type=0x6) returned 0x18a002e [0070.241] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0070.241] SelectObject (hdc=0x770109c4, h=0x260a09ba) returned 0x18a002e [0070.241] GetBkMode (hdc=0x770109c4) returned 2 [0070.241] SetBkMode (hdc=0x770109c4, mode=1) returned 2 [0070.241] DrawTextExW (in: hdc=0x770109c4, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x272ed58 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0070.241] DrawTextExW (in: hdc=0x770109c4, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x272ed58 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0070.242] RestoreDC (hdc=0x770109c4, nSavedDC=-1) returned 1 [0070.242] GdipReleaseDC (graphics=0x1b86d040, hdc=0x770109c4) returned 0x0 [0070.242] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0070.242] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x770109c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0070.242] GdipReleaseDC (graphics=0x1b86d040, hdc=0x770109c4) returned 0x0 [0070.242] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0070.242] SelectObject (hdc=0x770109c4, h=0x185000f) returned 0x17050730 [0070.242] DeleteDC (hdc=0x770109c4) returned 1 [0070.242] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0070.242] DeleteObject (ho=0x17050730) returned 1 [0070.246] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0070.246] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.246] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.246] WaitMessage () returned 1 [0070.370] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.370] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.370] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.370] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.370] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.370] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0070.370] GetCurrentThreadId () returned 0xa28 [0070.370] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0070.370] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.370] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.370] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.370] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.370] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.371] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0070.371] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0070.371] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffda0109cf [0070.371] GetObjectType (h=0x60109d6) returned 0x3 [0070.371] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x19050730 [0070.371] GetDIBits (in: hdc=0x60109d6, hbm=0x19050730, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.371] GetDIBits (in: hdc=0x60109d6, hbm=0x19050730, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.371] DeleteObject (ho=0x19050730) returned 1 [0070.371] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x780509c4 [0070.371] SelectObject (hdc=0xffffffffda0109cf, h=0x780509c4) returned 0x185000f [0070.371] GdipCreateFromHDC (hdc=0xffffffffda0109cf, graphics=0x26e408) returned 0x0 [0070.371] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0070.371] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0070.371] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0070.371] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0070.371] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0070.371] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.371] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0070.372] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.372] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0070.372] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0070.372] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0070.372] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0070.372] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0070.372] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.372] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.372] GetSystemMetrics (nIndex=42) returned 0 [0070.372] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.372] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.372] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0070.372] IsAppThemed () returned 0x1 [0070.372] GetThemeAppProperties () returned 0x3 [0070.372] GetThemeAppProperties () returned 0x3 [0070.372] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0070.372] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0070.372] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0070.372] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0070.372] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0070.372] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.372] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.372] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.372] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0070.372] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.372] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.372] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.372] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0070.372] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0070.372] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0070.373] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0070.373] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0070.373] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0070.373] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x1) returned 0x1b00017 [0070.373] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x2) returned 0x1900010 [0070.373] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x7) returned 0x780509c4 [0070.373] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x6) returned 0x18a002e [0070.373] SaveDC (hdc=0xffffffffda0109cf) returned 1 [0070.373] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff950409f1 [0070.373] GetClipRgn (hdc=0xffffffffda0109cf, hrgn=0xffffffff950409f1) returned 0 [0070.373] SelectClipRgn (hdc=0xffffffffda0109cf, hrgn=0xffffffffbb0409ff) returned 2 [0070.373] DeleteObject (ho=0xffffffff950409f1) returned 1 [0070.373] DeleteObject (ho=0xffffffffbb0409ff) returned 1 [0070.373] OffsetViewportOrgEx (in: hdc=0xffffffffda0109cf, x=0, y=0, lppt=0x2730938 | out: lppt=0x2730938) returned 1 [0070.373] OffsetViewportOrgEx (in: hdc=0xffffffffda0109cf, x=-417, y=-278, lppt=0x2730950 | out: lppt=0x2730950) returned 1 [0070.373] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0070.373] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x1) returned 0x1b00017 [0070.373] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x2) returned 0x1900010 [0070.373] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x7) returned 0x780509c4 [0070.373] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x6) returned 0x18a002e [0070.373] SaveDC (hdc=0xffffffffda0109cf) returned 2 [0070.373] GetNearestColor (hdc=0xffffffffda0109cf, color=0x6c4607) returned 0x6c4607 [0070.373] CreateSolidBrush (color=0x6c4607) returned 0x4100276 [0070.373] FillRect (hDC=0xffffffffda0109cf, lprc=0x26de08, hbr=0x4100276) returned 1 [0070.379] DeleteObject (ho=0x4100276) returned 1 [0070.379] RestoreDC (hdc=0xffffffffda0109cf, nSavedDC=-1) returned 1 [0070.379] RestoreDC (hdc=0xffffffffda0109cf, nSavedDC=-1) returned 1 [0070.379] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffda0109cf) returned 0x0 [0070.379] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc320dbd) returned 0x0 [0070.379] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0070.379] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.379] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.379] GetSystemMetrics (nIndex=42) returned 0 [0070.379] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.379] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.379] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2a) returned 0x0 [0070.380] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0070.380] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0070.380] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0070.380] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0070.380] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0070.380] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0070.380] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x1) returned 0x1b00017 [0070.380] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x2) returned 0x1900010 [0070.380] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x7) returned 0x780509c4 [0070.380] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x6) returned 0x18a002e [0070.380] SaveDC (hdc=0xffffffffda0109cf) returned 1 [0070.380] GetNearestColor (hdc=0xffffffffda0109cf, color=0xf0f0f0) returned 0xf0f0f0 [0070.380] RestoreDC (hdc=0xffffffffda0109cf, nSavedDC=-1) returned 1 [0070.380] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffda0109cf) returned 0x0 [0070.381] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0070.381] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0070.381] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0070.381] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0070.381] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x1) returned 0x1b00017 [0070.381] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x2) returned 0x1900010 [0070.381] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x7) returned 0x780509c4 [0070.381] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x6) returned 0x18a002e [0070.381] SaveDC (hdc=0xffffffffda0109cf) returned 1 [0070.381] GetTextAlign (hdc=0xffffffffda0109cf) returned 0x0 [0070.381] GetTextColor (hdc=0xffffffffda0109cf) returned 0x0 [0070.381] SetTextColor (hdc=0xffffffffda0109cf, color=0xf0f0f0) returned 0x0 [0070.381] GetCurrentObject (hdc=0xffffffffda0109cf, type=0x6) returned 0x18a002e [0070.381] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0070.381] SelectObject (hdc=0xffffffffda0109cf, h=0x260a09ba) returned 0x18a002e [0070.381] GetBkMode (hdc=0xffffffffda0109cf) returned 2 [0070.381] SetBkMode (hdc=0xffffffffda0109cf, mode=1) returned 2 [0070.381] DrawTextExW (in: hdc=0xffffffffda0109cf, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2731800 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0070.381] DrawTextExW (in: hdc=0xffffffffda0109cf, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2731800 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0070.382] RestoreDC (hdc=0xffffffffda0109cf, nSavedDC=-1) returned 1 [0070.382] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffda0109cf) returned 0x0 [0070.382] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0070.382] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffda0109cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0070.382] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffda0109cf) returned 0x0 [0070.382] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0070.382] SelectObject (hdc=0xffffffffda0109cf, h=0x185000f) returned 0x780509c4 [0070.382] DeleteDC (hdc=0xffffffffda0109cf) returned 1 [0070.382] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0070.382] DeleteObject (ho=0x780509c4) returned 1 [0070.386] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0070.386] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.386] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.386] WaitMessage () returned 1 [0070.511] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.511] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.511] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.511] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.511] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.511] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0070.511] GetCurrentThreadId () returned 0xa28 [0070.511] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0070.511] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.511] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.511] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.511] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.511] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.511] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0070.511] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0070.511] CreateCompatibleDC (hdc=0x60109d6) returned 0x22010730 [0070.511] GetObjectType (h=0x60109d6) returned 0x3 [0070.511] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff800509c4 [0070.511] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff800509c4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.511] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff800509c4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.511] DeleteObject (ho=0xffffffff800509c4) returned 1 [0070.511] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffe10509cf [0070.512] SelectObject (hdc=0x22010730, h=0xffffffffe10509cf) returned 0x185000f [0070.512] GdipCreateFromHDC (hdc=0x22010730, graphics=0x26e408) returned 0x0 [0070.512] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0070.512] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0070.512] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0070.512] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0070.512] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0070.512] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.512] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0070.512] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.512] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0070.512] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0070.512] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0070.512] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0070.512] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0070.512] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.512] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.512] GetSystemMetrics (nIndex=42) returned 0 [0070.512] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.512] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.512] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0070.512] IsAppThemed () returned 0x1 [0070.512] GetThemeAppProperties () returned 0x3 [0070.512] GetThemeAppProperties () returned 0x3 [0070.513] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0070.513] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0070.513] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0070.513] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0070.513] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0070.513] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.513] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.513] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.513] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0070.513] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.513] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.513] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.513] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0070.513] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0070.513] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0070.513] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0070.513] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0070.513] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0070.513] GetCurrentObject (hdc=0x22010730, type=0x1) returned 0x1b00017 [0070.513] GetCurrentObject (hdc=0x22010730, type=0x2) returned 0x1900010 [0070.513] GetCurrentObject (hdc=0x22010730, type=0x7) returned 0xffffffffe10509cf [0070.513] GetCurrentObject (hdc=0x22010730, type=0x6) returned 0x18a002e [0070.513] SaveDC (hdc=0x22010730) returned 1 [0070.513] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffbc0409ff [0070.513] GetClipRgn (hdc=0x22010730, hrgn=0xffffffffbc0409ff) returned 0 [0070.513] SelectClipRgn (hdc=0x22010730, hrgn=0xffffffff980409f1) returned 2 [0070.513] DeleteObject (ho=0xffffffffbc0409ff) returned 1 [0070.513] DeleteObject (ho=0xffffffff980409f1) returned 1 [0070.514] OffsetViewportOrgEx (in: hdc=0x22010730, x=0, y=0, lppt=0x27333e0 | out: lppt=0x27333e0) returned 1 [0070.514] OffsetViewportOrgEx (in: hdc=0x22010730, x=-417, y=-278, lppt=0x27333f8 | out: lppt=0x27333f8) returned 1 [0070.514] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0070.514] GetCurrentObject (hdc=0x22010730, type=0x1) returned 0x1b00017 [0070.514] GetCurrentObject (hdc=0x22010730, type=0x2) returned 0x1900010 [0070.514] GetCurrentObject (hdc=0x22010730, type=0x7) returned 0xffffffffe10509cf [0070.514] GetCurrentObject (hdc=0x22010730, type=0x6) returned 0x18a002e [0070.514] SaveDC (hdc=0x22010730) returned 2 [0070.514] GetNearestColor (hdc=0x22010730, color=0x6c4607) returned 0x6c4607 [0070.514] CreateSolidBrush (color=0x6c4607) returned 0x5100276 [0070.514] FillRect (hDC=0x22010730, lprc=0x26de08, hbr=0x5100276) returned 1 [0070.518] DeleteObject (ho=0x5100276) returned 1 [0070.518] RestoreDC (hdc=0x22010730, nSavedDC=-1) returned 1 [0070.518] RestoreDC (hdc=0x22010730, nSavedDC=-1) returned 1 [0070.518] GdipReleaseDC (graphics=0x1b86d040, hdc=0x22010730) returned 0x0 [0070.518] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc300dbd) returned 0x0 [0070.518] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0070.518] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.518] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.518] GetSystemMetrics (nIndex=42) returned 0 [0070.518] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.518] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.519] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0070.519] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0070.519] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0070.519] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0070.519] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0070.519] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0070.519] GetCurrentObject (hdc=0x22010730, type=0x1) returned 0x1b00017 [0070.519] GetCurrentObject (hdc=0x22010730, type=0x2) returned 0x1900010 [0070.519] GetCurrentObject (hdc=0x22010730, type=0x7) returned 0xffffffffe10509cf [0070.519] GetCurrentObject (hdc=0x22010730, type=0x6) returned 0x18a002e [0070.519] SaveDC (hdc=0x22010730) returned 1 [0070.519] GetNearestColor (hdc=0x22010730, color=0xf0f0f0) returned 0xf0f0f0 [0070.519] RestoreDC (hdc=0x22010730, nSavedDC=-1) returned 1 [0070.519] GdipReleaseDC (graphics=0x1b86d040, hdc=0x22010730) returned 0x0 [0070.519] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0070.519] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0070.519] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0070.519] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0070.519] GetCurrentObject (hdc=0x22010730, type=0x1) returned 0x1b00017 [0070.520] GetCurrentObject (hdc=0x22010730, type=0x2) returned 0x1900010 [0070.520] GetCurrentObject (hdc=0x22010730, type=0x7) returned 0xffffffffe10509cf [0070.520] GetCurrentObject (hdc=0x22010730, type=0x6) returned 0x18a002e [0070.520] SaveDC (hdc=0x22010730) returned 1 [0070.520] GetTextAlign (hdc=0x22010730) returned 0x0 [0070.520] GetTextColor (hdc=0x22010730) returned 0x0 [0070.520] SetTextColor (hdc=0x22010730, color=0xf0f0f0) returned 0x0 [0070.520] GetCurrentObject (hdc=0x22010730, type=0x6) returned 0x18a002e [0070.520] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0070.520] SelectObject (hdc=0x22010730, h=0x260a09ba) returned 0x18a002e [0070.520] GetBkMode (hdc=0x22010730) returned 2 [0070.520] SetBkMode (hdc=0x22010730, mode=1) returned 2 [0070.520] DrawTextExW (in: hdc=0x22010730, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27340a8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0070.520] DrawTextExW (in: hdc=0x22010730, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27340a8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0070.521] RestoreDC (hdc=0x22010730, nSavedDC=-1) returned 1 [0070.521] GdipReleaseDC (graphics=0x1b86d040, hdc=0x22010730) returned 0x0 [0070.521] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0070.521] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x22010730, x1=0, y1=0, rop=0xcc0020) returned 1 [0070.521] GdipReleaseDC (graphics=0x1b86d040, hdc=0x22010730) returned 0x0 [0070.521] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0070.521] SelectObject (hdc=0x22010730, h=0x185000f) returned 0xffffffffe10509cf [0070.521] DeleteDC (hdc=0x22010730) returned 1 [0070.521] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0070.521] DeleteObject (ho=0xffffffffe10509cf) returned 1 [0070.524] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0070.524] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.524] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.524] WaitMessage () returned 1 [0070.640] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.640] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.640] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.640] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.640] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.640] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0070.640] GetCurrentThreadId () returned 0xa28 [0070.640] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0070.640] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.640] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.640] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.640] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.640] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.640] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0070.641] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0070.641] CreateCompatibleDC (hdc=0x60109d6) returned 0x2b010730 [0070.641] GetObjectType (h=0x60109d6) returned 0x3 [0070.641] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff8a0509c4 [0070.641] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8a0509c4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.641] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff8a0509c4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.641] DeleteObject (ho=0xffffffff8a0509c4) returned 1 [0070.641] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xffffffffea0509cf [0070.641] SelectObject (hdc=0x2b010730, h=0xffffffffea0509cf) returned 0x185000f [0070.641] GdipCreateFromHDC (hdc=0x2b010730, graphics=0x26e408) returned 0x0 [0070.641] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0070.641] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0070.641] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0070.641] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0070.641] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0070.641] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.641] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0070.641] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.641] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0070.642] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0070.642] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0070.642] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0070.642] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0070.642] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.642] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.642] GetSystemMetrics (nIndex=42) returned 0 [0070.642] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.642] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.642] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0070.642] IsAppThemed () returned 0x1 [0070.642] GetThemeAppProperties () returned 0x3 [0070.642] GetThemeAppProperties () returned 0x3 [0070.642] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0070.642] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0070.642] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0070.642] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0070.642] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0070.642] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.642] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.642] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.642] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0070.642] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.642] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.642] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.642] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0070.642] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0070.642] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0070.642] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0070.643] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0070.643] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0070.643] GetCurrentObject (hdc=0x2b010730, type=0x1) returned 0x1b00017 [0070.643] GetCurrentObject (hdc=0x2b010730, type=0x2) returned 0x1900010 [0070.643] GetCurrentObject (hdc=0x2b010730, type=0x7) returned 0xffffffffea0509cf [0070.643] GetCurrentObject (hdc=0x2b010730, type=0x6) returned 0x18a002e [0070.643] SaveDC (hdc=0x2b010730) returned 1 [0070.643] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff990409f1 [0070.643] GetClipRgn (hdc=0x2b010730, hrgn=0xffffffff990409f1) returned 0 [0070.643] SelectClipRgn (hdc=0x2b010730, hrgn=0xffffffffbf0409ff) returned 2 [0070.643] DeleteObject (ho=0xffffffff990409f1) returned 1 [0070.643] DeleteObject (ho=0xffffffffbf0409ff) returned 1 [0070.643] OffsetViewportOrgEx (in: hdc=0x2b010730, x=0, y=0, lppt=0x2735c88 | out: lppt=0x2735c88) returned 1 [0070.643] OffsetViewportOrgEx (in: hdc=0x2b010730, x=-417, y=-278, lppt=0x2735ca0 | out: lppt=0x2735ca0) returned 1 [0070.643] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0070.643] GetCurrentObject (hdc=0x2b010730, type=0x1) returned 0x1b00017 [0070.643] GetCurrentObject (hdc=0x2b010730, type=0x2) returned 0x1900010 [0070.643] GetCurrentObject (hdc=0x2b010730, type=0x7) returned 0xffffffffea0509cf [0070.643] GetCurrentObject (hdc=0x2b010730, type=0x6) returned 0x18a002e [0070.643] SaveDC (hdc=0x2b010730) returned 2 [0070.643] GetNearestColor (hdc=0x2b010730, color=0x6c4607) returned 0x6c4607 [0070.643] CreateSolidBrush (color=0x6c4607) returned 0x6100276 [0070.643] FillRect (hDC=0x2b010730, lprc=0x26de08, hbr=0x6100276) returned 1 [0070.647] DeleteObject (ho=0x6100276) returned 1 [0070.647] RestoreDC (hdc=0x2b010730, nSavedDC=-1) returned 1 [0070.647] RestoreDC (hdc=0x2b010730, nSavedDC=-1) returned 1 [0070.647] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2b010730) returned 0x0 [0070.647] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc2e0dbd) returned 0x0 [0070.647] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0070.647] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.647] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.647] GetSystemMetrics (nIndex=42) returned 0 [0070.647] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.647] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.647] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2c) returned 0x0 [0070.648] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0070.648] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0070.648] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0070.648] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0070.648] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0070.648] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0070.648] GetCurrentObject (hdc=0x2b010730, type=0x1) returned 0x1b00017 [0070.648] GetCurrentObject (hdc=0x2b010730, type=0x2) returned 0x1900010 [0070.648] GetCurrentObject (hdc=0x2b010730, type=0x7) returned 0xffffffffea0509cf [0070.648] GetCurrentObject (hdc=0x2b010730, type=0x6) returned 0x18a002e [0070.648] SaveDC (hdc=0x2b010730) returned 1 [0070.648] GetNearestColor (hdc=0x2b010730, color=0xf0f0f0) returned 0xf0f0f0 [0070.648] RestoreDC (hdc=0x2b010730, nSavedDC=-1) returned 1 [0070.648] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2b010730) returned 0x0 [0070.649] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0070.649] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0070.649] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0070.649] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0070.649] GetCurrentObject (hdc=0x2b010730, type=0x1) returned 0x1b00017 [0070.649] GetCurrentObject (hdc=0x2b010730, type=0x2) returned 0x1900010 [0070.649] GetCurrentObject (hdc=0x2b010730, type=0x7) returned 0xffffffffea0509cf [0070.649] GetCurrentObject (hdc=0x2b010730, type=0x6) returned 0x18a002e [0070.649] SaveDC (hdc=0x2b010730) returned 1 [0070.649] GetTextAlign (hdc=0x2b010730) returned 0x0 [0070.649] GetTextColor (hdc=0x2b010730) returned 0x0 [0070.649] SetTextColor (hdc=0x2b010730, color=0xf0f0f0) returned 0x0 [0070.649] GetCurrentObject (hdc=0x2b010730, type=0x6) returned 0x18a002e [0070.649] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0070.649] SelectObject (hdc=0x2b010730, h=0x260a09ba) returned 0x18a002e [0070.649] GetBkMode (hdc=0x2b010730) returned 2 [0070.649] SetBkMode (hdc=0x2b010730, mode=1) returned 2 [0070.649] DrawTextExW (in: hdc=0x2b010730, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x2736c00 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0070.650] DrawTextExW (in: hdc=0x2b010730, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x2736c00 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0070.650] RestoreDC (hdc=0x2b010730, nSavedDC=-1) returned 1 [0070.650] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2b010730) returned 0x0 [0070.650] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0070.650] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x2b010730, x1=0, y1=0, rop=0xcc0020) returned 1 [0070.651] GdipReleaseDC (graphics=0x1b86d040, hdc=0x2b010730) returned 0x0 [0070.651] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0070.651] SelectObject (hdc=0x2b010730, h=0x185000f) returned 0xffffffffea0509cf [0070.651] DeleteDC (hdc=0x2b010730) returned 1 [0070.651] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0070.651] DeleteObject (ho=0xffffffffea0509cf) returned 1 [0070.654] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0070.654] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.654] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.654] WaitMessage () returned 1 [0070.776] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.776] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.776] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.776] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.776] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.776] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0070.776] GetCurrentThreadId () returned 0xa28 [0070.776] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0070.776] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.776] IsWindowUnicode (hWnd=0x3015e) returned 1 [0070.776] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0070.776] TranslateMessage (lpMsg=0x26ee10) returned 0 [0070.776] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0070.776] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0070.776] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0070.776] CreateCompatibleDC (hdc=0x60109d6) returned 0x34010730 [0070.776] GetObjectType (h=0x60109d6) returned 0x3 [0070.776] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffff940509c4 [0070.776] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff940509c4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.777] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffff940509c4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0070.777] DeleteObject (ho=0xffffffff940509c4) returned 1 [0070.777] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xfffffffff30509cf [0070.777] SelectObject (hdc=0x34010730, h=0xfffffffff30509cf) returned 0x185000f [0070.777] GdipCreateFromHDC (hdc=0x34010730, graphics=0x26e408) returned 0x0 [0070.777] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0070.777] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0070.777] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0070.777] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0070.777] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0070.777] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.777] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0070.777] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.777] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0070.777] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0070.777] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0070.777] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0070.777] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0070.777] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.777] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.777] GetSystemMetrics (nIndex=42) returned 0 [0070.777] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.777] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.778] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0070.778] IsAppThemed () returned 0x1 [0070.778] GetThemeAppProperties () returned 0x3 [0070.778] GetThemeAppProperties () returned 0x3 [0070.778] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0070.778] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0070.778] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0070.778] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0070.778] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0070.778] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.778] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.778] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.778] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0070.778] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0070.778] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0070.778] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0070.778] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0070.778] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0070.778] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0070.778] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0070.778] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0070.778] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0070.778] GetCurrentObject (hdc=0x34010730, type=0x1) returned 0x1b00017 [0070.778] GetCurrentObject (hdc=0x34010730, type=0x2) returned 0x1900010 [0070.778] GetCurrentObject (hdc=0x34010730, type=0x7) returned 0xfffffffff30509cf [0070.778] GetCurrentObject (hdc=0x34010730, type=0x6) returned 0x18a002e [0070.778] SaveDC (hdc=0x34010730) returned 1 [0070.778] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc00409ff [0070.779] GetClipRgn (hdc=0x34010730, hrgn=0xffffffffc00409ff) returned 0 [0070.779] SelectClipRgn (hdc=0x34010730, hrgn=0xffffffff9c0409f1) returned 2 [0070.779] DeleteObject (ho=0xffffffffc00409ff) returned 1 [0070.779] DeleteObject (ho=0xffffffff9c0409f1) returned 1 [0070.779] OffsetViewportOrgEx (in: hdc=0x34010730, x=0, y=0, lppt=0x2738930 | out: lppt=0x2738930) returned 1 [0070.779] OffsetViewportOrgEx (in: hdc=0x34010730, x=-417, y=-278, lppt=0x2738948 | out: lppt=0x2738948) returned 1 [0070.779] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0070.779] GetCurrentObject (hdc=0x34010730, type=0x1) returned 0x1b00017 [0070.779] GetCurrentObject (hdc=0x34010730, type=0x2) returned 0x1900010 [0070.779] GetCurrentObject (hdc=0x34010730, type=0x7) returned 0xfffffffff30509cf [0070.779] GetCurrentObject (hdc=0x34010730, type=0x6) returned 0x18a002e [0070.779] SaveDC (hdc=0x34010730) returned 2 [0070.779] GetNearestColor (hdc=0x34010730, color=0x6c4607) returned 0x6c4607 [0070.779] CreateSolidBrush (color=0x6c4607) returned 0x7100276 [0070.779] FillRect (hDC=0x34010730, lprc=0x26de08, hbr=0x7100276) returned 1 [0070.783] DeleteObject (ho=0x7100276) returned 1 [0070.783] RestoreDC (hdc=0x34010730, nSavedDC=-1) returned 1 [0070.783] RestoreDC (hdc=0x34010730, nSavedDC=-1) returned 1 [0070.783] GdipReleaseDC (graphics=0x1b86d040, hdc=0x34010730) returned 0x0 [0070.783] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc2c0dbd) returned 0x0 [0070.783] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0070.783] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0070.783] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0070.783] GetSystemMetrics (nIndex=42) returned 0 [0070.783] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0070.783] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0070.783] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0070.783] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0070.783] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0070.783] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0070.783] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0070.783] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0070.783] GetCurrentObject (hdc=0x34010730, type=0x1) returned 0x1b00017 [0070.783] GetCurrentObject (hdc=0x34010730, type=0x2) returned 0x1900010 [0070.783] GetCurrentObject (hdc=0x34010730, type=0x7) returned 0xfffffffff30509cf [0070.783] GetCurrentObject (hdc=0x34010730, type=0x6) returned 0x18a002e [0070.783] SaveDC (hdc=0x34010730) returned 1 [0070.783] GetNearestColor (hdc=0x34010730, color=0xf0f0f0) returned 0xf0f0f0 [0070.784] RestoreDC (hdc=0x34010730, nSavedDC=-1) returned 1 [0070.784] GdipReleaseDC (graphics=0x1b86d040, hdc=0x34010730) returned 0x0 [0070.784] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0070.784] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0070.784] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0070.784] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0070.784] GetCurrentObject (hdc=0x34010730, type=0x1) returned 0x1b00017 [0070.784] GetCurrentObject (hdc=0x34010730, type=0x2) returned 0x1900010 [0070.784] GetCurrentObject (hdc=0x34010730, type=0x7) returned 0xfffffffff30509cf [0070.784] GetCurrentObject (hdc=0x34010730, type=0x6) returned 0x18a002e [0070.784] SaveDC (hdc=0x34010730) returned 1 [0070.784] GetTextAlign (hdc=0x34010730) returned 0x0 [0070.784] GetTextColor (hdc=0x34010730) returned 0x0 [0070.784] SetTextColor (hdc=0x34010730, color=0xf0f0f0) returned 0x0 [0070.784] GetCurrentObject (hdc=0x34010730, type=0x6) returned 0x18a002e [0070.784] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0070.785] SelectObject (hdc=0x34010730, h=0x260a09ba) returned 0x18a002e [0070.785] GetBkMode (hdc=0x34010730) returned 2 [0070.785] SetBkMode (hdc=0x34010730, mode=1) returned 2 [0070.785] DrawTextExW (in: hdc=0x34010730, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x27395f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0070.785] DrawTextExW (in: hdc=0x34010730, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x27395f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0070.785] RestoreDC (hdc=0x34010730, nSavedDC=-1) returned 1 [0070.785] GdipReleaseDC (graphics=0x1b86d040, hdc=0x34010730) returned 0x0 [0070.785] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0070.785] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0x34010730, x1=0, y1=0, rop=0xcc0020) returned 1 [0070.786] GdipReleaseDC (graphics=0x1b86d040, hdc=0x34010730) returned 0x0 [0070.786] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0070.786] SelectObject (hdc=0x34010730, h=0x185000f) returned 0xfffffffff30509cf [0070.786] DeleteDC (hdc=0x34010730) returned 1 [0070.786] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0070.786] DeleteObject (ho=0xfffffffff30509cf) returned 1 [0070.789] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0070.789] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0070.789] WaitMessage () returned 1 [0071.065] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0071.065] IsWindowUnicode (hWnd=0x3015e) returned 1 [0071.065] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0071.065] TranslateMessage (lpMsg=0x26ee10) returned 0 [0071.065] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0071.065] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0071.065] GetCurrentThreadId () returned 0xa28 [0071.065] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0071.065] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0071.065] IsWindowUnicode (hWnd=0x3015e) returned 1 [0071.065] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0071.065] TranslateMessage (lpMsg=0x26ee10) returned 0 [0071.065] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0071.065] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0071.065] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0071.065] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffa80109c4 [0071.066] GetObjectType (h=0x60109d6) returned 0x3 [0071.066] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x60509cf [0071.066] GetDIBits (in: hdc=0x60109d6, hbm=0x60509cf, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0071.066] GetDIBits (in: hdc=0x60109d6, hbm=0x60509cf, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0071.066] DeleteObject (ho=0x60509cf) returned 1 [0071.066] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x47050730 [0071.066] SelectObject (hdc=0xffffffffa80109c4, h=0x47050730) returned 0x185000f [0071.066] GdipCreateFromHDC (hdc=0xffffffffa80109c4, graphics=0x26e408) returned 0x0 [0071.066] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0071.066] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0071.066] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0071.066] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0071.066] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0071.066] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0071.066] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0071.066] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0071.066] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0071.066] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0071.066] GdipGetClip (graphics=0x1b86d040, region=0x1d056010) returned 0x0 [0071.066] GdipIsInfiniteRegion (region=0x1d056010, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0071.066] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0071.067] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0071.067] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0071.067] GetSystemMetrics (nIndex=42) returned 0 [0071.067] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0071.067] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0071.067] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0071.067] IsAppThemed () returned 0x1 [0071.067] GetThemeAppProperties () returned 0x3 [0071.067] GetThemeAppProperties () returned 0x3 [0071.067] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0071.067] GdipGetClip (graphics=0x1b86d040, region=0x1d0570e0) returned 0x0 [0071.067] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0071.067] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0071.067] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0071.067] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0071.067] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0071.067] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0071.067] GdipCombineRegionRegion (region=0x1d0570e0, region2=0x1d056010, combineMode=0x1) returned 0x0 [0071.067] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0071.067] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0071.067] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0071.067] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0071.067] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0071.067] GdipIsInfiniteRegion (region=0x1d0570e0, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0071.067] GdipGetRegionHRgn (region=0x1d0570e0, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0071.067] GdipDeleteRegion (region=0x1d0570e0) returned 0x0 [0071.067] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0071.067] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x1) returned 0x1b00017 [0071.068] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x2) returned 0x1900010 [0071.068] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x7) returned 0x47050730 [0071.068] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x6) returned 0x18a002e [0071.068] SaveDC (hdc=0xffffffffa80109c4) returned 1 [0071.068] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffff9d0409f1 [0071.068] GetClipRgn (hdc=0xffffffffa80109c4, hrgn=0xffffffff9d0409f1) returned 0 [0071.068] SelectClipRgn (hdc=0xffffffffa80109c4, hrgn=0xffffffffc30409ff) returned 2 [0071.068] DeleteObject (ho=0xffffffff9d0409f1) returned 1 [0071.068] DeleteObject (ho=0xffffffffc30409ff) returned 1 [0071.068] OffsetViewportOrgEx (in: hdc=0xffffffffa80109c4, x=0, y=0, lppt=0x2698520 | out: lppt=0x2698520) returned 1 [0071.068] OffsetViewportOrgEx (in: hdc=0xffffffffa80109c4, x=-417, y=-278, lppt=0x2698538 | out: lppt=0x2698538) returned 1 [0071.068] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0071.068] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x1) returned 0x1b00017 [0071.068] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x2) returned 0x1900010 [0071.068] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x7) returned 0x47050730 [0071.068] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x6) returned 0x18a002e [0071.068] SaveDC (hdc=0xffffffffa80109c4) returned 2 [0071.068] GetNearestColor (hdc=0xffffffffa80109c4, color=0x6c4607) returned 0x6c4607 [0071.068] CreateSolidBrush (color=0x6c4607) returned 0x8100276 [0071.068] FillRect (hDC=0xffffffffa80109c4, lprc=0x26de08, hbr=0x8100276) returned 1 [0071.081] DeleteObject (ho=0x8100276) returned 1 [0071.081] RestoreDC (hdc=0xffffffffa80109c4, nSavedDC=-1) returned 1 [0071.081] RestoreDC (hdc=0xffffffffa80109c4, nSavedDC=-1) returned 1 [0071.081] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109c4) returned 0x0 [0071.081] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc2a0dbd) returned 0x0 [0071.081] GdipDeleteRegion (region=0x1d056010) returned 0x0 [0071.081] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0071.081] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0071.081] GetSystemMetrics (nIndex=42) returned 0 [0071.081] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0071.081] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0071.082] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x2e) returned 0x0 [0071.082] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0071.082] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0071.082] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0071.082] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0071.082] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0071.082] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0071.082] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x1) returned 0x1b00017 [0071.082] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x2) returned 0x1900010 [0071.083] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x7) returned 0x47050730 [0071.083] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x6) returned 0x18a002e [0071.083] SaveDC (hdc=0xffffffffa80109c4) returned 1 [0071.083] GetNearestColor (hdc=0xffffffffa80109c4, color=0xf0f0f0) returned 0xf0f0f0 [0071.083] RestoreDC (hdc=0xffffffffa80109c4, nSavedDC=-1) returned 1 [0071.083] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109c4) returned 0x0 [0071.083] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0071.083] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0071.083] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0071.083] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x1) returned 0x1b00017 [0071.083] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x2) returned 0x1900010 [0071.083] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x7) returned 0x47050730 [0071.083] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x6) returned 0x18a002e [0071.083] SaveDC (hdc=0xffffffffa80109c4) returned 1 [0071.083] GetTextAlign (hdc=0xffffffffa80109c4) returned 0x0 [0071.083] GetTextColor (hdc=0xffffffffa80109c4) returned 0x0 [0071.083] SetTextColor (hdc=0xffffffffa80109c4, color=0xf0f0f0) returned 0x0 [0071.083] GetCurrentObject (hdc=0xffffffffa80109c4, type=0x6) returned 0x18a002e [0071.083] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0071.084] SelectObject (hdc=0xffffffffa80109c4, h=0x260a09ba) returned 0x18a002e [0071.084] GetBkMode (hdc=0xffffffffa80109c4) returned 2 [0071.084] SetBkMode (hdc=0xffffffffa80109c4, mode=1) returned 2 [0071.084] DrawTextExW (in: hdc=0xffffffffa80109c4, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26993e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0071.084] DrawTextExW (in: hdc=0xffffffffa80109c4, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26993e8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0071.084] RestoreDC (hdc=0xffffffffa80109c4, nSavedDC=-1) returned 1 [0071.084] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109c4) returned 0x0 [0071.084] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0071.084] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffa80109c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0071.085] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffa80109c4) returned 0x0 [0071.085] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0071.085] SelectObject (hdc=0xffffffffa80109c4, h=0x185000f) returned 0x47050730 [0071.085] DeleteDC (hdc=0xffffffffa80109c4) returned 1 [0071.085] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0071.085] DeleteObject (ho=0x47050730) returned 1 [0071.089] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0071.089] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0071.089] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0071.089] WaitMessage () returned 1 [0071.340] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0071.340] IsWindowUnicode (hWnd=0x3015e) returned 1 [0071.340] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0071.340] TranslateMessage (lpMsg=0x26ee10) returned 0 [0071.340] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0071.340] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0071.340] GetCurrentThreadId () returned 0xa28 [0071.340] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0071.340] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0071.340] IsWindowUnicode (hWnd=0x3015e) returned 1 [0071.340] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0071.340] TranslateMessage (lpMsg=0x26ee10) returned 0 [0071.340] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0071.340] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0071.340] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0071.340] CreateCompatibleDC (hdc=0x60109d6) returned 0xb0109cf [0071.340] GetObjectType (h=0x60109d6) returned 0x3 [0071.340] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0xffffffffad0509c4 [0071.341] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffad0509c4, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0071.341] GetDIBits (in: hdc=0x60109d6, hbm=0xffffffffad0509c4, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0071.341] DeleteObject (ho=0xffffffffad0509c4) returned 1 [0071.341] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0x2505072f [0071.341] SelectObject (hdc=0xb0109cf, h=0x2505072f) returned 0x185000f [0071.341] GdipCreateFromHDC (hdc=0xb0109cf, graphics=0x26e408) returned 0x0 [0071.341] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0071.341] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0071.341] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0071.341] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0071.341] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0071.341] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0071.341] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0071.341] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0071.341] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0071.342] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0071.342] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0071.342] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0071.342] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0071.342] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0071.342] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0071.342] GetSystemMetrics (nIndex=42) returned 0 [0071.342] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0071.342] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0071.342] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0071.342] IsAppThemed () returned 0x1 [0071.342] GetThemeAppProperties () returned 0x3 [0071.342] GetThemeAppProperties () returned 0x3 [0071.342] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0071.342] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0071.342] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0071.342] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0071.342] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0071.342] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0071.342] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0071.342] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0071.342] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0071.342] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0071.342] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0071.342] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0071.342] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0071.342] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0071.343] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0071.343] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0071.343] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0071.343] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0071.343] GetCurrentObject (hdc=0xb0109cf, type=0x1) returned 0x1b00017 [0071.343] GetCurrentObject (hdc=0xb0109cf, type=0x2) returned 0x1900010 [0071.343] GetCurrentObject (hdc=0xb0109cf, type=0x7) returned 0x2505072f [0071.343] GetCurrentObject (hdc=0xb0109cf, type=0x6) returned 0x18a002e [0071.343] SaveDC (hdc=0xb0109cf) returned 1 [0071.343] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffc40409ff [0071.343] GetClipRgn (hdc=0xb0109cf, hrgn=0xffffffffc40409ff) returned 0 [0071.343] SelectClipRgn (hdc=0xb0109cf, hrgn=0xffffffffa00409f1) returned 2 [0071.343] DeleteObject (ho=0xffffffffc40409ff) returned 1 [0071.343] DeleteObject (ho=0xffffffffa00409f1) returned 1 [0071.343] OffsetViewportOrgEx (in: hdc=0xb0109cf, x=0, y=0, lppt=0x2695430 | out: lppt=0x2695430) returned 1 [0071.343] OffsetViewportOrgEx (in: hdc=0xb0109cf, x=-417, y=-278, lppt=0x2695448 | out: lppt=0x2695448) returned 1 [0071.343] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0071.343] GetCurrentObject (hdc=0xb0109cf, type=0x1) returned 0x1b00017 [0071.343] GetCurrentObject (hdc=0xb0109cf, type=0x2) returned 0x1900010 [0071.343] GetCurrentObject (hdc=0xb0109cf, type=0x7) returned 0x2505072f [0071.343] GetCurrentObject (hdc=0xb0109cf, type=0x6) returned 0x18a002e [0071.343] SaveDC (hdc=0xb0109cf) returned 2 [0071.343] GetNearestColor (hdc=0xb0109cf, color=0x6c4607) returned 0x6c4607 [0071.343] CreateSolidBrush (color=0x6c4607) returned 0x9100276 [0071.344] FillRect (hDC=0xb0109cf, lprc=0x26de08, hbr=0x9100276) returned 1 [0071.350] DeleteObject (ho=0x9100276) returned 1 [0071.350] RestoreDC (hdc=0xb0109cf, nSavedDC=-1) returned 1 [0071.350] RestoreDC (hdc=0xb0109cf, nSavedDC=-1) returned 1 [0071.350] GdipReleaseDC (graphics=0x1b86d040, hdc=0xb0109cf) returned 0x0 [0071.350] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc280dbd) returned 0x0 [0071.350] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0071.350] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0071.350] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0071.350] GetSystemMetrics (nIndex=42) returned 0 [0071.350] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0071.350] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0071.350] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0071.350] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0071.350] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0071.350] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0071.350] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0071.350] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0071.351] GetCurrentObject (hdc=0xb0109cf, type=0x1) returned 0x1b00017 [0071.351] GetCurrentObject (hdc=0xb0109cf, type=0x2) returned 0x1900010 [0071.351] GetCurrentObject (hdc=0xb0109cf, type=0x7) returned 0x2505072f [0071.351] GetCurrentObject (hdc=0xb0109cf, type=0x6) returned 0x18a002e [0071.351] SaveDC (hdc=0xb0109cf) returned 1 [0071.351] GetNearestColor (hdc=0xb0109cf, color=0xf0f0f0) returned 0xf0f0f0 [0071.351] RestoreDC (hdc=0xb0109cf, nSavedDC=-1) returned 1 [0071.351] GdipReleaseDC (graphics=0x1b86d040, hdc=0xb0109cf) returned 0x0 [0071.351] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0071.351] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0071.351] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0071.351] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0071.351] GetCurrentObject (hdc=0xb0109cf, type=0x1) returned 0x1b00017 [0071.351] GetCurrentObject (hdc=0xb0109cf, type=0x2) returned 0x1900010 [0071.351] GetCurrentObject (hdc=0xb0109cf, type=0x7) returned 0x2505072f [0071.351] GetCurrentObject (hdc=0xb0109cf, type=0x6) returned 0x18a002e [0071.351] SaveDC (hdc=0xb0109cf) returned 1 [0071.351] GetTextAlign (hdc=0xb0109cf) returned 0x0 [0071.351] GetTextColor (hdc=0xb0109cf) returned 0x0 [0071.352] SetTextColor (hdc=0xb0109cf, color=0xf0f0f0) returned 0x0 [0071.352] GetCurrentObject (hdc=0xb0109cf, type=0x6) returned 0x18a002e [0071.352] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0071.352] SelectObject (hdc=0xb0109cf, h=0x260a09ba) returned 0x18a002e [0071.352] GetBkMode (hdc=0xb0109cf) returned 2 [0071.352] SetBkMode (hdc=0xb0109cf, mode=1) returned 2 [0071.352] DrawTextExW (in: hdc=0xb0109cf, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x26960f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0071.352] DrawTextExW (in: hdc=0xb0109cf, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x26960f8 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0071.352] RestoreDC (hdc=0xb0109cf, nSavedDC=-1) returned 1 [0071.353] GdipReleaseDC (graphics=0x1b86d040, hdc=0xb0109cf) returned 0x0 [0071.353] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0071.353] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xb0109cf, x1=0, y1=0, rop=0xcc0020) returned 1 [0071.353] GdipReleaseDC (graphics=0x1b86d040, hdc=0xb0109cf) returned 0x0 [0071.353] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0071.353] SelectObject (hdc=0xb0109cf, h=0x185000f) returned 0x2505072f [0071.353] DeleteDC (hdc=0xb0109cf) returned 1 [0071.353] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0071.353] DeleteObject (ho=0x2505072f) returned 1 [0071.356] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0071.356] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0071.356] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0071.356] WaitMessage () returned 1 [0072.257] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0072.257] IsWindowUnicode (hWnd=0x3015e) returned 1 [0072.257] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0072.257] TranslateMessage (lpMsg=0x26ee10) returned 0 [0072.257] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0072.258] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0072.258] GetCurrentThreadId () returned 0xa28 [0072.258] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0072.258] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0072.258] IsWindowUnicode (hWnd=0x3015e) returned 1 [0072.258] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0072.258] TranslateMessage (lpMsg=0x26ee10) returned 0 [0072.258] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0072.258] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0072.259] SelectPalette (hdc=0x60109d6, hPal=0x2c0809d4, bForceBkgd=1) returned 0x188000b [0072.259] CreateCompatibleDC (hdc=0x60109d6) returned 0xffffffffaf0109c4 [0072.259] GetObjectType (h=0x60109d6) returned 0x3 [0072.259] CreateCompatibleBitmap (hdc=0x60109d6, cx=1, cy=1) returned 0x2605072f [0072.259] GetDIBits (in: hdc=0x60109d6, hbm=0x2605072f, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0072.259] GetDIBits (in: hdc=0x60109d6, hbm=0x2605072f, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x26de18, usage=0x0 | out: lpvBits=0x0, lpbmi=0x26de18) returned 1 [0072.259] DeleteObject (ho=0x2605072f) returned 1 [0072.259] CreateDIBSection (in: hdc=0x60109d6, lpbmi=0x26dec8, usage=0x0, ppvBits=0x26e488, hSection=0x0, offset=0x0 | out: ppvBits=0x26e488) returned 0xc0509cf [0072.259] SelectObject (hdc=0xffffffffaf0109c4, h=0xc0509cf) returned 0x185000f [0072.260] GdipCreateFromHDC (hdc=0xffffffffaf0109c4, graphics=0x26e408) returned 0x0 [0072.260] GdipTranslateWorldTransform (graphics=0x1b86d040, dx=0x7fef13edf12, dy=0xdf2acb62dab1, order=0x0) returned 0x0 [0072.260] GdipSetClipRectI (graphics=0x1b86d040, x=0, y=0, width=538, height=325, combineMode=0x0) returned 0x0 [0072.260] GdipCreateMatrix (matrix=0x26e4b0) returned 0x0 [0072.260] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b9eff40) returned 0x0 [0072.260] GdipIsMatrixIdentity (matrix=0x1b9eff40, result=0x26e518) returned 0x0 [0072.260] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0072.260] GdipGetMatrixElements (matrix=0x1b9eff40, matrixOut=0x1a78ceb0) returned 0x0 [0072.260] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0072.260] GdipDeleteMatrix (matrix=0x1b9eff40) returned 0x0 [0072.260] GdipCreateRegion (region=0x26e4b0) returned 0x0 [0072.261] GdipGetClip (graphics=0x1b86d040, region=0x1d055f50) returned 0x0 [0072.261] GdipIsInfiniteRegion (region=0x1d055f50, graphics=0x1b86d040, result=0x26e510) returned 0x0 [0072.261] GdipSaveGraphics (graphics=0x1b86d040, state=0x26e5b0) returned 0x0 [0072.261] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0072.261] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0072.261] GetSystemMetrics (nIndex=42) returned 0 [0072.261] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0072.261] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0072.261] GetClientRect (in: hWnd=0x3015e, lpRect=0x26e558 | out: lpRect=0x26e558) returned 1 [0072.261] IsAppThemed () returned 0x1 [0072.261] GetThemeAppProperties () returned 0x3 [0072.261] GetThemeAppProperties () returned 0x3 [0072.261] GdipCreateRegion (region=0x26e0f0) returned 0x0 [0072.261] GdipGetClip (graphics=0x1b86d040, region=0x1b86e730) returned 0x0 [0072.261] GdipCreateMatrix (matrix=0x26e0f0) returned 0x0 [0072.262] GdipGetWorldTransform (graphics=0x1b86d040, matrix=0x1b8b60a0) returned 0x0 [0072.262] GdipIsMatrixIdentity (matrix=0x1b8b60a0, result=0x26e158) returned 0x0 [0072.262] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0072.262] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0072.262] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0072.262] GdipCombineRegionRegion (region=0x1b86e730, region2=0x1d055f50, combineMode=0x1) returned 0x0 [0072.262] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1a78ceb0 [0072.262] GdipGetMatrixElements (matrix=0x1b8b60a0, matrixOut=0x1a78ceb0) returned 0x0 [0072.262] LocalFree (hMem=0x1a78ceb0) returned 0x0 [0072.262] GdipDeleteMatrix (matrix=0x1b8b60a0) returned 0x0 [0072.262] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e1c0) returned 0x0 [0072.262] GdipIsInfiniteRegion (region=0x1b86e730, graphics=0x1b86d040, result=0x26e180) returned 0x0 [0072.262] GdipGetRegionHRgn (region=0x1b86e730, graphics=0x1b86d040, hRgn=0x26e180) returned 0x0 [0072.262] GdipDeleteRegion (region=0x1b86e730) returned 0x0 [0072.262] GdipGetDC (graphics=0x1b86d040, hdc=0x26e1c8) returned 0x0 [0072.262] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x1) returned 0x1b00017 [0072.262] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x2) returned 0x1900010 [0072.262] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x7) returned 0xc0509cf [0072.262] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x6) returned 0x18a002e [0072.262] SaveDC (hdc=0xffffffffaf0109c4) returned 1 [0072.262] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xffffffffa10409f1 [0072.262] GetClipRgn (hdc=0xffffffffaf0109c4, hrgn=0xffffffffa10409f1) returned 0 [0072.263] SelectClipRgn (hdc=0xffffffffaf0109c4, hrgn=0xffffffffc70409ff) returned 2 [0072.263] DeleteObject (ho=0xffffffffa10409f1) returned 1 [0072.263] DeleteObject (ho=0xffffffffc70409ff) returned 1 [0072.263] OffsetViewportOrgEx (in: hdc=0xffffffffaf0109c4, x=0, y=0, lppt=0x271d708 | out: lppt=0x271d708) returned 1 [0072.263] OffsetViewportOrgEx (in: hdc=0xffffffffaf0109c4, x=-417, y=-278, lppt=0x271d720 | out: lppt=0x271d720) returned 1 [0072.263] GetClientRect (in: hWnd=0x50114, lpRect=0x26e118 | out: lpRect=0x26e118) returned 1 [0072.263] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x1) returned 0x1b00017 [0072.263] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x2) returned 0x1900010 [0072.263] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x7) returned 0xc0509cf [0072.263] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x6) returned 0x18a002e [0072.263] SaveDC (hdc=0xffffffffaf0109c4) returned 2 [0072.263] GetNearestColor (hdc=0xffffffffaf0109c4, color=0x6c4607) returned 0x6c4607 [0072.263] CreateSolidBrush (color=0x6c4607) returned 0xa100276 [0072.263] FillRect (hDC=0xffffffffaf0109c4, lprc=0x26de08, hbr=0xa100276) returned 1 [0072.269] DeleteObject (ho=0xa100276) returned 1 [0072.269] RestoreDC (hdc=0xffffffffaf0109c4, nSavedDC=-1) returned 1 [0072.270] RestoreDC (hdc=0xffffffffaf0109c4, nSavedDC=-1) returned 1 [0072.270] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffaf0109c4) returned 0x0 [0072.270] GdipRestoreGraphics (graphics=0x1b86d040, state=0xfffffffffc260dbd) returned 0x0 [0072.270] GdipDeleteRegion (region=0x1d055f50) returned 0x0 [0072.270] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0072.270] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0072.270] GetSystemMetrics (nIndex=42) returned 0 [0072.270] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e300, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0072.270] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e300) returned 0x5d [0072.270] GdipImageSelectActiveFrame (image=0x1d0552e0, dimensionID=0x26e2b0*(Data1=0x6aedbd6d, Data2=0x3fb5, Data3=0x418a, Data4=([0]=0x83, [1]=0xa6, [2]=0x7f, [3]=0x45, [4]=0x22, [5]=0x9d, [6]=0xc8, [7]=0x72)), frameIndex=0x30) returned 0x0 [0072.272] GdipGetImageWidth (image=0x1d0552e0, width=0x26e278) returned 0x0 [0072.272] GdipGetImageHeight (image=0x1d0552e0, height=0x26e278) returned 0x0 [0072.272] GdipGetImageWidth (image=0x1d0552e0, width=0x26e308) returned 0x0 [0072.272] GdipGetImageHeight (image=0x1d0552e0, height=0x26e308) returned 0x0 [0072.272] GdipDrawImageRectI (graphics=0x1b86d040, image=0x1d0552e0, x=253, y=146, width=32, height=32) returned 0x0 [0072.272] GdipGetDC (graphics=0x1b86d040, hdc=0x26e3a8) returned 0x0 [0072.272] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x1) returned 0x1b00017 [0072.272] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x2) returned 0x1900010 [0072.272] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x7) returned 0xc0509cf [0072.272] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x6) returned 0x18a002e [0072.272] SaveDC (hdc=0xffffffffaf0109c4) returned 1 [0072.272] GetNearestColor (hdc=0xffffffffaf0109c4, color=0xf0f0f0) returned 0xf0f0f0 [0072.272] RestoreDC (hdc=0xffffffffaf0109c4, nSavedDC=-1) returned 1 [0072.272] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffaf0109c4) returned 0x0 [0072.273] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0072.273] AdjustWindowRectEx (in: lpRect=0x26e258, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26e258) returned 1 [0072.273] GdipGetTextRenderingHint (graphics=0x1b86d040, mode=0x26e2b8) returned 0x0 [0072.273] GdipGetDC (graphics=0x1b86d040, hdc=0x26e298) returned 0x0 [0072.273] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x1) returned 0x1b00017 [0072.273] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x2) returned 0x1900010 [0072.273] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x7) returned 0xc0509cf [0072.273] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x6) returned 0x18a002e [0072.273] SaveDC (hdc=0xffffffffaf0109c4) returned 1 [0072.273] GetTextAlign (hdc=0xffffffffaf0109c4) returned 0x0 [0072.273] GetTextColor (hdc=0xffffffffaf0109c4) returned 0x0 [0072.273] SetTextColor (hdc=0xffffffffaf0109c4, color=0xf0f0f0) returned 0x0 [0072.273] GetCurrentObject (hdc=0xffffffffaf0109c4, type=0x6) returned 0x18a002e [0072.274] GetObjectW (in: h=0x18a002e, c=92, pv=0x26ddd0 | out: pv=0x26ddd0) returned 92 [0072.274] SelectObject (hdc=0xffffffffaf0109c4, h=0x260a09ba) returned 0x18a002e [0072.274] GetBkMode (hdc=0xffffffffaf0109c4) returned 2 [0072.274] SetBkMode (hdc=0xffffffffaf0109c4, mode=1) returned 2 [0072.274] DrawTextExW (in: hdc=0xffffffffaf0109c4, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e010, format=0x100405, lpdtp=0x271e5d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e010) returned 333 [0072.274] DrawTextExW (in: hdc=0xffffffffaf0109c4, lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", cchText=93, lprc=0x26e228, format=0x100005, lpdtp=0x271e5d0 | out: lpchText="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.", lprc=0x26e228) returned 333 [0072.275] RestoreDC (hdc=0xffffffffaf0109c4, nSavedDC=-1) returned 1 [0072.275] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffaf0109c4) returned 0x0 [0072.275] GdipGetDC (graphics=0x1b86d040, hdc=0x26e4c8) returned 0x0 [0072.275] BitBlt (hdc=0x60109d6, x=0, y=0, cx=538, cy=325, hdcSrc=0xffffffffaf0109c4, x1=0, y1=0, rop=0xcc0020) returned 1 [0072.275] GdipReleaseDC (graphics=0x1b86d040, hdc=0xffffffffaf0109c4) returned 0x0 [0072.275] SelectPalette (hdc=0x60109d6, hPal=0x188000b, bForceBkgd=0) returned 0x2c0809d4 [0072.275] SelectObject (hdc=0xffffffffaf0109c4, h=0x185000f) returned 0xc0509cf [0072.275] DeleteDC (hdc=0xffffffffaf0109c4) returned 1 [0072.275] GdipDeleteGraphics (graphics=0x1b86d040) returned 0x0 [0072.275] DeleteObject (ho=0xc0509cf) returned 1 [0072.278] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0072.279] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0072.279] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0072.279] WaitMessage () returned 1 [0072.665] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0072.665] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0072.665] IsWindowUnicode (hWnd=0x50114) returned 1 [0072.665] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0072.665] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x84, wParam=0x0, lParam=0x610185) returned 0x1 [0072.666] SetCursor (hCursor=0x10007) returned 0x10007 [0072.666] TranslateMessage (lpMsg=0x26ee10) returned 0 [0072.666] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0072.666] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x200, wParam=0x0, lParam=0x610185) returned 0x0 [0072.666] GetKeyState (nVirtKey=1) returned 0 [0072.666] GetKeyState (nVirtKey=2) returned 0 [0072.666] GetKeyState (nVirtKey=4) returned 0 [0072.666] GetKeyState (nVirtKey=5) returned 0 [0072.666] GetKeyState (nVirtKey=6) returned 0 [0072.897] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0072.901] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x3b, wParam=0x50e, lParam=0x0) returned 0x3 [0072.904] CoTaskMemAlloc (cb=0x11) returned 0x1a7f7e20 [0072.909] CoTaskMemAlloc (cb=0x12) returned 0x1a7f7fe0 [0072.917] IsWindowUnicode (hWnd=0x3015e) returned 1 [0072.917] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0072.917] TranslateMessage (lpMsg=0x26ee10) returned 0 [0072.917] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0072.917] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0072.917] GetCurrentThreadId () returned 0xa28 [0072.917] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0072.918] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.402] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x86, wParam=0x0, lParam=0x30274) returned 0x1 [0073.402] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x86, wParam=0x0, lParam=0x50114) returned 0x1 [0073.402] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0xd, wParam=0x104, lParam=0x1af95a80) returned 0x0 [0073.402] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0xd, wParam=0x104, lParam=0x1af95ab0) returned 0x0 [0073.403] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x6, wParam=0x1, lParam=0x50114) returned 0x0 [0073.403] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x8, wParam=0x30274, lParam=0x0) returned 0x0 [0073.403] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0073.404] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0073.443] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.443] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0073.443] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0073.443] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x7, wParam=0x50114, lParam=0x0) returned 0x0 [0073.443] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0073.443] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0xd, wParam=0x104, lParam=0x1af95ab0) returned 0x0 [0073.444] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0xd, wParam=0x104, lParam=0x1af95ab0) returned 0x0 [0073.444] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0073.444] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x1c, wParam=0x0, lParam=0xa04) returned 0x0 [0073.444] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x1c, wParam=0x0, lParam=0xa04) returned 0x0 [0073.444] NtdllDefWindowProc_W (hWnd=0x1c0270, Msg=0x1c, wParam=0x0, lParam=0xa04) returned 0x0 [0073.444] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0073.444] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0073.444] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x30274, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0073.444] IsWindowUnicode (hWnd=0x3015e) returned 1 [0073.444] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.444] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.444] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.444] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0073.444] GetCurrentThreadId () returned 0xa28 [0073.444] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0073.444] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.444] GetMessageA (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.445] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.445] DispatchMessageA (lpMsg=0x26ee10) returned 0x0 [0073.445] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.445] IsWindowUnicode (hWnd=0x50114) returned 1 [0073.445] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.445] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.445] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.445] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50114, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0073.445] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.445] IsWindowUnicode (hWnd=0x3015e) returned 1 [0073.445] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.445] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.445] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.445] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0073.445] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0073.445] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.445] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.445] WaitMessage () returned 1 [0073.505] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.505] IsWindowUnicode (hWnd=0x30162) returned 1 [0073.505] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.505] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.505] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.505] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.505] WaitMessage () returned 1 [0073.583] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.584] IsWindowUnicode (hWnd=0x3015e) returned 1 [0073.584] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.584] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.584] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.584] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0073.584] GetCurrentThreadId () returned 0xa28 [0073.584] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0073.584] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.584] IsWindowUnicode (hWnd=0x3015e) returned 1 [0073.584] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.584] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.584] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.584] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0073.584] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0073.584] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.584] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.584] WaitMessage () returned 1 [0073.708] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.708] IsWindowUnicode (hWnd=0x3015e) returned 1 [0073.708] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.708] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.708] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.708] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0073.708] GetCurrentThreadId () returned 0xa28 [0073.708] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0073.709] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.709] IsWindowUnicode (hWnd=0x3015e) returned 1 [0073.709] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.709] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.709] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.709] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0073.709] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0073.709] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.709] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.709] WaitMessage () returned 1 [0073.755] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.755] IsWindowUnicode (hWnd=0x3015c) returned 1 [0073.755] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.755] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.755] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.755] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.755] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.755] WaitMessage () returned 1 [0073.911] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.911] IsWindowUnicode (hWnd=0x3015e) returned 1 [0073.911] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.911] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.911] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.911] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0073.911] GetCurrentThreadId () returned 0xa28 [0073.911] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0073.912] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.912] IsWindowUnicode (hWnd=0x3015e) returned 1 [0073.912] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0073.912] TranslateMessage (lpMsg=0x26ee10) returned 0 [0073.912] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0073.912] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0073.912] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0073.912] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.912] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0073.912] WaitMessage () returned 1 [0074.098] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.098] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.098] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.098] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.098] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.098] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0074.098] GetCurrentThreadId () returned 0xa28 [0074.098] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0074.098] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.098] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.098] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.098] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.098] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.098] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0074.099] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0074.099] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.099] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.099] WaitMessage () returned 1 [0074.312] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.312] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.312] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.312] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.312] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.312] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0074.312] GetCurrentThreadId () returned 0xa28 [0074.312] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0074.312] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.312] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.312] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.312] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.312] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.312] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0074.312] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0074.313] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.313] WaitMessage () returned 1 [0074.473] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.473] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.473] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.473] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.473] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.473] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0074.473] GetCurrentThreadId () returned 0xa28 [0074.473] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0074.474] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.474] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.474] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.474] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.474] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.474] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0074.474] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0074.474] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.474] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.474] WaitMessage () returned 1 [0074.613] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.613] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.613] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.613] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.613] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.613] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0074.613] GetCurrentThreadId () returned 0xa28 [0074.613] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0074.613] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.613] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.613] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.613] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.613] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.614] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0074.614] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0074.614] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.614] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.614] WaitMessage () returned 1 [0074.816] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.816] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.816] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.816] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.816] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.816] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0074.816] GetCurrentThreadId () returned 0xa28 [0074.816] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0074.816] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.816] IsWindowUnicode (hWnd=0x3015e) returned 1 [0074.816] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0074.816] TranslateMessage (lpMsg=0x26ee10) returned 0 [0074.816] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0074.816] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0074.816] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0074.816] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.816] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0074.816] WaitMessage () returned 1 [0075.050] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.050] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.050] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.050] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.050] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.050] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0075.051] GetCurrentThreadId () returned 0xa28 [0075.051] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0075.051] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.051] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.051] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.051] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.051] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.051] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0075.051] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0075.051] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.051] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.051] WaitMessage () returned 1 [0075.206] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.206] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.206] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.206] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.206] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.206] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0075.206] GetCurrentThreadId () returned 0xa28 [0075.206] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0075.206] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.206] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.206] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.206] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.206] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.206] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0075.207] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0075.207] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.207] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.207] WaitMessage () returned 1 [0075.408] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.408] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.408] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.408] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.408] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.409] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0075.409] GetCurrentThreadId () returned 0xa28 [0075.409] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0075.409] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.409] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.409] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.409] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.409] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.409] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0075.409] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0075.409] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.409] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.409] WaitMessage () returned 1 [0075.596] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.596] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.596] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.596] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.596] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.596] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0075.596] GetCurrentThreadId () returned 0xa28 [0075.596] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0075.596] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.596] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.596] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.596] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.596] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.596] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0075.596] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0075.596] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.596] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.596] WaitMessage () returned 1 [0075.783] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.783] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.783] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.783] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.783] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.783] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0075.783] GetCurrentThreadId () returned 0xa28 [0075.783] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0075.783] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.783] IsWindowUnicode (hWnd=0x3015e) returned 1 [0075.783] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0075.783] TranslateMessage (lpMsg=0x26ee10) returned 0 [0075.783] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0075.783] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0075.783] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0075.783] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.784] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0075.784] WaitMessage () returned 1 [0076.001] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.001] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.001] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.001] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.001] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.001] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0076.002] GetCurrentThreadId () returned 0xa28 [0076.002] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0076.002] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.002] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.002] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.002] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.002] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.002] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0076.002] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0076.002] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.002] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.002] WaitMessage () returned 1 [0076.173] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.173] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.173] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.173] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.173] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.173] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0076.173] GetCurrentThreadId () returned 0xa28 [0076.173] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0076.173] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.173] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.173] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.173] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.173] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.173] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0076.173] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0076.173] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.173] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.173] WaitMessage () returned 1 [0076.360] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.360] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.360] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.360] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.360] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.360] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0076.360] GetCurrentThreadId () returned 0xa28 [0076.360] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0076.360] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.360] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.360] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.361] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.361] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.361] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0076.361] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0076.361] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.361] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.361] WaitMessage () returned 1 [0076.551] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.551] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.551] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.551] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.551] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.552] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0076.552] GetCurrentThreadId () returned 0xa28 [0076.552] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0076.552] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.552] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.552] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.552] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.552] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.552] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0076.552] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0076.552] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.552] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.552] WaitMessage () returned 1 [0076.735] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.735] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.735] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.735] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.735] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.735] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0076.735] GetCurrentThreadId () returned 0xa28 [0076.735] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0076.735] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.735] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.735] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.735] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.735] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.735] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0076.736] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0076.736] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.736] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.736] WaitMessage () returned 1 [0076.875] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.875] IsWindowUnicode (hWnd=0x5015a) returned 1 [0076.875] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.875] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.875] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.875] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0076.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0076.875] GetSystemMetrics (nIndex=42) returned 0 [0076.875] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e690, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0076.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e690) returned 0x5d [0076.875] GetWindowTextLengthW (hWnd=0x3015e) returned 93 [0076.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5d [0076.875] GetSystemMetrics (nIndex=42) returned 0 [0076.875] GetWindowTextW (in: hWnd=0x3015e, lpString=0x26e630, nMaxCount=94 | out: lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n4% complete\r\nDo not turn off your computer.") returned 93 [0076.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xd, wParam=0x5e, lParam=0x26e630) returned 0x5d [0076.875] SetWindowTextW (hWnd=0x3015e, lpString="Configuring critical Windows Updates\r\n\r\n\r\n\r\n\r\n\r\n\r\n5% complete\r\nDo not turn off your computer.") returned 1 [0076.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0xc, wParam=0x0, lParam=0x27efeec) returned 0x1 [0076.875] GetStockObject (i=5) returned 0x1900015 [0076.875] GetDlgItem (hDlg=0x50114, nIDDlgItem=196958) returned 0x3015e [0076.875] SendMessageW (hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26df90) returned 0x0 [0076.875] CallWindowProcW (lpPrevWndFunc=0x7fefc5861b4, hWnd=0x3015e, Msg=0x202b, wParam=0x3015e, lParam=0x26df90) returned 0x0 [0076.876] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0076.876] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.876] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.876] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.876] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.876] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.876] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0076.876] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0076.876] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.876] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.876] WaitMessage () returned 1 [0076.993] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.993] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.993] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.993] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.993] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.993] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0076.993] GetCurrentThreadId () returned 0xa28 [0076.993] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0076.993] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.993] IsWindowUnicode (hWnd=0x3015e) returned 1 [0076.993] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0076.993] TranslateMessage (lpMsg=0x26ee10) returned 0 [0076.993] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0076.993] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0076.993] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0076.993] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.993] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0076.993] WaitMessage () returned 1 [0077.203] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.203] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.203] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.203] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.203] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.203] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0077.203] GetCurrentThreadId () returned 0xa28 [0077.203] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0077.203] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.203] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.203] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.203] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.203] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.203] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0077.203] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0077.203] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.203] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.203] WaitMessage () returned 1 [0077.391] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.391] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.391] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.391] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.391] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.391] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0077.391] GetCurrentThreadId () returned 0xa28 [0077.391] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0077.391] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.391] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.391] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.391] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.391] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.391] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0077.391] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0077.391] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.392] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.392] WaitMessage () returned 1 [0077.577] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.577] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.577] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.577] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.577] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.577] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0077.577] GetCurrentThreadId () returned 0xa28 [0077.577] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0077.577] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.577] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.577] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.577] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.577] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.577] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0077.577] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0077.577] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.577] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.578] WaitMessage () returned 1 [0077.704] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.704] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.704] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.704] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.704] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.704] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0077.704] GetCurrentThreadId () returned 0xa28 [0077.704] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0077.704] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.704] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.704] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.704] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.704] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.704] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0077.704] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0077.704] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.705] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.705] WaitMessage () returned 1 [0077.889] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.889] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.889] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.889] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.889] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.889] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0077.889] GetCurrentThreadId () returned 0xa28 [0077.889] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0077.889] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.889] IsWindowUnicode (hWnd=0x3015e) returned 1 [0077.889] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0077.889] TranslateMessage (lpMsg=0x26ee10) returned 0 [0077.889] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0077.889] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0077.889] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0077.890] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.890] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0077.890] WaitMessage () returned 1 [0078.076] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.076] IsWindowUnicode (hWnd=0x3015e) returned 1 [0078.076] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.076] TranslateMessage (lpMsg=0x26ee10) returned 0 [0078.076] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0078.076] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0078.076] GetCurrentThreadId () returned 0xa28 [0078.076] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0078.076] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.076] IsWindowUnicode (hWnd=0x3015e) returned 1 [0078.076] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.076] TranslateMessage (lpMsg=0x26ee10) returned 0 [0078.076] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0078.077] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0078.077] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0078.077] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0078.077] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0078.077] WaitMessage () returned 1 [0078.273] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.274] IsWindowUnicode (hWnd=0x3015e) returned 1 [0078.274] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.274] TranslateMessage (lpMsg=0x26ee10) returned 0 [0078.274] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0078.274] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0078.274] GetCurrentThreadId () returned 0xa28 [0078.274] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0078.274] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.274] IsWindowUnicode (hWnd=0x3015e) returned 1 [0078.274] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.274] TranslateMessage (lpMsg=0x26ee10) returned 0 [0078.274] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0078.274] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0078.274] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0078.274] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0078.274] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0078.274] WaitMessage () returned 1 [0078.513] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.513] IsWindowUnicode (hWnd=0x3015e) returned 1 [0078.513] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.513] TranslateMessage (lpMsg=0x26ee10) returned 0 [0078.513] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0078.513] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0078.513] GetCurrentThreadId () returned 0xa28 [0078.513] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0078.513] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.513] IsWindowUnicode (hWnd=0x3015e) returned 1 [0078.513] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.513] TranslateMessage (lpMsg=0x26ee10) returned 0 [0078.513] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0078.514] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0078.514] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0078.514] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0078.514] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0078.514] WaitMessage () returned 1 [0078.749] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.749] IsWindowUnicode (hWnd=0x3015e) returned 1 [0078.749] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.749] TranslateMessage (lpMsg=0x26ee10) returned 0 [0078.750] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0078.750] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0078.750] GetCurrentThreadId () returned 0xa28 [0078.750] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0078.750] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.750] IsWindowUnicode (hWnd=0x3015e) returned 1 [0078.750] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0078.750] TranslateMessage (lpMsg=0x26ee10) returned 0 [0078.750] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0078.750] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0078.750] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0078.750] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0078.750] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0078.750] WaitMessage () returned 1 [0079.032] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.032] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.032] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.032] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.032] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.032] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0079.032] GetCurrentThreadId () returned 0xa28 [0079.032] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0079.032] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.032] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.032] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.032] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.032] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.032] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0079.032] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0079.032] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.032] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.032] WaitMessage () returned 1 [0079.196] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.196] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.196] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.196] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.196] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.196] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0079.196] GetCurrentThreadId () returned 0xa28 [0079.196] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0079.197] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.197] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.197] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.197] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.197] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.197] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0079.197] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0079.197] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.197] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.197] WaitMessage () returned 1 [0079.309] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.309] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.309] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.309] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.309] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.309] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0079.309] GetCurrentThreadId () returned 0xa28 [0079.309] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0079.309] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.309] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.309] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.309] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.309] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.309] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0079.309] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0079.309] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.309] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.309] WaitMessage () returned 1 [0079.433] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.433] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.433] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.433] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.433] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.433] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0079.433] GetCurrentThreadId () returned 0xa28 [0079.433] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0079.434] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.434] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.434] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.434] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.434] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.434] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0079.434] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0079.434] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.434] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.434] WaitMessage () returned 1 [0079.621] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.621] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.621] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.621] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.621] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.621] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0079.621] GetCurrentThreadId () returned 0xa28 [0079.621] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0079.621] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.621] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.621] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.621] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.621] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.621] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0079.621] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0079.621] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.621] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.621] WaitMessage () returned 1 [0079.823] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.823] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.823] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.823] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.823] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.823] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0079.823] GetCurrentThreadId () returned 0xa28 [0079.823] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0079.824] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.824] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.824] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.824] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.824] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.824] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0079.824] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0079.824] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.824] WaitMessage () returned 1 [0079.986] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.986] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.986] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.986] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.986] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.986] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0079.986] GetCurrentThreadId () returned 0xa28 [0079.986] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0079.987] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.987] IsWindowUnicode (hWnd=0x3015e) returned 1 [0079.987] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0079.987] TranslateMessage (lpMsg=0x26ee10) returned 0 [0079.987] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0079.987] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0079.987] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0079.987] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.987] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0079.987] WaitMessage () returned 1 [0080.132] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.132] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.132] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.132] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.132] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.132] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0080.132] GetCurrentThreadId () returned 0xa28 [0080.132] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0080.132] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.132] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.132] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.132] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.132] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.132] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0080.132] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0080.133] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.133] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.133] WaitMessage () returned 1 [0080.270] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.270] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.270] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.270] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.271] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.271] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0080.271] GetCurrentThreadId () returned 0xa28 [0080.271] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0080.271] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.271] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.271] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.271] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.271] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.271] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0080.271] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0080.271] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.271] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.271] WaitMessage () returned 1 [0080.494] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.494] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.494] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.494] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.494] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.494] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0080.494] GetCurrentThreadId () returned 0xa28 [0080.494] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0080.494] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.494] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.494] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.494] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.494] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.495] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0080.495] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0080.495] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.495] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.495] WaitMessage () returned 1 [0080.682] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.682] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.682] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.682] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.682] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.682] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0080.682] GetCurrentThreadId () returned 0xa28 [0080.682] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0080.682] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.682] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.682] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.682] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.682] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.682] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0080.682] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0080.682] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.682] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.682] WaitMessage () returned 1 [0080.837] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.837] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.837] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.837] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.837] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.837] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0080.837] GetCurrentThreadId () returned 0xa28 [0080.837] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0080.837] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.838] IsWindowUnicode (hWnd=0x3015e) returned 1 [0080.838] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0080.838] TranslateMessage (lpMsg=0x26ee10) returned 0 [0080.838] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0080.838] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0080.838] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0080.838] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.838] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0080.838] WaitMessage () returned 1 [0081.045] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.045] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.045] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.045] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.045] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.045] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0081.045] GetCurrentThreadId () returned 0xa28 [0081.045] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0081.045] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.045] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.045] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.045] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.045] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.045] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0081.045] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0081.045] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.045] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.045] WaitMessage () returned 1 [0081.196] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.196] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.196] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.196] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.196] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.196] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0081.196] GetCurrentThreadId () returned 0xa28 [0081.196] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0081.196] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.196] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.196] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.196] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.197] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.197] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x4801027b [0081.197] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0081.197] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.197] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.197] WaitMessage () returned 1 [0081.369] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.369] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.369] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.369] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.369] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.369] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0081.369] GetCurrentThreadId () returned 0xa28 [0081.369] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0081.369] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.369] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.369] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.369] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.369] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.369] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0081.369] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0081.370] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.370] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.370] WaitMessage () returned 1 [0081.586] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.586] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.586] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.586] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.586] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.586] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0081.586] GetCurrentThreadId () returned 0xa28 [0081.586] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0081.586] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.586] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.586] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.586] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.586] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.587] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0081.587] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0081.587] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.587] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.587] WaitMessage () returned 1 [0081.759] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.759] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.759] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.759] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.759] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.759] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0081.759] GetCurrentThreadId () returned 0xa28 [0081.760] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0081.760] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.760] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.760] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.760] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.760] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.760] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x350109dd [0081.760] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0081.760] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.760] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.760] WaitMessage () returned 1 [0081.945] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.945] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.945] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.945] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.945] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.945] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0081.945] GetCurrentThreadId () returned 0xa28 [0081.945] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0081.945] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.945] IsWindowUnicode (hWnd=0x3015e) returned 1 [0081.945] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0081.945] TranslateMessage (lpMsg=0x26ee10) returned 0 [0081.945] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0081.946] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0081.946] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0081.946] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.946] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0081.946] WaitMessage () returned 1 [0082.117] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0082.117] IsWindowUnicode (hWnd=0x3015e) returned 1 [0082.117] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0082.117] TranslateMessage (lpMsg=0x26ee10) returned 0 [0082.117] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0082.117] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0082.117] GetCurrentThreadId () returned 0xa28 [0082.117] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0082.117] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0082.117] IsWindowUnicode (hWnd=0x3015e) returned 1 [0082.117] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0082.117] TranslateMessage (lpMsg=0x26ee10) returned 0 [0082.117] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0082.117] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x150109ce [0082.117] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0082.117] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0082.117] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0082.117] WaitMessage () returned 1 [0082.343] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0082.343] IsWindowUnicode (hWnd=0x3015e) returned 1 [0082.343] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0082.343] TranslateMessage (lpMsg=0x26ee10) returned 0 [0082.343] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0082.343] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x26e5c8 | out: lpdwProcessId=0x26e5c8) returned 0xa28 [0082.343] GetCurrentThreadId () returned 0xa28 [0082.343] InvalidateRect (hWnd=0x3015e, lpRect=0x0, bErase=1) returned 1 [0082.343] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 1 [0082.343] IsWindowUnicode (hWnd=0x3015e) returned 1 [0082.343] GetMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26ee10) returned 1 [0082.343] TranslateMessage (lpMsg=0x26ee10) returned 0 [0082.343] DispatchMessageW (lpMsg=0x26ee10) returned 0x0 [0082.343] BeginPaint (in: hWnd=0x3015e, lpPaint=0x26e508 | out: lpPaint=0x26e508) returned 0x60109d6 [0082.344] EndPaint (hWnd=0x3015e, lpPaint=0x26e4a8) returned 1 [0082.344] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0082.344] PeekMessageW (in: lpMsg=0x26ee10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x26ee10) returned 0 [0082.344] WaitMessage () Thread: id = 2 os_tid = 0xa50 Thread: id = 3 os_tid = 0xa4c [0029.273] CoGetContextToken (in: pToken=0x1a9bf4e0 | out: pToken=0x1a9bf4e0) returned 0x800401f0 [0029.273] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 4 os_tid = 0xa48 Thread: id = 5 os_tid = 0x51c Thread: id = 6 os_tid = 0xab4 [0036.196] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0036.203] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.268] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0036.269] GetCurrentThreadId () returned 0xab4 [0036.269] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0036.269] GetCurrentThreadId () returned 0xab4 [0036.270] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc122 [0036.270] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0036.270] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.350] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.469] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0036.469] GetCurrentThreadId () returned 0xab4 [0036.469] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0036.469] GetCurrentThreadId () returned 0xab4 [0036.469] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0036.469] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.518] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.580] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0036.580] GetCurrentThreadId () returned 0xab4 [0036.580] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0036.580] GetCurrentThreadId () returned 0xab4 [0036.580] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0036.595] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.642] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.705] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0036.705] GetCurrentThreadId () returned 0xab4 [0036.705] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0036.705] GetCurrentThreadId () returned 0xab4 [0036.705] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0036.723] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.783] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.846] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0036.846] GetCurrentThreadId () returned 0xab4 [0036.846] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0036.846] GetCurrentThreadId () returned 0xab4 [0036.846] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0036.860] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.908] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0036.970] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0036.970] GetCurrentThreadId () returned 0xab4 [0036.970] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0036.970] GetCurrentThreadId () returned 0xab4 [0036.970] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0036.985] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0037.076] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0037.499] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0037.499] GetCurrentThreadId () returned 0xab4 [0037.500] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0037.500] GetCurrentThreadId () returned 0xab4 [0037.500] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0037.520] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0037.578] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0037.641] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0037.641] GetCurrentThreadId () returned 0xab4 [0037.641] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0037.641] GetCurrentThreadId () returned 0xab4 [0037.641] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0037.661] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0037.719] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0037.785] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0037.785] GetCurrentThreadId () returned 0xab4 [0037.785] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0037.785] GetCurrentThreadId () returned 0xab4 [0037.786] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0037.801] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0037.860] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0037.922] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0037.922] GetCurrentThreadId () returned 0xab4 [0037.922] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0037.922] GetCurrentThreadId () returned 0xab4 [0037.922] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0037.937] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.000] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.062] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0038.062] GetCurrentThreadId () returned 0xab4 [0038.062] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0038.062] GetCurrentThreadId () returned 0xab4 [0038.062] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0038.076] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.124] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.187] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0038.187] GetCurrentThreadId () returned 0xab4 [0038.187] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0038.187] GetCurrentThreadId () returned 0xab4 [0038.187] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0038.202] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.249] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.312] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0038.312] GetCurrentThreadId () returned 0xab4 [0038.312] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0038.312] GetCurrentThreadId () returned 0xab4 [0038.312] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0038.325] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.447] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.624] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0038.624] GetCurrentThreadId () returned 0xab4 [0038.624] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0038.624] GetCurrentThreadId () returned 0xab4 [0038.624] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0038.642] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.702] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.772] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0038.772] GetCurrentThreadId () returned 0xab4 [0038.772] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0038.772] GetCurrentThreadId () returned 0xab4 [0038.772] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0038.789] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.842] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.904] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0038.904] GetCurrentThreadId () returned 0xab4 [0038.904] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0038.904] GetCurrentThreadId () returned 0xab4 [0038.905] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0038.922] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0038.982] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.045] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0039.045] GetCurrentThreadId () returned 0xab4 [0039.045] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0039.045] GetCurrentThreadId () returned 0xab4 [0039.045] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0039.063] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.123] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.187] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0039.187] GetCurrentThreadId () returned 0xab4 [0039.187] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0039.188] GetCurrentThreadId () returned 0xab4 [0039.188] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0039.203] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.263] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.325] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0039.325] GetCurrentThreadId () returned 0xab4 [0039.325] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0039.325] GetCurrentThreadId () returned 0xab4 [0039.325] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0039.342] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.404] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.466] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0039.466] GetCurrentThreadId () returned 0xab4 [0039.466] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0039.466] GetCurrentThreadId () returned 0xab4 [0039.466] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0039.483] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.544] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.606] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0039.606] GetCurrentThreadId () returned 0xab4 [0039.606] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0039.606] GetCurrentThreadId () returned 0xab4 [0039.606] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0039.624] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.684] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.747] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0039.747] GetCurrentThreadId () returned 0xab4 [0039.747] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0039.748] GetCurrentThreadId () returned 0xab4 [0039.748] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0039.776] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.825] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.895] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0039.895] GetCurrentThreadId () returned 0xab4 [0039.895] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0039.895] GetCurrentThreadId () returned 0xab4 [0039.895] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0039.914] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0039.966] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.027] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0040.027] GetCurrentThreadId () returned 0xab4 [0040.027] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0040.028] GetCurrentThreadId () returned 0xab4 [0040.028] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0040.045] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.105] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.168] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0040.168] GetCurrentThreadId () returned 0xab4 [0040.168] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0040.168] GetCurrentThreadId () returned 0xab4 [0040.168] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0040.185] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.246] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.309] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0040.309] GetCurrentThreadId () returned 0xab4 [0040.309] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0040.309] GetCurrentThreadId () returned 0xab4 [0040.309] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0040.326] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.418] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.480] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0040.480] GetCurrentThreadId () returned 0xab4 [0040.480] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0040.480] GetCurrentThreadId () returned 0xab4 [0040.480] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0040.497] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.558] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.621] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0040.621] GetCurrentThreadId () returned 0xab4 [0040.621] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0040.621] GetCurrentThreadId () returned 0xab4 [0040.621] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0040.639] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.698] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.768] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0040.768] GetCurrentThreadId () returned 0xab4 [0040.768] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0040.768] GetCurrentThreadId () returned 0xab4 [0040.768] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0040.785] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.839] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.901] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0040.901] GetCurrentThreadId () returned 0xab4 [0040.901] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0040.901] GetCurrentThreadId () returned 0xab4 [0040.901] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0040.919] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0040.979] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.041] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0041.041] GetCurrentThreadId () returned 0xab4 [0041.041] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0041.042] GetCurrentThreadId () returned 0xab4 [0041.042] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0041.061] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.119] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.182] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0041.182] GetCurrentThreadId () returned 0xab4 [0041.182] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0041.182] GetCurrentThreadId () returned 0xab4 [0041.182] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0041.207] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.260] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.322] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0041.322] GetCurrentThreadId () returned 0xab4 [0041.322] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0041.322] GetCurrentThreadId () returned 0xab4 [0041.322] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0041.339] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.401] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.467] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0041.467] GetCurrentThreadId () returned 0xab4 [0041.467] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0041.467] GetCurrentThreadId () returned 0xab4 [0041.467] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0041.485] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.541] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.603] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0041.603] GetCurrentThreadId () returned 0xab4 [0041.603] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0041.603] GetCurrentThreadId () returned 0xab4 [0041.603] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0041.620] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.681] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.743] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0041.744] GetCurrentThreadId () returned 0xab4 [0041.744] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0041.744] GetCurrentThreadId () returned 0xab4 [0041.744] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0041.768] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.821] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.884] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0041.884] GetCurrentThreadId () returned 0xab4 [0041.884] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0041.884] GetCurrentThreadId () returned 0xab4 [0041.884] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0041.900] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0041.962] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.024] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0042.024] GetCurrentThreadId () returned 0xab4 [0042.024] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0042.024] GetCurrentThreadId () returned 0xab4 [0042.024] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0042.042] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.103] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.165] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0042.165] GetCurrentThreadId () returned 0xab4 [0042.165] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0042.165] GetCurrentThreadId () returned 0xab4 [0042.165] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0042.182] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.243] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.305] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0042.305] GetCurrentThreadId () returned 0xab4 [0042.305] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0042.305] GetCurrentThreadId () returned 0xab4 [0042.305] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0042.324] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.385] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.445] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0042.445] GetCurrentThreadId () returned 0xab4 [0042.445] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0042.446] GetCurrentThreadId () returned 0xab4 [0042.446] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0042.462] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.523] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.586] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0042.586] GetCurrentThreadId () returned 0xab4 [0042.586] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0042.586] GetCurrentThreadId () returned 0xab4 [0042.586] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0042.603] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.685] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.742] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0042.742] GetCurrentThreadId () returned 0xab4 [0042.742] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0042.742] GetCurrentThreadId () returned 0xab4 [0042.742] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0042.756] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.805] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.867] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0042.867] GetCurrentThreadId () returned 0xab4 [0042.867] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0042.867] GetCurrentThreadId () returned 0xab4 [0042.867] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0042.881] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0042.929] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.000] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0043.000] GetCurrentThreadId () returned 0xab4 [0043.000] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0043.000] GetCurrentThreadId () returned 0xab4 [0043.000] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0043.014] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.069] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.132] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0043.132] GetCurrentThreadId () returned 0xab4 [0043.132] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0043.132] GetCurrentThreadId () returned 0xab4 [0043.132] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0043.146] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.194] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.257] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0043.257] GetCurrentThreadId () returned 0xab4 [0043.257] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0043.257] GetCurrentThreadId () returned 0xab4 [0043.257] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0043.271] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.319] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.381] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0043.381] GetCurrentThreadId () returned 0xab4 [0043.381] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0043.381] GetCurrentThreadId () returned 0xab4 [0043.382] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0043.396] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.444] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.507] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0043.507] GetCurrentThreadId () returned 0xab4 [0043.507] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0043.507] GetCurrentThreadId () returned 0xab4 [0043.507] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0043.521] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.569] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.631] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0043.631] GetCurrentThreadId () returned 0xab4 [0043.631] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0043.631] GetCurrentThreadId () returned 0xab4 [0043.631] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0043.646] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.693] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.762] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0043.762] GetCurrentThreadId () returned 0xab4 [0043.762] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0043.762] GetCurrentThreadId () returned 0xab4 [0043.762] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0043.776] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.834] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.896] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0043.896] GetCurrentThreadId () returned 0xab4 [0043.896] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0043.897] GetCurrentThreadId () returned 0xab4 [0043.897] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0043.917] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0043.975] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.037] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0044.037] GetCurrentThreadId () returned 0xab4 [0044.037] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0044.037] GetCurrentThreadId () returned 0xab4 [0044.037] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0044.051] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.100] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.178] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0044.179] GetCurrentThreadId () returned 0xab4 [0044.179] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0044.179] GetCurrentThreadId () returned 0xab4 [0044.179] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0044.202] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.255] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.317] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0044.317] GetCurrentThreadId () returned 0xab4 [0044.317] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0044.317] GetCurrentThreadId () returned 0xab4 [0044.318] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0044.331] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.380] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.442] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0044.442] GetCurrentThreadId () returned 0xab4 [0044.443] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0044.443] GetCurrentThreadId () returned 0xab4 [0044.443] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0044.457] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.505] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.567] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0044.567] GetCurrentThreadId () returned 0xab4 [0044.567] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0044.567] GetCurrentThreadId () returned 0xab4 [0044.567] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0044.581] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.629] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.692] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0044.692] GetCurrentThreadId () returned 0xab4 [0044.692] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0044.692] GetCurrentThreadId () returned 0xab4 [0044.692] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0044.706] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.760] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.817] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0044.817] GetCurrentThreadId () returned 0xab4 [0044.817] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0044.817] GetCurrentThreadId () returned 0xab4 [0044.817] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0044.831] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.879] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0044.941] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0044.941] GetCurrentThreadId () returned 0xab4 [0044.942] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0044.942] GetCurrentThreadId () returned 0xab4 [0044.942] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0044.956] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.012] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.066] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0045.066] GetCurrentThreadId () returned 0xab4 [0045.066] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0045.066] GetCurrentThreadId () returned 0xab4 [0045.066] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0045.081] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.129] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.191] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0045.191] GetCurrentThreadId () returned 0xab4 [0045.191] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0045.191] GetCurrentThreadId () returned 0xab4 [0045.191] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0045.205] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.253] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.318] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0045.318] GetCurrentThreadId () returned 0xab4 [0045.318] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0045.318] GetCurrentThreadId () returned 0xab4 [0045.318] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0045.333] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.398] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.457] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0045.457] GetCurrentThreadId () returned 0xab4 [0045.457] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0045.457] GetCurrentThreadId () returned 0xab4 [0045.457] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0045.474] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.534] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.597] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0045.597] GetCurrentThreadId () returned 0xab4 [0045.597] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0045.597] GetCurrentThreadId () returned 0xab4 [0045.597] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0045.612] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.659] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.721] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0045.722] GetCurrentThreadId () returned 0xab4 [0045.722] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0045.722] GetCurrentThreadId () returned 0xab4 [0045.722] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0045.738] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.800] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.862] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0045.862] GetCurrentThreadId () returned 0xab4 [0045.863] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0045.863] GetCurrentThreadId () returned 0xab4 [0045.863] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0045.876] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.924] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0045.987] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0045.987] GetCurrentThreadId () returned 0xab4 [0045.987] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0045.987] GetCurrentThreadId () returned 0xab4 [0045.987] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0046.002] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.049] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.112] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0046.112] GetCurrentThreadId () returned 0xab4 [0046.112] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0046.112] GetCurrentThreadId () returned 0xab4 [0046.112] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0046.126] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.174] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.237] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0046.237] GetCurrentThreadId () returned 0xab4 [0046.237] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0046.237] GetCurrentThreadId () returned 0xab4 [0046.237] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0046.251] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.299] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.399] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0046.400] GetCurrentThreadId () returned 0xab4 [0046.400] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0046.400] GetCurrentThreadId () returned 0xab4 [0046.400] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0046.416] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.470] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.550] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0046.550] GetCurrentThreadId () returned 0xab4 [0046.550] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0046.550] GetCurrentThreadId () returned 0xab4 [0046.550] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0046.567] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.635] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.688] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0046.689] GetCurrentThreadId () returned 0xab4 [0046.689] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0046.689] GetCurrentThreadId () returned 0xab4 [0046.689] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0046.708] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.798] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.892] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0046.892] GetCurrentThreadId () returned 0xab4 [0046.892] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0046.892] GetCurrentThreadId () returned 0xab4 [0046.892] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0046.913] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0046.988] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.048] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0047.048] GetCurrentThreadId () returned 0xab4 [0047.048] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0047.048] GetCurrentThreadId () returned 0xab4 [0047.048] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0047.064] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.131] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.190] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0047.190] GetCurrentThreadId () returned 0xab4 [0047.191] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0047.191] GetCurrentThreadId () returned 0xab4 [0047.191] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0047.208] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.289] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.344] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0047.344] GetCurrentThreadId () returned 0xab4 [0047.344] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0047.344] GetCurrentThreadId () returned 0xab4 [0047.344] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0047.358] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.406] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.484] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0047.484] GetCurrentThreadId () returned 0xab4 [0047.484] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0047.484] GetCurrentThreadId () returned 0xab4 [0047.485] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0047.502] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.578] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.644] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0047.644] GetCurrentThreadId () returned 0xab4 [0047.644] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0047.644] GetCurrentThreadId () returned 0xab4 [0047.644] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0047.661] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.721] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.781] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0047.782] GetCurrentThreadId () returned 0xab4 [0047.782] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0047.782] GetCurrentThreadId () returned 0xab4 [0047.782] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0047.799] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.874] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0047.937] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0047.937] GetCurrentThreadId () returned 0xab4 [0047.937] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0047.937] GetCurrentThreadId () returned 0xab4 [0047.937] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0047.952] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.046] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.119] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0048.119] GetCurrentThreadId () returned 0xab4 [0048.119] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0048.119] GetCurrentThreadId () returned 0xab4 [0048.119] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0048.135] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.217] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.324] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0048.324] GetCurrentThreadId () returned 0xab4 [0048.324] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0048.324] GetCurrentThreadId () returned 0xab4 [0048.324] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0048.374] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.436] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.636] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0048.636] GetCurrentThreadId () returned 0xab4 [0048.636] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0048.636] GetCurrentThreadId () returned 0xab4 [0048.636] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0048.654] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.720] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.811] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0048.811] GetCurrentThreadId () returned 0xab4 [0048.811] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0048.811] GetCurrentThreadId () returned 0xab4 [0048.811] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0048.827] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.893] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0048.966] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0048.966] GetCurrentThreadId () returned 0xab4 [0048.966] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0048.966] GetCurrentThreadId () returned 0xab4 [0048.966] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0048.983] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.086] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.139] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0049.139] GetCurrentThreadId () returned 0xab4 [0049.139] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0049.139] GetCurrentThreadId () returned 0xab4 [0049.139] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0049.244] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.341] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.416] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0049.416] GetCurrentThreadId () returned 0xab4 [0049.416] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0049.416] GetCurrentThreadId () returned 0xab4 [0049.416] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0049.442] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.497] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.583] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0049.590] GetCurrentThreadId () returned 0xab4 [0049.590] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0049.590] GetCurrentThreadId () returned 0xab4 [0049.590] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0049.606] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.655] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.716] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0049.731] GetCurrentThreadId () returned 0xab4 [0049.731] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0049.731] GetCurrentThreadId () returned 0xab4 [0049.731] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0049.748] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.862] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0049.923] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0049.923] GetCurrentThreadId () returned 0xab4 [0049.923] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0049.924] GetCurrentThreadId () returned 0xab4 [0049.924] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0049.939] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.012] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.106] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0050.106] GetCurrentThreadId () returned 0xab4 [0050.106] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0050.106] GetCurrentThreadId () returned 0xab4 [0050.106] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0050.122] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.196] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.260] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0050.260] GetCurrentThreadId () returned 0xab4 [0050.292] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0050.292] GetCurrentThreadId () returned 0xab4 [0050.292] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0050.309] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.526] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.605] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0050.605] GetCurrentThreadId () returned 0xab4 [0050.605] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0050.605] GetCurrentThreadId () returned 0xab4 [0050.605] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0050.622] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.715] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.807] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0050.807] GetCurrentThreadId () returned 0xab4 [0050.807] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0050.807] GetCurrentThreadId () returned 0xab4 [0050.807] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0050.808] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.870] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0050.963] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0050.963] GetCurrentThreadId () returned 0xab4 [0050.963] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0050.963] GetCurrentThreadId () returned 0xab4 [0050.963] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0050.980] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0051.125] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0051.227] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0051.227] GetCurrentThreadId () returned 0xab4 [0051.227] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0051.227] GetCurrentThreadId () returned 0xab4 [0051.228] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0051.251] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0051.338] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0051.432] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0051.432] GetCurrentThreadId () returned 0xab4 [0051.432] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0051.432] GetCurrentThreadId () returned 0xab4 [0051.432] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0051.448] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0051.570] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0051.674] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0051.674] GetCurrentThreadId () returned 0xab4 [0051.674] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0051.674] GetCurrentThreadId () returned 0xab4 [0051.674] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0051.692] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0051.775] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0051.872] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0051.872] GetCurrentThreadId () returned 0xab4 [0051.872] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0051.872] GetCurrentThreadId () returned 0xab4 [0051.872] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0051.888] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0051.996] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.062] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0052.062] GetCurrentThreadId () returned 0xab4 [0052.062] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0052.062] GetCurrentThreadId () returned 0xab4 [0052.062] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0052.078] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.136] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.206] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0052.207] GetCurrentThreadId () returned 0xab4 [0052.207] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0052.207] GetCurrentThreadId () returned 0xab4 [0052.207] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0052.222] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.289] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.388] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0052.388] GetCurrentThreadId () returned 0xab4 [0052.388] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0052.388] GetCurrentThreadId () returned 0xab4 [0052.389] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0052.420] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.519] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.571] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0052.571] GetCurrentThreadId () returned 0xab4 [0052.571] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0052.571] GetCurrentThreadId () returned 0xab4 [0052.571] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0052.587] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.663] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.773] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0052.773] GetCurrentThreadId () returned 0xab4 [0052.773] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0052.773] GetCurrentThreadId () returned 0xab4 [0052.773] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0052.790] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.852] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0052.930] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0052.930] GetCurrentThreadId () returned 0xab4 [0052.930] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0052.930] GetCurrentThreadId () returned 0xab4 [0052.930] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0052.946] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0053.053] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0053.179] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0053.179] GetCurrentThreadId () returned 0xab4 [0053.179] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0053.179] GetCurrentThreadId () returned 0xab4 [0053.179] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0053.198] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0053.288] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0053.421] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0053.421] GetCurrentThreadId () returned 0xab4 [0053.421] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0053.421] GetCurrentThreadId () returned 0xab4 [0053.421] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0053.437] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0053.491] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0053.590] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0053.590] GetCurrentThreadId () returned 0xab4 [0053.590] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0053.590] GetCurrentThreadId () returned 0xab4 [0053.590] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0053.607] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0053.690] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0053.771] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0053.771] GetCurrentThreadId () returned 0xab4 [0053.771] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0053.771] GetCurrentThreadId () returned 0xab4 [0053.771] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0053.787] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0053.876] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.005] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0054.005] GetCurrentThreadId () returned 0xab4 [0054.005] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0054.005] GetCurrentThreadId () returned 0xab4 [0054.005] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0054.023] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.114] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.208] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0054.208] GetCurrentThreadId () returned 0xab4 [0054.208] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0054.208] GetCurrentThreadId () returned 0xab4 [0054.208] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0054.224] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.348] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.442] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0054.442] GetCurrentThreadId () returned 0xab4 [0054.442] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0054.442] GetCurrentThreadId () returned 0xab4 [0054.442] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0054.459] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.597] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.679] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0054.679] GetCurrentThreadId () returned 0xab4 [0054.679] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0054.679] GetCurrentThreadId () returned 0xab4 [0054.679] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0054.695] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.770] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.863] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0054.863] GetCurrentThreadId () returned 0xab4 [0054.863] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0054.863] GetCurrentThreadId () returned 0xab4 [0054.863] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0054.880] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0054.941] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0055.012] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0055.012] GetCurrentThreadId () returned 0xab4 [0055.012] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0055.012] GetCurrentThreadId () returned 0xab4 [0055.012] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0055.082] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0055.175] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0055.315] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0055.316] GetCurrentThreadId () returned 0xab4 [0055.316] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0055.316] GetCurrentThreadId () returned 0xab4 [0055.316] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0055.337] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0055.425] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0055.518] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0055.518] GetCurrentThreadId () returned 0xab4 [0055.518] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0055.518] GetCurrentThreadId () returned 0xab4 [0055.518] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0055.535] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0055.674] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0055.796] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0055.797] GetCurrentThreadId () returned 0xab4 [0055.797] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0055.797] GetCurrentThreadId () returned 0xab4 [0055.797] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0055.832] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0055.908] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0055.985] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0055.985] GetCurrentThreadId () returned 0xab4 [0055.985] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0055.985] GetCurrentThreadId () returned 0xab4 [0055.985] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0056.002] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0056.098] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0056.258] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0056.258] GetCurrentThreadId () returned 0xab4 [0056.258] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0056.258] GetCurrentThreadId () returned 0xab4 [0056.258] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0056.275] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0056.353] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0056.423] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0056.423] GetCurrentThreadId () returned 0xab4 [0056.423] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0056.423] GetCurrentThreadId () returned 0xab4 [0056.423] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0056.439] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0056.579] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0056.685] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0056.685] GetCurrentThreadId () returned 0xab4 [0056.685] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0056.685] GetCurrentThreadId () returned 0xab4 [0056.685] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0056.701] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0056.785] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0056.876] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0056.876] GetCurrentThreadId () returned 0xab4 [0056.876] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0056.876] GetCurrentThreadId () returned 0xab4 [0056.876] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0056.893] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.000] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.062] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0057.062] GetCurrentThreadId () returned 0xab4 [0057.062] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0057.062] GetCurrentThreadId () returned 0xab4 [0057.062] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0057.086] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.172] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.258] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0057.258] GetCurrentThreadId () returned 0xab4 [0057.258] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0057.258] GetCurrentThreadId () returned 0xab4 [0057.258] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0057.276] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.371] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.453] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0057.453] GetCurrentThreadId () returned 0xab4 [0057.453] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0057.453] GetCurrentThreadId () returned 0xab4 [0057.453] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0057.469] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.579] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.655] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0057.655] GetCurrentThreadId () returned 0xab4 [0057.656] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0057.656] GetCurrentThreadId () returned 0xab4 [0057.656] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0057.672] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.765] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.890] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0057.890] GetCurrentThreadId () returned 0xab4 [0057.890] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0057.890] GetCurrentThreadId () returned 0xab4 [0057.890] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0057.908] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0057.999] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0058.108] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0058.108] GetCurrentThreadId () returned 0xab4 [0058.108] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0058.108] GetCurrentThreadId () returned 0xab4 [0058.108] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0058.125] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0058.248] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0058.335] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0058.335] GetCurrentThreadId () returned 0xab4 [0058.335] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0058.335] GetCurrentThreadId () returned 0xab4 [0058.335] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0058.351] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0058.404] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0058.521] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0058.521] GetCurrentThreadId () returned 0xab4 [0058.522] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0058.522] GetCurrentThreadId () returned 0xab4 [0058.522] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0058.539] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0058.592] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0058.670] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0058.670] GetCurrentThreadId () returned 0xab4 [0058.671] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0058.671] GetCurrentThreadId () returned 0xab4 [0058.671] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0058.687] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0058.864] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0058.982] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0058.982] GetCurrentThreadId () returned 0xab4 [0058.982] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0058.982] GetCurrentThreadId () returned 0xab4 [0058.982] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0059.002] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.068] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.131] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0059.131] GetCurrentThreadId () returned 0xab4 [0059.131] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0059.131] GetCurrentThreadId () returned 0xab4 [0059.131] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0059.149] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.202] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.278] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0059.278] GetCurrentThreadId () returned 0xab4 [0059.278] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0059.278] GetCurrentThreadId () returned 0xab4 [0059.278] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0059.295] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.340] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.404] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0059.404] GetCurrentThreadId () returned 0xab4 [0059.404] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0059.404] GetCurrentThreadId () returned 0xab4 [0059.404] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0059.421] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.497] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.595] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0059.596] GetCurrentThreadId () returned 0xab4 [0059.596] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0059.596] GetCurrentThreadId () returned 0xab4 [0059.596] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0059.613] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.679] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.746] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0059.746] GetCurrentThreadId () returned 0xab4 [0059.746] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0059.746] GetCurrentThreadId () returned 0xab4 [0059.746] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0059.763] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.862] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0059.918] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0059.926] GetCurrentThreadId () returned 0xab4 [0059.926] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0059.926] GetCurrentThreadId () returned 0xab4 [0059.926] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0059.966] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0060.065] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0060.214] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0060.214] GetCurrentThreadId () returned 0xab4 [0060.214] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0060.214] GetCurrentThreadId () returned 0xab4 [0060.214] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0060.231] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0060.321] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0060.370] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0060.370] GetCurrentThreadId () returned 0xab4 [0060.370] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0060.370] GetCurrentThreadId () returned 0xab4 [0060.370] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0060.387] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0060.448] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0060.526] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0060.526] GetCurrentThreadId () returned 0xab4 [0060.526] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0060.526] GetCurrentThreadId () returned 0xab4 [0060.526] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0060.543] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0060.635] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0060.756] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0060.756] GetCurrentThreadId () returned 0xab4 [0060.756] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0060.756] GetCurrentThreadId () returned 0xab4 [0060.756] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0060.774] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0060.891] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.044] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0061.044] GetCurrentThreadId () returned 0xab4 [0061.044] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0061.044] GetCurrentThreadId () returned 0xab4 [0061.044] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0061.069] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.125] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.212] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0061.212] GetCurrentThreadId () returned 0xab4 [0061.212] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0061.212] GetCurrentThreadId () returned 0xab4 [0061.212] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0061.230] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.302] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.356] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0061.356] GetCurrentThreadId () returned 0xab4 [0061.356] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0061.356] GetCurrentThreadId () returned 0xab4 [0061.356] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0061.373] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.431] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.496] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0061.496] GetCurrentThreadId () returned 0xab4 [0061.496] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0061.496] GetCurrentThreadId () returned 0xab4 [0061.496] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0061.513] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.594] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.694] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0061.694] GetCurrentThreadId () returned 0xab4 [0061.694] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0061.694] GetCurrentThreadId () returned 0xab4 [0061.694] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0061.744] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.826] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0061.886] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0061.886] GetCurrentThreadId () returned 0xab4 [0061.886] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0061.886] GetCurrentThreadId () returned 0xab4 [0061.886] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0061.930] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0062.030] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0062.088] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0062.088] GetCurrentThreadId () returned 0xab4 [0062.088] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0062.088] GetCurrentThreadId () returned 0xab4 [0062.088] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0062.108] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0062.179] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0062.294] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0062.294] GetCurrentThreadId () returned 0xab4 [0062.294] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0062.321] GetCurrentThreadId () returned 0xab4 [0062.321] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0062.338] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0062.429] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0062.556] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0062.556] GetCurrentThreadId () returned 0xab4 [0062.556] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0062.556] GetCurrentThreadId () returned 0xab4 [0062.556] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0062.576] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0062.648] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0062.868] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0062.868] GetCurrentThreadId () returned 0xab4 [0062.868] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0062.868] GetCurrentThreadId () returned 0xab4 [0062.868] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0062.886] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0062.991] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.053] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0063.053] GetCurrentThreadId () returned 0xab4 [0063.053] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0063.053] GetCurrentThreadId () returned 0xab4 [0063.053] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0063.077] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.142] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.225] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0063.225] GetCurrentThreadId () returned 0xab4 [0063.225] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0063.225] GetCurrentThreadId () returned 0xab4 [0063.225] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0063.241] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.335] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.428] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0063.428] GetCurrentThreadId () returned 0xab4 [0063.428] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0063.428] GetCurrentThreadId () returned 0xab4 [0063.428] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0063.448] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.512] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.584] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0063.584] GetCurrentThreadId () returned 0xab4 [0063.584] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0063.584] GetCurrentThreadId () returned 0xab4 [0063.584] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0063.601] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.693] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.791] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0063.801] GetCurrentThreadId () returned 0xab4 [0063.801] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0063.801] GetCurrentThreadId () returned 0xab4 [0063.801] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0063.833] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0063.914] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.025] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0064.025] GetCurrentThreadId () returned 0xab4 [0064.025] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0064.025] GetCurrentThreadId () returned 0xab4 [0064.025] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0064.042] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.102] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.273] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0064.286] GetCurrentThreadId () returned 0xab4 [0064.286] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0064.286] GetCurrentThreadId () returned 0xab4 [0064.286] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0064.302] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.395] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.458] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0064.460] GetCurrentThreadId () returned 0xab4 [0064.463] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0064.465] GetCurrentThreadId () returned 0xab4 [0064.467] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0064.485] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.541] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.613] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0064.614] GetCurrentThreadId () returned 0xab4 [0064.614] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0064.614] GetCurrentThreadId () returned 0xab4 [0064.614] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0064.615] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.787] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.864] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0064.864] GetCurrentThreadId () returned 0xab4 [0064.864] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0064.864] GetCurrentThreadId () returned 0xab4 [0064.864] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0064.881] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0064.966] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.050] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0065.050] GetCurrentThreadId () returned 0xab4 [0065.050] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0065.050] GetCurrentThreadId () returned 0xab4 [0065.050] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0065.077] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.167] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.250] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0065.250] GetCurrentThreadId () returned 0xab4 [0065.250] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0065.250] GetCurrentThreadId () returned 0xab4 [0065.251] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0065.267] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.344] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.424] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0065.424] GetCurrentThreadId () returned 0xab4 [0065.424] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0065.424] GetCurrentThreadId () returned 0xab4 [0065.424] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0065.445] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.506] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.583] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0065.583] GetCurrentThreadId () returned 0xab4 [0065.583] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0065.583] GetCurrentThreadId () returned 0xab4 [0065.584] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0065.600] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.687] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.736] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0065.737] GetCurrentThreadId () returned 0xab4 [0065.737] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0065.737] GetCurrentThreadId () returned 0xab4 [0065.737] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0065.755] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.846] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0065.913] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0065.913] GetCurrentThreadId () returned 0xab4 [0065.913] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0065.913] GetCurrentThreadId () returned 0xab4 [0065.913] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0065.954] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0066.049] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0066.111] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0066.111] GetCurrentThreadId () returned 0xab4 [0066.111] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0066.111] GetCurrentThreadId () returned 0xab4 [0066.111] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0066.113] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0066.188] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0066.329] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0066.329] GetCurrentThreadId () returned 0xab4 [0066.329] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0066.329] GetCurrentThreadId () returned 0xab4 [0066.329] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0066.346] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0066.446] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0066.563] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0066.563] GetCurrentThreadId () returned 0xab4 [0066.563] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0066.563] GetCurrentThreadId () returned 0xab4 [0066.563] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0066.580] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0066.665] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0066.819] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0066.819] GetCurrentThreadId () returned 0xab4 [0066.819] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0066.819] GetCurrentThreadId () returned 0xab4 [0066.819] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0066.836] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0066.906] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.000] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0067.000] GetCurrentThreadId () returned 0xab4 [0067.000] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0067.000] GetCurrentThreadId () returned 0xab4 [0067.000] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0067.017] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.125] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.191] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0067.191] GetCurrentThreadId () returned 0xab4 [0067.191] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0067.191] GetCurrentThreadId () returned 0xab4 [0067.191] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0067.208] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.285] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.403] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0067.403] GetCurrentThreadId () returned 0xab4 [0067.403] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0067.403] GetCurrentThreadId () returned 0xab4 [0067.403] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0067.420] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.497] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.608] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0067.608] GetCurrentThreadId () returned 0xab4 [0067.608] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0067.608] GetCurrentThreadId () returned 0xab4 [0067.608] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0067.608] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.717] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.811] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0067.811] GetCurrentThreadId () returned 0xab4 [0067.812] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0067.812] GetCurrentThreadId () returned 0xab4 [0067.812] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0067.828] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.921] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0067.986] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0067.986] GetCurrentThreadId () returned 0xab4 [0067.986] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0067.986] GetCurrentThreadId () returned 0xab4 [0067.994] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0068.030] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0068.101] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0068.186] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0068.186] GetCurrentThreadId () returned 0xab4 [0068.186] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0068.186] GetCurrentThreadId () returned 0xab4 [0068.186] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0068.202] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0068.279] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0068.352] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0068.353] GetCurrentThreadId () returned 0xab4 [0068.353] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0068.353] GetCurrentThreadId () returned 0xab4 [0068.353] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0068.371] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0068.483] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0068.544] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0068.544] GetCurrentThreadId () returned 0xab4 [0068.544] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0068.545] GetCurrentThreadId () returned 0xab4 [0068.545] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0068.565] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0068.685] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0068.872] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0068.872] GetCurrentThreadId () returned 0xab4 [0068.873] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0068.873] GetCurrentThreadId () returned 0xab4 [0068.873] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0068.891] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0068.969] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.060] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0069.060] GetCurrentThreadId () returned 0xab4 [0069.060] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0069.060] GetCurrentThreadId () returned 0xab4 [0069.060] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0069.089] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.154] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.278] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0069.278] GetCurrentThreadId () returned 0xab4 [0069.278] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0069.278] GetCurrentThreadId () returned 0xab4 [0069.278] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0069.301] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.387] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.575] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0069.576] GetCurrentThreadId () returned 0xab4 [0069.576] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0069.576] GetCurrentThreadId () returned 0xab4 [0069.576] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0069.593] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.661] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.730] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0069.730] GetCurrentThreadId () returned 0xab4 [0069.730] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0069.730] GetCurrentThreadId () returned 0xab4 [0069.730] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0069.747] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.815] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.871] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0069.871] GetCurrentThreadId () returned 0xab4 [0069.871] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0069.871] GetCurrentThreadId () returned 0xab4 [0069.871] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0069.888] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0069.962] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.060] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0070.060] GetCurrentThreadId () returned 0xab4 [0070.060] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0070.060] GetCurrentThreadId () returned 0xab4 [0070.060] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0070.104] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.167] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.229] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0070.229] GetCurrentThreadId () returned 0xab4 [0070.229] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0070.229] GetCurrentThreadId () returned 0xab4 [0070.230] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0070.246] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.308] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.370] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0070.370] GetCurrentThreadId () returned 0xab4 [0070.370] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0070.370] GetCurrentThreadId () returned 0xab4 [0070.370] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0070.386] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.448] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.510] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0070.510] GetCurrentThreadId () returned 0xab4 [0070.510] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0070.510] GetCurrentThreadId () returned 0xab4 [0070.510] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0070.525] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.572] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.640] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0070.640] GetCurrentThreadId () returned 0xab4 [0070.640] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0070.640] GetCurrentThreadId () returned 0xab4 [0070.640] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0070.655] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.713] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.775] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0070.775] GetCurrentThreadId () returned 0xab4 [0070.775] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0070.775] GetCurrentThreadId () returned 0xab4 [0070.776] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0070.789] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0070.838] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0071.065] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0071.065] GetCurrentThreadId () returned 0xab4 [0071.065] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0071.065] GetCurrentThreadId () returned 0xab4 [0071.065] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0071.093] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0071.198] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0071.339] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0071.340] GetCurrentThreadId () returned 0xab4 [0071.340] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0071.340] GetCurrentThreadId () returned 0xab4 [0071.340] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0071.356] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0071.456] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0071.632] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0071.842] GetCurrentThreadId () returned 0xab4 [0072.243] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0072.243] GetCurrentThreadId () returned 0xab4 [0072.257] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0072.279] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0072.386] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0072.878] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0072.878] GetCurrentThreadId () returned 0xab4 [0072.878] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0072.878] GetCurrentThreadId () returned 0xab4 [0072.878] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0072.878] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0073.232] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0073.430] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0073.430] GetCurrentThreadId () returned 0xab4 [0073.430] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0073.430] GetCurrentThreadId () returned 0xab4 [0073.430] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0073.443] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0073.523] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0073.583] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0073.583] GetCurrentThreadId () returned 0xab4 [0073.583] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0073.583] GetCurrentThreadId () returned 0xab4 [0073.583] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0073.584] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0073.651] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0073.708] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0073.708] GetCurrentThreadId () returned 0xab4 [0073.708] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0073.708] GetCurrentThreadId () returned 0xab4 [0073.708] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0073.708] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0073.828] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0073.911] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0073.911] GetCurrentThreadId () returned 0xab4 [0073.911] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0073.911] GetCurrentThreadId () returned 0xab4 [0073.911] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0073.912] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.008] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.098] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0074.098] GetCurrentThreadId () returned 0xab4 [0074.098] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0074.098] GetCurrentThreadId () returned 0xab4 [0074.098] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0074.099] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.207] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.311] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0074.312] GetCurrentThreadId () returned 0xab4 [0074.312] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0074.312] GetCurrentThreadId () returned 0xab4 [0074.312] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0074.313] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.394] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.473] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0074.473] GetCurrentThreadId () returned 0xab4 [0074.473] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0074.473] GetCurrentThreadId () returned 0xab4 [0074.473] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0074.474] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.555] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.613] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0074.613] GetCurrentThreadId () returned 0xab4 [0074.613] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0074.613] GetCurrentThreadId () returned 0xab4 [0074.613] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0074.614] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.677] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.815] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0074.815] GetCurrentThreadId () returned 0xab4 [0074.815] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0074.815] GetCurrentThreadId () returned 0xab4 [0074.815] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0074.816] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0074.921] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.050] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0075.050] GetCurrentThreadId () returned 0xab4 [0075.050] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0075.050] GetCurrentThreadId () returned 0xab4 [0075.050] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0075.051] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.145] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.206] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0075.206] GetCurrentThreadId () returned 0xab4 [0075.206] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0075.206] GetCurrentThreadId () returned 0xab4 [0075.206] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0075.207] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.293] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.408] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0075.408] GetCurrentThreadId () returned 0xab4 [0075.408] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0075.408] GetCurrentThreadId () returned 0xab4 [0075.408] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0075.409] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.502] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.595] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0075.595] GetCurrentThreadId () returned 0xab4 [0075.596] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0075.596] GetCurrentThreadId () returned 0xab4 [0075.596] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0075.596] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.689] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.783] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0075.783] GetCurrentThreadId () returned 0xab4 [0075.783] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0075.783] GetCurrentThreadId () returned 0xab4 [0075.783] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0075.784] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0075.876] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.001] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0076.001] GetCurrentThreadId () returned 0xab4 [0076.001] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0076.001] GetCurrentThreadId () returned 0xab4 [0076.001] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0076.002] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.080] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.173] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0076.173] GetCurrentThreadId () returned 0xab4 [0076.173] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0076.173] GetCurrentThreadId () returned 0xab4 [0076.173] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0076.174] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.252] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.360] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0076.360] GetCurrentThreadId () returned 0xab4 [0076.360] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0076.360] GetCurrentThreadId () returned 0xab4 [0076.360] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0076.361] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.469] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.551] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0076.551] GetCurrentThreadId () returned 0xab4 [0076.551] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0076.551] GetCurrentThreadId () returned 0xab4 [0076.551] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0076.552] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.610] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.734] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0076.734] GetCurrentThreadId () returned 0xab4 [0076.734] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0076.735] GetCurrentThreadId () returned 0xab4 [0076.735] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0076.736] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.823] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0076.993] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0076.993] GetCurrentThreadId () returned 0xab4 [0076.993] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0076.993] GetCurrentThreadId () returned 0xab4 [0076.993] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0076.994] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.078] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.202] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0077.202] GetCurrentThreadId () returned 0xab4 [0077.202] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0077.202] GetCurrentThreadId () returned 0xab4 [0077.202] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0077.203] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.312] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.391] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0077.391] GetCurrentThreadId () returned 0xab4 [0077.391] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0077.391] GetCurrentThreadId () returned 0xab4 [0077.391] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0077.392] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.483] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.577] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0077.577] GetCurrentThreadId () returned 0xab4 [0077.577] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0077.577] GetCurrentThreadId () returned 0xab4 [0077.577] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0077.578] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.639] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.704] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0077.704] GetCurrentThreadId () returned 0xab4 [0077.704] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0077.704] GetCurrentThreadId () returned 0xab4 [0077.704] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0077.705] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.795] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.889] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0077.889] GetCurrentThreadId () returned 0xab4 [0077.889] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0077.889] GetCurrentThreadId () returned 0xab4 [0077.889] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0077.890] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0077.982] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0078.076] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0078.076] GetCurrentThreadId () returned 0xab4 [0078.076] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0078.076] GetCurrentThreadId () returned 0xab4 [0078.076] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0078.077] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0078.170] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0078.273] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0078.273] GetCurrentThreadId () returned 0xab4 [0078.273] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0078.273] GetCurrentThreadId () returned 0xab4 [0078.273] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0078.274] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0078.357] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0078.513] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0078.513] GetCurrentThreadId () returned 0xab4 [0078.513] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0078.513] GetCurrentThreadId () returned 0xab4 [0078.513] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0078.514] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0078.607] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0078.749] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0078.749] GetCurrentThreadId () returned 0xab4 [0078.749] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0078.749] GetCurrentThreadId () returned 0xab4 [0078.749] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0078.750] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0078.840] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.031] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0079.031] GetCurrentThreadId () returned 0xab4 [0079.031] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0079.032] GetCurrentThreadId () returned 0xab4 [0079.032] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0079.032] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.121] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.196] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0079.196] GetCurrentThreadId () returned 0xab4 [0079.196] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0079.196] GetCurrentThreadId () returned 0xab4 [0079.196] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0079.197] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.261] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.308] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0079.308] GetCurrentThreadId () returned 0xab4 [0079.308] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0079.309] GetCurrentThreadId () returned 0xab4 [0079.309] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0079.309] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.372] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.433] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0079.433] GetCurrentThreadId () returned 0xab4 [0079.433] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0079.433] GetCurrentThreadId () returned 0xab4 [0079.433] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0079.434] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.527] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.620] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0079.620] GetCurrentThreadId () returned 0xab4 [0079.620] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0079.620] GetCurrentThreadId () returned 0xab4 [0079.620] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0079.621] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.730] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.823] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0079.823] GetCurrentThreadId () returned 0xab4 [0079.823] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0079.823] GetCurrentThreadId () returned 0xab4 [0079.823] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0079.824] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.918] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0079.986] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0079.986] GetCurrentThreadId () returned 0xab4 [0079.986] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0079.986] GetCurrentThreadId () returned 0xab4 [0079.986] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0079.987] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.041] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.132] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0080.132] GetCurrentThreadId () returned 0xab4 [0080.132] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0080.132] GetCurrentThreadId () returned 0xab4 [0080.132] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0080.133] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.184] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.270] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0080.270] GetCurrentThreadId () returned 0xab4 [0080.270] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0080.270] GetCurrentThreadId () returned 0xab4 [0080.270] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0080.271] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.354] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.494] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0080.494] GetCurrentThreadId () returned 0xab4 [0080.494] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0080.494] GetCurrentThreadId () returned 0xab4 [0080.494] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0080.495] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.587] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.682] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0080.682] GetCurrentThreadId () returned 0xab4 [0080.682] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0080.682] GetCurrentThreadId () returned 0xab4 [0080.682] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0080.682] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.761] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.837] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0080.837] GetCurrentThreadId () returned 0xab4 [0080.837] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0080.837] GetCurrentThreadId () returned 0xab4 [0080.837] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0080.838] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0080.949] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.044] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0081.044] GetCurrentThreadId () returned 0xab4 [0081.044] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0081.045] GetCurrentThreadId () returned 0xab4 [0081.045] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0081.045] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.103] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.196] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0081.196] GetCurrentThreadId () returned 0xab4 [0081.196] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0081.196] GetCurrentThreadId () returned 0xab4 [0081.196] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0081.197] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.290] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.369] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0081.369] GetCurrentThreadId () returned 0xab4 [0081.369] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0081.369] GetCurrentThreadId () returned 0xab4 [0081.369] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0081.370] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.492] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.586] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0081.586] GetCurrentThreadId () returned 0xab4 [0081.586] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0081.586] GetCurrentThreadId () returned 0xab4 [0081.586] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0081.587] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.679] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.759] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0081.759] GetCurrentThreadId () returned 0xab4 [0081.759] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0081.759] GetCurrentThreadId () returned 0xab4 [0081.759] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0081.760] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.851] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0081.945] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0081.945] GetCurrentThreadId () returned 0xab4 [0081.945] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0081.945] GetCurrentThreadId () returned 0xab4 [0081.945] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0081.946] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0082.036] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0082.116] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0082.116] GetCurrentThreadId () returned 0xab4 [0082.116] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0082.116] GetCurrentThreadId () returned 0xab4 [0082.116] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0082.117] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0082.196] SleepEx (dwMilliseconds=0x32, bAlertable=1) returned 0x0 [0082.343] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf388 | out: lpdwProcessId=0x1c7cf388) returned 0xa28 [0082.343] GetCurrentThreadId () returned 0xab4 [0082.343] GetWindowThreadProcessId (in: hWnd=0x3015e, lpdwProcessId=0x1c7cf2e0 | out: lpdwProcessId=0x1c7cf2e0) returned 0xa28 [0082.343] GetCurrentThreadId () returned 0xab4 [0082.343] PostMessageW (hWnd=0x3015e, Msg=0xc122, wParam=0x0, lParam=0x0) returned 1 [0082.344] SleepEx (dwMilliseconds=0x32, bAlertable=1) Thread: id = 7 os_tid = 0x7cc [0036.351] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0036.352] CoTaskMemAlloc (cb=0xa5) returned 0x1a7c6f50 [0036.368] CoTaskMemAlloc (cb=0x16) returned 0x1a7e2c60 [0036.410] CoTaskMemAlloc (cb=0xf) returned 0x1a7e2c80 [0036.471] SleepEx (dwMilliseconds=0x41d0, bAlertable=1) returned 0x0 [0046.487] CoTaskMemAlloc (cb=0x54b) returned 0x1a7ea0c0 [0046.794] CoTaskMemAlloc (cb=0x11) returned 0x1a7e2d20 [0046.797] CoTaskMemAlloc (cb=0xb) returned 0x1a7e2de0 [0046.801] CoTaskMemAlloc (cb=0xbf) returned 0x1a7c87d0 [0046.820] CoTaskMemAlloc (cb=0x16) returned 0x1a7e2e20 [0046.827] CoTaskMemAlloc (cb=0x12) returned 0x1a7e2ec0 [0046.830] CoTaskMemAlloc (cb=0xb) returned 0x1a7e2ea0 [0046.832] CoTaskMemAlloc (cb=0x3e7) returned 0x1a7e97e0 [0046.932] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c9aeea8 | out: phkResult=0x1c9aeea8*=0x278) returned 0x0 [0046.933] CoTaskMemAlloc (cb=0x12) returned 0x1a7e2fe0 [0046.934] RegQueryValueExW (in: hKey=0x278, lpValueName="ProductName", lpReserved=0x0, lpType=0x1c9aeec8, lpData=0x0, lpcbData=0x1c9aeec0*=0x0 | out: lpType=0x1c9aeec8*=0x1, lpData=0x0, lpcbData=0x1c9aeec0*=0x2e) returned 0x0 [0046.935] RegQueryValueExW (in: hKey=0x278, lpValueName="ProductName", lpReserved=0x0, lpType=0x1c9aeec8, lpData=0x280ed80, lpcbData=0x1c9aeec0*=0x2e | out: lpType=0x1c9aeec8*=0x1, lpData="Windows 7 Professional", lpcbData=0x1c9aeec0*=0x2e) returned 0x0 [0046.935] RegCloseKey (hKey=0x278) returned 0x0 [0046.935] GetCurrentProcessId () returned 0xa18 [0046.935] CoTaskMemAlloc (cb=0xe) returned 0x1a7e3000 [0046.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aef50 | out: SystemInformation=0x12641930, ResultLength=0x1c9aef50*=0x11120) returned 0x0 [0046.965] CoTaskMemAlloc (cb=0xf) returned 0x1a7e3020 [0047.075] CoTaskMemAlloc (cb=0x18b) returned 0x1a7e6dd0 [0047.121] CoTaskMemAlloc (cb=0x12) returned 0x1a7e3080 [0047.126] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1c9aedd8 | out: phkResult=0x1c9aedd8*=0x0) returned 0x2 [0047.127] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1c9aee30, lpdwDisposition=0x1c9aef18 | out: phkResult=0x1c9aee30*=0x284, lpdwDisposition=0x1c9aef18*=0x1) returned 0x0 [0047.127] CoTaskMemAlloc (cb=0x16) returned 0x1a7e30a0 [0047.133] RegQueryValueExW (in: hKey=0x284, lpValueName="DisableTaskMgr", lpReserved=0x0, lpType=0x1c9aeee8, lpData=0x0, lpcbData=0x1c9aeee0*=0x0 | out: lpType=0x1c9aeee8*=0x0, lpData=0x0, lpcbData=0x1c9aeee0*=0x0) returned 0x2 [0047.133] RegSetValueExW (in: hKey=0x284, lpValueName="DisableTaskMgr", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0 [0047.133] RegCloseKey (hKey=0x284) returned 0x0 [0047.134] CoTaskMemAlloc (cb=0x22a) returned 0x1a821a70 [0047.183] CoTaskMemAlloc (cb=0x20c) returned 0x1a7939b0 [0047.183] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a7939b0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0047.183] CoTaskMemFree (pv=0x1a7939b0) [0047.183] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x1c9ae9e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0047.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1c9ae9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0047.184] CoTaskMemAlloc (cb=0xf) returned 0x1a7e30c0 [0047.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\backup\\", nBufferLength=0x105, lpBuffer=0x1c9ae9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\backup\\", lpFilePart=0x0) returned 0x38 [0047.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aee00) returned 1 [0047.186] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\backup\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\backup"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeee0 | out: lpFileInformation=0x1c9aeee0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0047.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aedc0) returned 1 [0047.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\", nBufferLength=0x105, lpBuffer=0x1c9aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\", lpFilePart=0x0) returned 0x37 [0047.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed50) returned 1 [0047.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aee30 | out: lpFileInformation=0x1c9aee30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0047.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aed10) returned 1 [0047.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed50) returned 1 [0047.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aee30 | out: lpFileInformation=0x1c9aee30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0047.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aed10) returned 1 [0047.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed50) returned 1 [0047.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x1c9aee30 | out: lpFileInformation=0x1c9aee30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb88f23e0, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xb88f23e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0047.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aed10) returned 1 [0047.188] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobe"), lpSecurityAttributes=0x0) returned 1 [0047.209] CoTaskMemAlloc (cb=0x12) returned 0x1a7e30e0 [0047.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\", nBufferLength=0x105, lpBuffer=0x1c9ae830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\", lpFilePart=0x0) returned 0x37 [0047.214] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\", dwFileAttributes=0x12) returned 1 [0047.214] CoTaskMemAlloc (cb=0xe) returned 0x1a7e3100 [0047.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", nBufferLength=0x105, lpBuffer=0x1c9ae830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpFilePart=0x0) returned 0x71 [0047.216] CoTaskMemAlloc (cb=0x13) returned 0x1a7e3120 [0047.218] CoTaskMemAlloc (cb=0x17) returned 0x1a7e3140 [0047.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", nBufferLength=0x105, lpBuffer=0x1c9ae980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpFilePart=0x0) returned 0x71 [0047.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", nBufferLength=0x105, lpBuffer=0x1c9ae980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpFilePart=0x0) returned 0x82 [0047.221] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobe\\us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe"), bFailIfExists=1) returned 1 [0047.232] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1c9aeda8 | out: phkResult=0x1c9aeda8*=0x288) returned 0x0 [0047.232] CoTaskMemAlloc (cb=0x20c) returned 0x1a7939b0 [0047.232] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a7939b0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0047.232] CoTaskMemFree (pv=0x1a7939b0) [0047.232] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x1c9ae9e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0047.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1c9ae9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0047.233] CoTaskMemAlloc (cb=0x17) returned 0x1a7e3160 [0047.235] RegQueryValueExW (in: hKey=0x288, lpValueName="US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpReserved=0x0, lpType=0x1c9aeee8, lpData=0x0, lpcbData=0x1c9aeee0*=0x0 | out: lpType=0x1c9aeee8*=0x0, lpData=0x0, lpcbData=0x1c9aeee0*=0x0) returned 0x2 [0047.236] RegSetValueExW (in: hKey=0x288, lpValueName="US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", cbData=0x106 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Adobe\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe") returned 0x0 [0047.236] CoTaskMemAlloc (cb=0xe) returned 0x1a7e3180 [0047.238] RegCloseKey (hKey=0x288) returned 0x0 [0047.238] CoTaskMemAlloc (cb=0xc8) returned 0x1a7c88a0 [0047.270] CoTaskMemAlloc (cb=0x1e) returned 0x1a7df790 [0047.274] CoTaskMemAlloc (cb=0x12) returned 0x1a7e31a0 [0047.276] CoTaskMemAlloc (cb=0x17) returned 0x1a7e31c0 [0047.278] CoTaskMemAlloc (cb=0x33) returned 0x1a7d57a0 [0047.293] CoTaskMemAlloc (cb=0x12) returned 0x1a7e31e0 [0047.318] CoTaskMemAlloc (cb=0xf) returned 0x1a7e3220 [0047.321] CoTaskMemAlloc (cb=0x16) returned 0x1a7e3200 [0047.324] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1c9aea90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0047.325] CoTaskMemAlloc (cb=0x489) returned 0x1a817520 [0047.412] CoTaskMemAlloc (cb=0xf) returned 0x1a7e3240 [0047.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aee30) returned 1 [0047.415] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1c9ae920, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0047.415] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1c9ae8c0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0047.417] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x1c9aead0 | out: lpFindFileData=0x1c9aead0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a8084e0 [0047.418] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0047.418] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0047.419] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0047.419] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0047.419] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0047.419] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0047.419] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0047.419] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0047.419] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0047.420] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0047.420] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0047.420] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0047.420] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0047.420] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0047.420] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0047.420] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0047.421] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0047.421] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0047.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aed80) returned 1 [0047.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aed40) returned 1 [0047.422] CoTaskMemAlloc (cb=0xf) returned 0x1a7e3260 [0047.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aee30) returned 1 [0047.424] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1c9ae920, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0047.424] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1c9ae8c0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0047.424] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x1c9aead0 | out: lpFindFileData=0x1c9aead0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1a8084e0 [0047.425] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0047.425] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0047.425] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0047.425] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0047.425] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0047.425] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0047.425] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0047.427] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0047.427] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aeb20 | out: lpFindFileData=0x1c9aeb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0047.427] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0047.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aed80) returned 1 [0047.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aed40) returned 1 [0047.427] CoTaskMemAlloc (cb=0x17) returned 0x1a7e3280 [0047.432] GetFullPathNameW (in: lpFileName="C:\\bootmgr", nBufferLength=0x105, lpBuffer=0x1c9ae8a0, lpFilePart=0x0 | out: lpBuffer="C:\\bootmgr", lpFilePart=0x0) returned 0xa [0047.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed80) returned 1 [0047.432] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x288 [0047.434] GetFileType (hFile=0x288) returned 0x1 [0047.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aecf0) returned 1 [0047.434] GetFileType (hFile=0x288) returned 0x1 [0047.435] CoTaskMemAlloc (cb=0xe) returned 0x1a7e32a0 [0047.436] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x1c9aef48 | out: lpFileSizeHigh=0x1c9aef48*=0x0) returned 0x5db2a [0047.436] CoTaskMemAlloc (cb=0x12) returned 0x1a7e32c0 [0047.438] SetFilePointer (in: hFile=0x288, lDistanceToMove=383776, lpDistanceToMoveHigh=0x1c9aeea8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeea8*=0) returned 0x5db20 [0047.439] CoTaskMemAlloc (cb=0x1a) returned 0x1a7df8e0 [0047.441] ReadFile (in: hFile=0x288, lpBuffer=0x26c99b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aee78, lpOverlapped=0x0 | out: lpBuffer=0x26c99b8*, lpNumberOfBytesRead=0x1c9aee78*=0xa, lpOverlapped=0x0) returned 1 [0047.443] CoTaskMemAlloc (cb=0x12) returned 0x1a7f7ac0 [0047.446] CloseHandle (hObject=0x288) returned 1 [0047.447] CoTaskMemAlloc (cb=0x2ff) returned 0x1a7dceb0 [0047.510] CoTaskMemAlloc (cb=0x48b) returned 0x1a8250a0 [0047.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeda0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeda0*=0x11120) returned 0x0 [0047.602] CoTaskMemAlloc (cb=0xe) returned 0x1a7f7ae0 [0047.610] GetFullPathNameW (in: lpFileName="C:\\bootmgr", nBufferLength=0x105, lpBuffer=0x1c9ae940, lpFilePart=0x0 | out: lpBuffer="C:\\bootmgr", lpFilePart=0x0) returned 0xa [0047.610] CoTaskMemAlloc (cb=0xe) returned 0x1a7f7b00 [0047.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0047.613] GetFileAttributesExW (in: lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), fInfoLevelId=0x0, lpFileInformation=0x27359d8 | out: lpFileInformation=0x27359d8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a)) returned 1 [0047.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aed50) returned 1 [0047.614] CoTaskMemAlloc (cb=0xf) returned 0x1a7f7b20 [0047.615] CoTaskMemAlloc (cb=0xf) returned 0x1a7f7b40 [0047.618] GetFullPathNameW (in: lpFileName="C:\\bootmgr", nBufferLength=0x105, lpBuffer=0x1c9ae770, lpFilePart=0x0 | out: lpBuffer="C:\\bootmgr", lpFilePart=0x0) returned 0xa [0047.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0047.618] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x288 [0047.618] GetFileType (hFile=0x288) returned 0x1 [0047.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebc0) returned 1 [0047.618] GetFileType (hFile=0x288) returned 0x1 [0047.618] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x1c9aede8 | out: lpFileSizeHigh=0x1c9aede8*=0x0) returned 0x5db2a [0047.619] ReadFile (in: hFile=0x288, lpBuffer=0x12661968, nNumberOfBytesToRead=0x5db2a, lpNumberOfBytesRead=0x1c9aed18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aed18*=0x5db2a, lpOverlapped=0x0) returned 1 [0047.626] CloseHandle (hObject=0x288) returned 1 [0047.626] CoTaskMemAlloc (cb=0xb) returned 0x1a7f7b60 [0047.664] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1c9ae5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0047.665] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1c9ae700, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0047.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0047.665] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec20 | out: lpFileInformation=0x1c9aec20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x279e2c00, ftCreationTime.dwHighDateTime=0x1cd5cf6, ftLastAccessTime.dwLowDateTime=0xcf7c84e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x279e2c00, ftLastWriteTime.dwHighDateTime=0x1cd5cf6, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0047.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0047.714] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x1c9ae5d0 | out: pfEnabled=0x1c9ae5d0) returned 0x0 [0047.715] CoTaskMemAlloc (cb=0x12) returned 0x1a7f7bc0 [0047.718] CoTaskMemAlloc (cb=0x1e1) returned 0x1a825d40 [0047.779] CoTaskMemAlloc (cb=0x13) returned 0x1a7f7be0 [0047.800] CoTaskMemAlloc (cb=0x12) returned 0x1a7f7c00 [0047.802] CoTaskMemAlloc (cb=0x12) returned 0x1a7f7c20 [0047.805] CoTaskMemAlloc (cb=0xe) returned 0x1a7f7cc0 [0047.840] CoTaskMemAlloc (cb=0x12) returned 0x1a7f7ce0 [0047.842] CoTaskMemAlloc (cb=0xe) returned 0x1a7f7d00 [0047.843] CoTaskMemAlloc (cb=0x12) returned 0x1a7f7d20 [0047.874] CoTaskMemAlloc (cb=0x12) returned 0x1a7f7d40 [0047.882] CoTaskMemAlloc (cb=0x1a) returned 0x1a8256f0 [0047.899] CoTaskMemAlloc (cb=0xe) returned 0x1a7f7d60 [0047.905] CoTaskMemAlloc (cb=0xe) returned 0x1a7f7d80 [0047.911] GetFullPathNameW (in: lpFileName="C:\\bootmgr", nBufferLength=0x105, lpBuffer=0x1c9ae7a0, lpFilePart=0x0 | out: lpBuffer="C:\\bootmgr", lpFilePart=0x0) returned 0xa [0047.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec80) returned 1 [0047.911] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0047.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab5c0) returned 1 [0047.936] GetFullPathNameW (in: lpFileName="C:\\BOOTSECT.BAK", nBufferLength=0x105, lpBuffer=0x1c9ae8a0, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTSECT.BAK", lpFilePart=0x0) returned 0xf [0047.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed80) returned 1 [0047.936] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0047.953] GetFileType (hFile=0x2a4) returned 0x1 [0047.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aecf0) returned 1 [0047.953] GetFileType (hFile=0x2a4) returned 0x1 [0047.953] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aef48 | out: lpFileSizeHigh=0x1c9aef48*=0x0) returned 0x2000 [0047.953] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=8182, lpDistanceToMoveHigh=0x1c9aeea8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeea8*=0) returned 0x1ff6 [0047.953] ReadFile (in: hFile=0x2a4, lpBuffer=0x27eee78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aee78, lpOverlapped=0x0 | out: lpBuffer=0x27eee78*, lpNumberOfBytesRead=0x1c9aee78*=0xa, lpOverlapped=0x0) returned 1 [0047.955] CloseHandle (hObject=0x2a4) returned 1 [0047.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeda0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeda0*=0x11120) returned 0x0 [0047.963] GetFullPathNameW (in: lpFileName="C:\\BOOTSECT.BAK", nBufferLength=0x105, lpBuffer=0x1c9ae940, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTSECT.BAK", lpFilePart=0x0) returned 0xf [0047.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0047.964] GetFileAttributesExW (in: lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), fInfoLevelId=0x0, lpFileInformation=0x28582b8 | out: lpFileInformation=0x28582b8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0047.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aed50) returned 1 [0047.964] GetFullPathNameW (in: lpFileName="C:\\BOOTSECT.BAK", nBufferLength=0x105, lpBuffer=0x1c9ae770, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTSECT.BAK", lpFilePart=0x0) returned 0xf [0047.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0047.964] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0047.964] GetFileType (hFile=0x2a4) returned 0x1 [0047.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebc0) returned 1 [0047.964] GetFileType (hFile=0x2a4) returned 0x1 [0047.964] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aede8 | out: lpFileSizeHigh=0x1c9aede8*=0x0) returned 0x2000 [0047.964] ReadFile (in: hFile=0x2a4, lpBuffer=0x2858490, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1c9aed18, lpOverlapped=0x0 | out: lpBuffer=0x2858490*, lpNumberOfBytesRead=0x1c9aed18*=0x2000, lpOverlapped=0x0) returned 1 [0047.965] CloseHandle (hObject=0x2a4) returned 1 [0048.045] GetFullPathNameW (in: lpFileName="C:\\BOOTSECT.BAK", nBufferLength=0x105, lpBuffer=0x1c9ae7a0, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTSECT.BAK", lpFilePart=0x0) returned 0xf [0048.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec80) returned 1 [0048.045] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab5c0) returned 1 [0048.048] GetFullPathNameW (in: lpFileName="C:\\hiberfil.sys", nBufferLength=0x105, lpBuffer=0x1c9ae8a0, lpFilePart=0x0 | out: lpBuffer="C:\\hiberfil.sys", lpFilePart=0x0) returned 0xf [0048.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed80) returned 1 [0048.048] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab6c0) returned 1 [0048.060] GetFullPathNameW (in: lpFileName="C:\\pagefile.sys", nBufferLength=0x105, lpBuffer=0x1c9ae8a0, lpFilePart=0x0 | out: lpBuffer="C:\\pagefile.sys", lpFilePart=0x0) returned 0xf [0048.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed80) returned 1 [0048.060] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab6c0) returned 1 [0048.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0048.063] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0048.063] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0048.063] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.063] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.064] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0048.064] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0048.064] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0048.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0048.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0048.065] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0048.065] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0048.065] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.065] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.065] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0048.065] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0048.065] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0048.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0048.066] CoTaskMemAlloc (cb=0x20e) returned 0x1a793e10 [0048.108] CoTaskMemAlloc (cb=0x1e) returned 0x1a825780 [0048.110] CoTaskMemAlloc (cb=0xb) returned 0x1a7f7c60 [0048.112] CoTaskMemAlloc (cb=0x16) returned 0x1a7f7c40 [0048.118] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\README_3728769.txt", lpFilePart=0x0) returned 0x22 [0048.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebf0) returned 1 [0048.118] CreateFileW (lpFileName="C:\\$Recycle.Bin\\README_3728769.txt" (normalized: "c:\\$recycle.bin\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2a4 [0048.137] GetFileType (hFile=0x2a4) returned 0x1 [0048.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0048.137] GetFileType (hFile=0x2a4) returned 0x1 [0048.138] WriteFile (in: hFile=0x2a4, lpBuffer=0x26e4ad0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aec38, lpOverlapped=0x0 | out: lpBuffer=0x26e4ad0*, lpNumberOfBytesWritten=0x1c9aec38*=0x5b3, lpOverlapped=0x0) returned 1 [0048.139] CloseHandle (hObject=0x2a4) returned 1 [0048.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0048.140] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0048.140] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0048.140] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.140] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.140] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0048.140] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0048.140] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0048.140] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0048.141] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0048.141] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0048.141] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0048.141] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0048.141] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0048.141] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0048.141] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0048.141] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0048.142] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0048.142] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0048.142] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0048.142] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0048.142] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0048.142] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0048.142] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0048.143] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0048.143] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0048.143] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0048.143] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0048.143] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0048.143] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0048.143] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0048.144] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0048.144] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0048.144] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0048.144] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0048.144] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0048.144] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0048.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0048.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0048.145] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0048.145] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0048.145] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.145] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.145] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0048.146] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0048.146] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0048.146] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0048.146] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0048.146] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0048.146] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0048.146] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0048.146] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0048.149] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0048.149] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0048.149] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0048.149] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0048.149] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0048.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0048.149] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD", lpFilePart=0x0) returned 0xb [0048.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aece0) returned 1 [0048.149] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab620) returned 1 [0048.151] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG", lpFilePart=0x0) returned 0xf [0048.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aece0) returned 1 [0048.151] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab620) returned 1 [0048.153] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG1", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG1", lpFilePart=0x0) returned 0x10 [0048.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aece0) returned 1 [0048.153] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.154] GetFileType (hFile=0x2a4) returned 0x1 [0048.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec50) returned 1 [0048.154] GetFileType (hFile=0x2a4) returned 0x1 [0048.154] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aeea8 | out: lpFileSizeHigh=0x1c9aeea8*=0x0) returned 0x0 [0048.163] CloseHandle (hObject=0x2a4) returned 1 [0048.164] GetFullPathNameW (in: lpFileName="C:\\Boot\\BCD.LOG2", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BCD.LOG2", lpFilePart=0x0) returned 0x10 [0048.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aece0) returned 1 [0048.164] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.164] GetFileType (hFile=0x2a4) returned 0x1 [0048.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec50) returned 1 [0048.164] GetFileType (hFile=0x2a4) returned 0x1 [0048.164] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aeea8 | out: lpFileSizeHigh=0x1c9aeea8*=0x0) returned 0x0 [0048.166] CloseHandle (hObject=0x2a4) returned 1 [0048.166] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT", lpFilePart=0x0) returned 0x14 [0048.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aece0) returned 1 [0048.166] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.180] GetFileType (hFile=0x2a4) returned 0x1 [0048.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec50) returned 1 [0048.180] GetFileType (hFile=0x2a4) returned 0x1 [0048.180] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aeea8 | out: lpFileSizeHigh=0x1c9aeea8*=0x0) returned 0x10000 [0048.180] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=65526, lpDistanceToMoveHigh=0x1c9aee08*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aee08*=0) returned 0xfff6 [0048.180] ReadFile (in: hFile=0x2a4, lpBuffer=0x26ec9a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aedd8, lpOverlapped=0x0 | out: lpBuffer=0x26ec9a0*, lpNumberOfBytesRead=0x1c9aedd8*=0xa, lpOverlapped=0x0) returned 1 [0048.182] CloseHandle (hObject=0x2a4) returned 1 [0048.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aed00 | out: SystemInformation=0x12641930, ResultLength=0x1c9aed00*=0x11120) returned 0x0 [0048.189] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT", nBufferLength=0x105, lpBuffer=0x1c9ae8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT", lpFilePart=0x0) returned 0x14 [0048.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.189] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), fInfoLevelId=0x0, lpFileInformation=0x2755de0 | out: lpFileInformation=0x2755de0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0048.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aecb0) returned 1 [0048.189] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT", nBufferLength=0x105, lpBuffer=0x1c9ae6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT", lpFilePart=0x0) returned 0x14 [0048.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0048.189] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.190] GetFileType (hFile=0x2a4) returned 0x1 [0048.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb20) returned 1 [0048.190] GetFileType (hFile=0x2a4) returned 0x1 [0048.190] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aed48 | out: lpFileSizeHigh=0x1c9aed48*=0x0) returned 0x10000 [0048.190] ReadFile (in: hFile=0x2a4, lpBuffer=0x2755fd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x1c9aec78, lpOverlapped=0x0 | out: lpBuffer=0x2755fd8*, lpNumberOfBytesRead=0x1c9aec78*=0x10000, lpOverlapped=0x0) returned 1 [0048.191] CloseHandle (hObject=0x2a4) returned 1 [0048.226] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT", nBufferLength=0x105, lpBuffer=0x1c9ae700, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT", lpFilePart=0x0) returned 0x14 [0048.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebe0) returned 1 [0048.226] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab520) returned 1 [0048.228] GetFullPathNameW (in: lpFileName="C:\\Boot\\memtest.exe", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\memtest.exe", lpFilePart=0x0) returned 0x13 [0048.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aece0) returned 1 [0048.228] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.230] GetFileType (hFile=0x2a4) returned 0x1 [0048.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec50) returned 1 [0048.230] GetFileType (hFile=0x2a4) returned 0x1 [0048.230] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aeea8 | out: lpFileSizeHigh=0x1c9aeea8*=0x0) returned 0x76980 [0048.230] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=485750, lpDistanceToMoveHigh=0x1c9aee08*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aee08*=0) returned 0x76976 [0048.230] ReadFile (in: hFile=0x2a4, lpBuffer=0x280d718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aedd8, lpOverlapped=0x0 | out: lpBuffer=0x280d718*, lpNumberOfBytesRead=0x1c9aedd8*=0xa, lpOverlapped=0x0) returned 1 [0048.231] CloseHandle (hObject=0x2a4) returned 1 [0048.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aed00 | out: SystemInformation=0x12641930, ResultLength=0x1c9aed00*=0x11120) returned 0x0 [0048.238] GetFullPathNameW (in: lpFileName="C:\\Boot\\memtest.exe", nBufferLength=0x105, lpBuffer=0x1c9ae8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\memtest.exe", lpFilePart=0x0) returned 0x13 [0048.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.238] GetFileAttributesExW (in: lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), fInfoLevelId=0x0, lpFileInformation=0x2876c78 | out: lpFileInformation=0x2876c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980)) returned 1 [0048.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aecb0) returned 1 [0048.238] GetFullPathNameW (in: lpFileName="C:\\Boot\\memtest.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\memtest.exe", lpFilePart=0x0) returned 0x13 [0048.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0048.238] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.238] GetFileType (hFile=0x2a4) returned 0x1 [0048.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb20) returned 1 [0048.238] GetFileType (hFile=0x2a4) returned 0x1 [0048.238] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aed48 | out: lpFileSizeHigh=0x1c9aed48*=0x0) returned 0x76980 [0048.239] ReadFile (in: hFile=0x2a4, lpBuffer=0x128b3d98, nNumberOfBytesToRead=0x76980, lpNumberOfBytesRead=0x1c9aec78, lpOverlapped=0x0 | out: lpBuffer=0x128b3d98*, lpNumberOfBytesRead=0x1c9aec78*=0x76980, lpOverlapped=0x0) returned 1 [0048.251] CloseHandle (hObject=0x2a4) returned 1 [0048.317] GetFullPathNameW (in: lpFileName="C:\\Boot\\memtest.exe", nBufferLength=0x105, lpBuffer=0x1c9ae700, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\memtest.exe", lpFilePart=0x0) returned 0x13 [0048.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebe0) returned 1 [0048.317] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab520) returned 1 [0048.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.320] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0048.320] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0048.320] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.320] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.321] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.321] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0048.321] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.322] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0048.322] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0048.322] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.322] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.322] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.322] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0048.322] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.322] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0048.322] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.323] GetFileType (hFile=0x2a4) returned 0x1 [0048.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0048.323] GetFileType (hFile=0x2a4) returned 0x1 [0048.323] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x15c50 [0048.323] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=89158, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x15c46 [0048.323] ReadFile (in: hFile=0x2a4, lpBuffer=0x26a6658, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x26a6658*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0048.324] CloseHandle (hObject=0x2a4) returned 1 [0048.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11120) returned 0x0 [0048.330] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0048.331] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x270fc08 | out: lpFileInformation=0x270fc08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50)) returned 1 [0048.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0048.331] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0048.331] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.331] GetFileType (hFile=0x2a4) returned 0x1 [0048.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0048.331] GetFileType (hFile=0x2a4) returned 0x1 [0048.331] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x15c50 [0048.331] ReadFile (in: hFile=0x2a4, lpBuffer=0x1283c020, nNumberOfBytesToRead=0x15c50, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x1283c020*, lpNumberOfBytesRead=0x1c9aebd8*=0x15c50, lpOverlapped=0x0) returned 1 [0048.350] CloseHandle (hObject=0x2a4) returned 1 [0048.408] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0048.408] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0048.412] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0048.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0048.412] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\README_3728769.txt" (normalized: "c:\\boot\\cs-cz\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2a4 [0048.413] GetFileType (hFile=0x2a4) returned 0x1 [0048.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0048.413] GetFileType (hFile=0x2a4) returned 0x1 [0048.413] WriteFile (in: hFile=0x2a4, lpBuffer=0x278cb30*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x278cb30*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0048.414] CloseHandle (hObject=0x2a4) returned 1 [0048.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.415] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0048.415] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0048.415] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.416] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.416] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.416] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0048.416] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.417] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0048.417] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0048.417] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.417] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.417] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.417] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0048.418] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.418] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0048.418] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.419] GetFileType (hFile=0x2a4) returned 0x1 [0048.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0048.419] GetFileType (hFile=0x2a4) returned 0x1 [0048.419] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x15640 [0048.419] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=87606, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x15636 [0048.419] ReadFile (in: hFile=0x2a4, lpBuffer=0x278f848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x278f848*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0048.421] CloseHandle (hObject=0x2a4) returned 1 [0048.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11120) returned 0x0 [0048.426] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0048.426] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27f8d28 | out: lpFileInformation=0x27f8d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0048.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0048.427] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0048.427] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.427] GetFileType (hFile=0x2a4) returned 0x1 [0048.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0048.427] GetFileType (hFile=0x2a4) returned 0x1 [0048.427] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x15640 [0048.427] ReadFile (in: hFile=0x2a4, lpBuffer=0x129b6da0, nNumberOfBytesToRead=0x15640, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x129b6da0*, lpNumberOfBytesRead=0x1c9aebd8*=0x15640, lpOverlapped=0x0) returned 1 [0048.429] CloseHandle (hObject=0x2a4) returned 1 [0048.465] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0048.465] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0048.469] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0048.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0048.469] CreateFileW (lpFileName="C:\\Boot\\da-DK\\README_3728769.txt" (normalized: "c:\\boot\\da-dk\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2a4 [0048.469] GetFileType (hFile=0x2a4) returned 0x1 [0048.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0048.469] GetFileType (hFile=0x2a4) returned 0x1 [0048.469] WriteFile (in: hFile=0x2a4, lpBuffer=0x2873280*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x2873280*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0048.470] CloseHandle (hObject=0x2a4) returned 1 [0048.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.470] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0048.470] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0048.470] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.471] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.471] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.471] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0048.471] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.472] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0048.472] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0048.472] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a8084e0 [0048.472] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.472] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.473] FindNextFileW (in: hFindFile=0x1a8084e0, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0048.473] FindClose (in: hFindFile=0x1a8084e0 | out: hFindFile=0x1a8084e0) returned 1 [0048.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.473] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0048.473] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.473] GetFileType (hFile=0x2a4) returned 0x1 [0048.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0048.473] GetFileType (hFile=0x2a4) returned 0x1 [0048.473] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x16640 [0048.473] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=91702, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x16636 [0048.473] ReadFile (in: hFile=0x2a4, lpBuffer=0x2875f98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2875f98*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0048.475] CloseHandle (hObject=0x2a4) returned 1 [0048.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11120) returned 0x0 [0048.477] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0048.477] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x28df4b8 | out: lpFileInformation=0x28df4b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640)) returned 1 [0048.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0048.477] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0048.477] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a4 [0048.477] GetFileType (hFile=0x2a4) returned 0x1 [0048.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0048.478] GetFileType (hFile=0x2a4) returned 0x1 [0048.478] GetFileSize (in: hFile=0x2a4, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x16640 [0048.478] ReadFile (in: hFile=0x2a4, lpBuffer=0x12a37448, nNumberOfBytesToRead=0x16640, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x12a37448*, lpNumberOfBytesRead=0x1c9aebd8*=0x16640, lpOverlapped=0x0) returned 1 [0048.480] CloseHandle (hObject=0x2a4) returned 1 [0048.626] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0048.626] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0048.630] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0048.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0048.630] CreateFileW (lpFileName="C:\\Boot\\de-DE\\README_3728769.txt" (normalized: "c:\\boot\\de-de\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b4 [0048.631] GetFileType (hFile=0x2b4) returned 0x1 [0048.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0048.631] GetFileType (hFile=0x2b4) returned 0x1 [0048.631] WriteFile (in: hFile=0x2b4, lpBuffer=0x26c5098*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x26c5098*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0048.632] CloseHandle (hObject=0x2b4) returned 1 [0048.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.632] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0048.632] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0048.632] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0048.633] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.633] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.633] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0048.633] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0048.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.634] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0048.634] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0048.634] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0048.635] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.635] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.635] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0048.635] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0048.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.636] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0048.636] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.655] GetFileType (hFile=0x2b4) returned 0x1 [0048.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0048.655] GetFileType (hFile=0x2b4) returned 0x1 [0048.655] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x17250 [0048.655] SetFilePointer (in: hFile=0x2b4, lDistanceToMove=94790, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x17246 [0048.655] ReadFile (in: hFile=0x2b4, lpBuffer=0x26d75a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x26d75a0*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0048.656] CloseHandle (hObject=0x2b4) returned 1 [0048.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0048.665] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0048.665] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27413c0 | out: lpFileInformation=0x27413c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250)) returned 1 [0048.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0048.665] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0048.665] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.665] GetFileType (hFile=0x2b4) returned 0x1 [0048.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0048.666] GetFileType (hFile=0x2b4) returned 0x1 [0048.666] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x17250 [0048.666] ReadFile (in: hFile=0x2b4, lpBuffer=0x126a4ca8, nNumberOfBytesToRead=0x17250, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x126a4ca8*, lpNumberOfBytesRead=0x1c9aebd8*=0x17250, lpOverlapped=0x0) returned 1 [0048.667] CloseHandle (hObject=0x2b4) returned 1 [0048.701] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0048.701] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0048.705] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0048.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0048.705] CreateFileW (lpFileName="C:\\Boot\\el-GR\\README_3728769.txt" (normalized: "c:\\boot\\el-gr\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b4 [0048.706] GetFileType (hFile=0x2b4) returned 0x1 [0048.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0048.706] GetFileType (hFile=0x2b4) returned 0x1 [0048.706] WriteFile (in: hFile=0x2b4, lpBuffer=0x27d76e8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x27d76e8*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0048.707] CloseHandle (hObject=0x2b4) returned 1 [0048.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.707] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0048.707] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0048.707] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0048.707] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.708] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.708] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0048.708] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0048.708] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0048.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.709] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0048.709] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0048.709] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0048.709] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.709] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.709] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0048.710] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0048.710] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0048.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.710] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0048.710] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.710] GetFileType (hFile=0x2b4) returned 0x1 [0048.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0048.710] GetFileType (hFile=0x2b4) returned 0x1 [0048.710] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x14c40 [0048.710] SetFilePointer (in: hFile=0x2b4, lDistanceToMove=85046, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x14c36 [0048.710] ReadFile (in: hFile=0x2b4, lpBuffer=0x27da6e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x27da6e8*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0048.712] CloseHandle (hObject=0x2b4) returned 1 [0048.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0048.719] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0048.719] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2843d30 | out: lpFileInformation=0x2843d30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40)) returned 1 [0048.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0048.719] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0048.719] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.719] GetFileType (hFile=0x2b4) returned 0x1 [0048.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0048.719] GetFileType (hFile=0x2b4) returned 0x1 [0048.719] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x14c40 [0048.720] ReadFile (in: hFile=0x2b4, lpBuffer=0x1272fbb0, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x1272fbb0*, lpNumberOfBytesRead=0x1c9aebd8*=0x14c40, lpOverlapped=0x0) returned 1 [0048.721] CloseHandle (hObject=0x2b4) returned 1 [0048.807] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0048.807] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0048.827] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d [0048.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0048.827] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.828] GetFileType (hFile=0x2b4) returned 0x1 [0048.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0048.828] GetFileType (hFile=0x2b4) returned 0x1 [0048.828] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0xaa50 [0048.828] SetFilePointer (in: hFile=0x2b4, lDistanceToMove=43590, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0xaa46 [0048.828] ReadFile (in: hFile=0x2b4, lpBuffer=0x26f2248, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x26f2248*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0048.834] CloseHandle (hObject=0x2b4) returned 1 [0048.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0048.839] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d [0048.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0048.839] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x275b950 | out: lpFileInformation=0x275b950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50)) returned 1 [0048.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0048.839] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d [0048.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0048.839] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.839] GetFileType (hFile=0x2b4) returned 0x1 [0048.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0048.839] GetFileType (hFile=0x2b4) returned 0x1 [0048.839] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0xaa50 [0048.839] ReadFile (in: hFile=0x2b4, lpBuffer=0x275bb68, nNumberOfBytesToRead=0xaa50, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x275bb68*, lpNumberOfBytesRead=0x1c9aebd8*=0xaa50, lpOverlapped=0x0) returned 1 [0048.840] CloseHandle (hObject=0x2b4) returned 1 [0048.873] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\memtest.exe.mui", lpFilePart=0x0) returned 0x1d [0048.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0048.873] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0048.877] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0048.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0048.877] CreateFileW (lpFileName="C:\\Boot\\en-US\\README_3728769.txt" (normalized: "c:\\boot\\en-us\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b4 [0048.878] GetFileType (hFile=0x2b4) returned 0x1 [0048.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0048.878] GetFileType (hFile=0x2b4) returned 0x1 [0048.878] WriteFile (in: hFile=0x2b4, lpBuffer=0x2800af0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x2800af0*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0048.879] CloseHandle (hObject=0x2b4) returned 1 [0048.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.879] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0048.879] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0048.879] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0048.880] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.880] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.881] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0048.881] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0048.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.882] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0048.882] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0048.882] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0048.882] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.882] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.882] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0048.882] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0048.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.882] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0048.883] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.883] GetFileType (hFile=0x2b4) returned 0x1 [0048.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0048.883] GetFileType (hFile=0x2b4) returned 0x1 [0048.883] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x16050 [0048.883] SetFilePointer (in: hFile=0x2b4, lDistanceToMove=90182, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x16046 [0048.883] ReadFile (in: hFile=0x2b4, lpBuffer=0x2803808, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2803808*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0048.884] CloseHandle (hObject=0x2b4) returned 1 [0048.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0048.891] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0048.891] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x286ced0 | out: lpFileInformation=0x286ced0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0048.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0048.892] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0048.892] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.892] GetFileType (hFile=0x2b4) returned 0x1 [0048.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0048.892] GetFileType (hFile=0x2b4) returned 0x1 [0048.892] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x16050 [0048.892] ReadFile (in: hFile=0x2b4, lpBuffer=0x127c1b30, nNumberOfBytesToRead=0x16050, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x127c1b30*, lpNumberOfBytesRead=0x1c9aebd8*=0x16050, lpOverlapped=0x0) returned 1 [0048.894] CloseHandle (hObject=0x2b4) returned 1 [0048.928] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0048.928] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0048.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0048.932] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0048.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0048.932] CreateFileW (lpFileName="C:\\Boot\\es-ES\\README_3728769.txt" (normalized: "c:\\boot\\es-es\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b4 [0048.932] GetFileType (hFile=0x2b4) returned 0x1 [0048.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0048.932] GetFileType (hFile=0x2b4) returned 0x1 [0048.932] WriteFile (in: hFile=0x2b4, lpBuffer=0x28e7428*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x28e7428*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0048.933] CloseHandle (hObject=0x2b4) returned 1 [0048.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.934] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0048.934] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0048.934] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0048.934] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.934] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.934] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0048.935] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0048.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0048.935] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0048.935] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0048.935] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0048.936] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.936] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0048.936] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0048.936] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0048.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0048.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0048.936] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0048.936] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.937] GetFileType (hFile=0x2b4) returned 0x1 [0048.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0048.937] GetFileType (hFile=0x2b4) returned 0x1 [0048.937] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x15c40 [0048.937] SetFilePointer (in: hFile=0x2b4, lDistanceToMove=89142, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x15c36 [0048.937] ReadFile (in: hFile=0x2b4, lpBuffer=0x28ea140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x28ea140*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0048.938] CloseHandle (hObject=0x2b4) returned 1 [0048.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0048.945] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0048.945] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2953808 | out: lpFileInformation=0x2953808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40)) returned 1 [0048.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0048.945] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0048.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0048.945] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0048.945] GetFileType (hFile=0x2b4) returned 0x1 [0048.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0048.945] GetFileType (hFile=0x2b4) returned 0x1 [0048.945] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x15c40 [0048.946] ReadFile (in: hFile=0x2b4, lpBuffer=0x12845e38, nNumberOfBytesToRead=0x15c40, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x12845e38*, lpNumberOfBytesRead=0x1c9aebd8*=0x15c40, lpOverlapped=0x0) returned 1 [0048.947] CloseHandle (hObject=0x2b4) returned 1 [0049.006] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.006] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.009] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.009] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\README_3728769.txt" (normalized: "c:\\boot\\fi-fi\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b4 [0049.010] GetFileType (hFile=0x2b4) returned 0x1 [0049.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.010] GetFileType (hFile=0x2b4) returned 0x1 [0049.010] WriteFile (in: hFile=0x2b4, lpBuffer=0x29d07d8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x29d07d8*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.011] CloseHandle (hObject=0x2b4) returned 1 [0049.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.011] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0049.011] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0049.011] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.012] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0049.013] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.013] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.016] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0049.017] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0049.017] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.017] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0049.018] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0049.018] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.018] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.018] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0049.018] GetFileType (hFile=0x2b4) returned 0x1 [0049.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.018] GetFileType (hFile=0x2b4) returned 0x1 [0049.018] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x385e00 [0049.018] SetFilePointer (in: hFile=0x2b4, lDistanceToMove=3694070, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x385df6 [0049.019] ReadFile (in: hFile=0x2b4, lpBuffer=0x29d3e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x29d3e80*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.022] CloseHandle (hObject=0x2b4) returned 1 [0049.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.039] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.039] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x274a010 | out: lpFileInformation=0x274a010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00)) returned 1 [0049.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.039] CoTaskMemAlloc (cb=0x340) returned 0x1a7d73f0 [0049.105] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.106] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0049.106] GetFileType (hFile=0x2b4) returned 0x1 [0049.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0049.106] GetFileType (hFile=0x2b4) returned 0x1 [0049.106] ReadFile (in: hFile=0x2b4, lpBuffer=0x128c88e0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aebb8, lpOverlapped=0x0 | out: lpBuffer=0x128c88e0*, lpNumberOfBytesRead=0x1c9aebb8*=0x100000, lpOverlapped=0x0) returned 1 [0049.123] CloseHandle (hObject=0x2b4) returned 1 [0049.123] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.123] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab460) returned 1 [0049.125] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.126] CoTaskMemAlloc (cb=0xe) returned 0x1a7f7e60 [0049.128] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.128] CoTaskMemAlloc (cb=0xb) returned 0x1a7f7ca0 [0049.134] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\chs_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.134] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab460) returned 1 [0049.137] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.137] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.138] GetFileType (hFile=0x2b8) returned 0x1 [0049.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.138] GetFileType (hFile=0x2b8) returned 0x1 [0049.138] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x3b27a4 [0049.138] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=3876762, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x3b279a [0049.138] ReadFile (in: hFile=0x2b8, lpBuffer=0x274c380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x274c380*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.160] CloseHandle (hObject=0x2b8) returned 1 [0049.160] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.166] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.166] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27b82b0 | out: lpFileInformation=0x27b82b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4)) returned 1 [0049.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.213] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.213] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.214] GetFileType (hFile=0x2b8) returned 0x1 [0049.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0049.214] GetFileType (hFile=0x2b8) returned 0x1 [0049.214] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aebb8, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aebb8*=0x100000, lpOverlapped=0x0) returned 1 [0049.237] CloseHandle (hObject=0x2b8) returned 1 [0049.238] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.238] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab460) returned 1 [0049.240] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.240] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.240] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\cht_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.240] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab460) returned 1 [0049.243] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.243] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.243] GetFileType (hFile=0x2b8) returned 0x1 [0049.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.243] GetFileType (hFile=0x2b8) returned 0x1 [0049.243] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x1e46e4 [0049.243] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1984218, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x1e46da [0049.243] ReadFile (in: hFile=0x2b8, lpBuffer=0x26a5b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x26a5b10*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.245] CloseHandle (hObject=0x2b8) returned 1 [0049.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.251] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.251] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x270f1d8 | out: lpFileInformation=0x270f1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4)) returned 1 [0049.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.253] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.253] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.254] GetFileType (hFile=0x2b8) returned 0x1 [0049.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0049.254] GetFileType (hFile=0x2b8) returned 0x1 [0049.254] ReadFile (in: hFile=0x2b8, lpBuffer=0x127619a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aebb8, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesRead=0x1c9aebb8*=0x100000, lpOverlapped=0x0) returned 1 [0049.290] CloseHandle (hObject=0x2b8) returned 1 [0049.299] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.299] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab460) returned 1 [0049.301] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.302] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.302] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\jpn_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.302] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab460) returned 1 [0049.304] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.304] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.305] GetFileType (hFile=0x2b8) returned 0x1 [0049.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.305] GetFileType (hFile=0x2b8) returned 0x1 [0049.305] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x242f20 [0049.305] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2371350, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x242f16 [0049.305] ReadFile (in: hFile=0x2b8, lpBuffer=0x2711100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2711100*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.306] CloseHandle (hObject=0x2b8) returned 1 [0049.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.313] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.313] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x277a7c8 | out: lpFileInformation=0x277a7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20)) returned 1 [0049.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.316] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.316] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.316] GetFileType (hFile=0x2b8) returned 0x1 [0049.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0049.316] GetFileType (hFile=0x2b8) returned 0x1 [0049.316] ReadFile (in: hFile=0x2b8, lpBuffer=0x128619d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aebb8, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesRead=0x1c9aebb8*=0x100000, lpOverlapped=0x0) returned 1 [0049.337] CloseHandle (hObject=0x2b8) returned 1 [0049.337] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.337] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab460) returned 1 [0049.339] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.339] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.339] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\kor_boot.ttf", lpFilePart=0x0) returned 0x1a [0049.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0049.339] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab460) returned 1 [0049.342] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\wgl4_boot.ttf", lpFilePart=0x0) returned 0x1b [0049.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.342] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.342] GetFileType (hFile=0x2b8) returned 0x1 [0049.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.343] GetFileType (hFile=0x2b8) returned 0x1 [0049.343] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0xb95c [0049.343] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=47442, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0xb952 [0049.343] ReadFile (in: hFile=0x2b8, lpBuffer=0x277c6f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x277c6f0*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.344] CloseHandle (hObject=0x2b8) returned 1 [0049.345] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.350] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\wgl4_boot.ttf", lpFilePart=0x0) returned 0x1b [0049.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.350] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x27e5df8 | out: lpFileInformation=0x27e5df8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c)) returned 1 [0049.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.351] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\wgl4_boot.ttf", lpFilePart=0x0) returned 0x1b [0049.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.351] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.351] GetFileType (hFile=0x2b8) returned 0x1 [0049.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.351] GetFileType (hFile=0x2b8) returned 0x1 [0049.351] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0xb95c [0049.351] ReadFile (in: hFile=0x2b8, lpBuffer=0x27e6000, nNumberOfBytesToRead=0xb95c, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x27e6000*, lpNumberOfBytesRead=0x1c9aebd8*=0xb95c, lpOverlapped=0x0) returned 1 [0049.352] CloseHandle (hObject=0x2b8) returned 1 [0049.411] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\wgl4_boot.ttf", lpFilePart=0x0) returned 0x1b [0049.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.411] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.415] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.415] CreateFileW (lpFileName="C:\\Boot\\Fonts\\README_3728769.txt" (normalized: "c:\\boot\\fonts\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0049.443] GetFileType (hFile=0x2b8) returned 0x1 [0049.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.443] GetFileType (hFile=0x2b8) returned 0x1 [0049.444] WriteFile (in: hFile=0x2b8, lpBuffer=0x26e1420*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x26e1420*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.444] CloseHandle (hObject=0x2b8) returned 1 [0049.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.445] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0049.445] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0049.445] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.446] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.446] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.446] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.446] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.447] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0049.447] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0049.447] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.447] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.448] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.448] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.448] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.448] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.448] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.448] GetFileType (hFile=0x2b8) returned 0x1 [0049.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.448] GetFileType (hFile=0x2b8) returned 0x1 [0049.448] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x16c40 [0049.449] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=93238, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x16c36 [0049.449] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e4138, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x26e4138*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.450] CloseHandle (hObject=0x2b8) returned 1 [0049.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.456] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.456] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x274d7c0 | out: lpFileInformation=0x274d7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40)) returned 1 [0049.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.456] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.456] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.456] GetFileType (hFile=0x2b8) returned 0x1 [0049.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.456] GetFileType (hFile=0x2b8) returned 0x1 [0049.457] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x16c40 [0049.457] ReadFile (in: hFile=0x2b8, lpBuffer=0x12678c40, nNumberOfBytesToRead=0x16c40, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x12678c40*, lpNumberOfBytesRead=0x1c9aebd8*=0x16c40, lpOverlapped=0x0) returned 1 [0049.458] CloseHandle (hObject=0x2b8) returned 1 [0049.493] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.493] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.497] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.497] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\README_3728769.txt" (normalized: "c:\\boot\\fr-fr\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0049.497] GetFileType (hFile=0x2b8) returned 0x1 [0049.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.497] GetFileType (hFile=0x2b8) returned 0x1 [0049.498] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c7fb0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x27c7fb0*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.498] CloseHandle (hObject=0x2b8) returned 1 [0049.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.499] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0049.499] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0049.499] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.499] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.499] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.499] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.499] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.500] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0049.500] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0049.500] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.500] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.501] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.501] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.501] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.501] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.501] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.501] GetFileType (hFile=0x2b8) returned 0x1 [0049.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.501] GetFileType (hFile=0x2b8) returned 0x1 [0049.501] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x16240 [0049.502] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=90678, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x16236 [0049.502] ReadFile (in: hFile=0x2b8, lpBuffer=0x27cacc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x27cacc8*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.503] CloseHandle (hObject=0x2b8) returned 1 [0049.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.509] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.509] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2834350 | out: lpFileInformation=0x2834350*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240)) returned 1 [0049.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.509] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.509] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.509] GetFileType (hFile=0x2b8) returned 0x1 [0049.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.509] GetFileType (hFile=0x2b8) returned 0x1 [0049.509] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x16240 [0049.509] ReadFile (in: hFile=0x2b8, lpBuffer=0x127016e8, nNumberOfBytesToRead=0x16240, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x127016e8*, lpNumberOfBytesRead=0x1c9aebd8*=0x16240, lpOverlapped=0x0) returned 1 [0049.511] CloseHandle (hObject=0x2b8) returned 1 [0049.551] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.551] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.554] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.555] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\README_3728769.txt" (normalized: "c:\\boot\\hu-hu\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0049.555] GetFileType (hFile=0x2b8) returned 0x1 [0049.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.555] GetFileType (hFile=0x2b8) returned 0x1 [0049.555] WriteFile (in: hFile=0x2b8, lpBuffer=0x28ae8a8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x28ae8a8*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.556] CloseHandle (hObject=0x2b8) returned 1 [0049.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.556] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0049.556] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0049.556] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.557] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.557] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.557] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.558] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.558] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0049.558] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0049.558] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.559] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.559] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.559] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.559] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.559] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.559] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.560] GetFileType (hFile=0x2b8) returned 0x1 [0049.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.560] GetFileType (hFile=0x2b8) returned 0x1 [0049.560] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x16250 [0049.560] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=90694, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x16246 [0049.560] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b15c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x28b15c0*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.561] CloseHandle (hObject=0x2b8) returned 1 [0049.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.581] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.581] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x274fd08 | out: lpFileInformation=0x274fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0049.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.581] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.581] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.581] GetFileType (hFile=0x2b8) returned 0x1 [0049.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.581] GetFileType (hFile=0x2b8) returned 0x1 [0049.581] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x16250 [0049.581] ReadFile (in: hFile=0x2b8, lpBuffer=0x12786590, nNumberOfBytesToRead=0x16250, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x12786590*, lpNumberOfBytesRead=0x1c9aebd8*=0x16250, lpOverlapped=0x0) returned 1 [0049.583] CloseHandle (hObject=0x2b8) returned 1 [0049.637] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.638] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.641] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.641] CreateFileW (lpFileName="C:\\Boot\\it-IT\\README_3728769.txt" (normalized: "c:\\boot\\it-it\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0049.642] GetFileType (hFile=0x2b8) returned 0x1 [0049.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.642] GetFileType (hFile=0x2b8) returned 0x1 [0049.642] WriteFile (in: hFile=0x2b8, lpBuffer=0x27ccda0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x27ccda0*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.643] CloseHandle (hObject=0x2b8) returned 1 [0049.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.643] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0049.643] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0049.643] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.643] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.644] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.644] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.644] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.645] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0049.645] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0049.645] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.645] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.645] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.645] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.645] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.646] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.646] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.646] GetFileType (hFile=0x2b8) returned 0x1 [0049.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.646] GetFileType (hFile=0x2b8) returned 0x1 [0049.646] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x12a40 [0049.646] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=76342, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x12a36 [0049.646] ReadFile (in: hFile=0x2b8, lpBuffer=0x27cfab8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x27cfab8*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.648] CloseHandle (hObject=0x2b8) returned 1 [0049.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.654] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.654] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x28391c0 | out: lpFileInformation=0x28391c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40)) returned 1 [0049.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.654] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.654] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.654] GetFileType (hFile=0x2b8) returned 0x1 [0049.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.654] GetFileType (hFile=0x2b8) returned 0x1 [0049.654] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x12a40 [0049.654] ReadFile (in: hFile=0x2b8, lpBuffer=0x28393d8, nNumberOfBytesToRead=0x12a40, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x28393d8*, lpNumberOfBytesRead=0x1c9aebd8*=0x12a40, lpOverlapped=0x0) returned 1 [0049.655] CloseHandle (hObject=0x2b8) returned 1 [0049.689] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.689] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.692] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.692] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\README_3728769.txt" (normalized: "c:\\boot\\ja-jp\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0049.693] GetFileType (hFile=0x2b8) returned 0x1 [0049.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.693] GetFileType (hFile=0x2b8) returned 0x1 [0049.693] WriteFile (in: hFile=0x2b8, lpBuffer=0x28fe088*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x28fe088*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.694] CloseHandle (hObject=0x2b8) returned 1 [0049.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.694] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0049.694] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0049.694] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.695] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.695] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.695] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.695] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.696] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0049.696] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0049.696] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.696] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.696] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.696] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.697] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.697] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.697] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.697] GetFileType (hFile=0x2b8) returned 0x1 [0049.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.697] GetFileType (hFile=0x2b8) returned 0x1 [0049.697] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x12650 [0049.697] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=75334, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x12646 [0049.697] ReadFile (in: hFile=0x2b8, lpBuffer=0x2900da0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2900da0*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.699] CloseHandle (hObject=0x2b8) returned 1 [0049.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.716] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.716] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x278bd70 | out: lpFileInformation=0x278bd70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650)) returned 1 [0049.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.716] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.716] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.716] GetFileType (hFile=0x2b8) returned 0x1 [0049.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.716] GetFileType (hFile=0x2b8) returned 0x1 [0049.716] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x12650 [0049.716] ReadFile (in: hFile=0x2b8, lpBuffer=0x278bf88, nNumberOfBytesToRead=0x12650, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x278bf88*, lpNumberOfBytesRead=0x1c9aebd8*=0x12650, lpOverlapped=0x0) returned 1 [0049.717] CloseHandle (hObject=0x2b8) returned 1 [0049.779] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.779] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.783] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.783] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\README_3728769.txt" (normalized: "c:\\boot\\ko-kr\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0049.783] GetFileType (hFile=0x2b8) returned 0x1 [0049.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.784] GetFileType (hFile=0x2b8) returned 0x1 [0049.784] WriteFile (in: hFile=0x2b8, lpBuffer=0x28529b8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x28529b8*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.785] CloseHandle (hObject=0x2b8) returned 1 [0049.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.785] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0049.785] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0049.785] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.785] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.785] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.786] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.786] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.786] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0049.787] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0049.787] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.787] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.787] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.787] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.787] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.787] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.787] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.788] GetFileType (hFile=0x2b8) returned 0x1 [0049.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.788] GetFileType (hFile=0x2b8) returned 0x1 [0049.788] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x15850 [0049.789] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=88134, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x15846 [0049.789] ReadFile (in: hFile=0x2b8, lpBuffer=0x28556d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x28556d0*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.791] CloseHandle (hObject=0x2b8) returned 1 [0049.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.797] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.797] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x28bedd8 | out: lpFileInformation=0x28bedd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850)) returned 1 [0049.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.797] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.797] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.797] GetFileType (hFile=0x2b8) returned 0x1 [0049.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.797] GetFileType (hFile=0x2b8) returned 0x1 [0049.797] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x15850 [0049.798] ReadFile (in: hFile=0x2b8, lpBuffer=0x12855628, nNumberOfBytesToRead=0x15850, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x12855628*, lpNumberOfBytesRead=0x1c9aebd8*=0x15850, lpOverlapped=0x0) returned 1 [0049.800] CloseHandle (hObject=0x2b8) returned 1 [0049.851] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.852] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.855] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.856] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\README_3728769.txt" (normalized: "c:\\boot\\nb-no\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0049.856] GetFileType (hFile=0x2b8) returned 0x1 [0049.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.856] GetFileType (hFile=0x2b8) returned 0x1 [0049.856] WriteFile (in: hFile=0x2b8, lpBuffer=0x2764020*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x2764020*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.857] CloseHandle (hObject=0x2b8) returned 1 [0049.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.858] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0049.858] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0049.858] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.858] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.858] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.858] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.858] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.859] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0049.859] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0049.859] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.859] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.860] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.860] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.860] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.860] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.860] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.860] GetFileType (hFile=0x2b8) returned 0x1 [0049.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.861] GetFileType (hFile=0x2b8) returned 0x1 [0049.861] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x16250 [0049.861] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=90694, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x16246 [0049.861] ReadFile (in: hFile=0x2b8, lpBuffer=0x2766d38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2766d38*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.862] CloseHandle (hObject=0x2b8) returned 1 [0049.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.868] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.868] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27d0380 | out: lpFileInformation=0x27d0380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0049.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.868] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.868] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.868] GetFileType (hFile=0x2b8) returned 0x1 [0049.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.868] GetFileType (hFile=0x2b8) returned 0x1 [0049.869] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x16250 [0049.869] ReadFile (in: hFile=0x2b8, lpBuffer=0x128d6930, nNumberOfBytesToRead=0x16250, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x128d6930*, lpNumberOfBytesRead=0x1c9aebd8*=0x16250, lpOverlapped=0x0) returned 1 [0049.870] CloseHandle (hObject=0x2b8) returned 1 [0049.904] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.905] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.908] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.908] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\README_3728769.txt" (normalized: "c:\\boot\\nl-nl\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0049.909] GetFileType (hFile=0x2b8) returned 0x1 [0049.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.909] GetFileType (hFile=0x2b8) returned 0x1 [0049.909] WriteFile (in: hFile=0x2b8, lpBuffer=0x284ab70*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x284ab70*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.910] CloseHandle (hObject=0x2b8) returned 1 [0049.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.910] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0049.910] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0049.910] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.910] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.911] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.911] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.911] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.912] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0049.912] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0049.912] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.912] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.912] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.912] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.912] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.913] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.913] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.913] GetFileType (hFile=0x2b8) returned 0x1 [0049.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.914] GetFileType (hFile=0x2b8) returned 0x1 [0049.914] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x16250 [0049.914] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=90694, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x16246 [0049.914] ReadFile (in: hFile=0x2b8, lpBuffer=0x284d888, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x284d888*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.915] CloseHandle (hObject=0x2b8) returned 1 [0049.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.921] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.921] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x28b7010 | out: lpFileInformation=0x28b7010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250)) returned 1 [0049.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.921] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.922] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.922] GetFileType (hFile=0x2b8) returned 0x1 [0049.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.922] GetFileType (hFile=0x2b8) returned 0x1 [0049.922] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x16250 [0049.922] ReadFile (in: hFile=0x2b8, lpBuffer=0x1295b838, nNumberOfBytesToRead=0x16250, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x1295b838*, lpNumberOfBytesRead=0x1c9aebd8*=0x16250, lpOverlapped=0x0) returned 1 [0049.940] CloseHandle (hObject=0x2b8) returned 1 [0049.978] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0049.978] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0049.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0049.982] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0049.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0049.982] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\README_3728769.txt" (normalized: "c:\\boot\\pl-pl\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0049.982] GetFileType (hFile=0x2b8) returned 0x1 [0049.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0049.982] GetFileType (hFile=0x2b8) returned 0x1 [0049.982] WriteFile (in: hFile=0x2b8, lpBuffer=0x26a7c50*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x26a7c50*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0049.983] CloseHandle (hObject=0x2b8) returned 1 [0049.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.983] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0049.983] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0049.983] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.984] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.984] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.984] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.984] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0049.985] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0049.985] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0049.985] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0049.985] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.985] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.986] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.986] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0049.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0049.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0049.986] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0049.986] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.986] GetFileType (hFile=0x2b8) returned 0x1 [0049.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0049.986] GetFileType (hFile=0x2b8) returned 0x1 [0049.986] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x16040 [0049.987] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=90166, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x16036 [0049.987] ReadFile (in: hFile=0x2b8, lpBuffer=0x26aa968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x26aa968*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0049.988] CloseHandle (hObject=0x2b8) returned 1 [0049.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0049.994] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0049.994] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2714070 | out: lpFileInformation=0x2714070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040)) returned 1 [0049.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0049.994] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0049.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0049.994] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0049.994] GetFileType (hFile=0x2b8) returned 0x1 [0049.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0049.995] GetFileType (hFile=0x2b8) returned 0x1 [0049.995] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x16040 [0049.995] ReadFile (in: hFile=0x2b8, lpBuffer=0x126d05e8, nNumberOfBytesToRead=0x16040, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x126d05e8*, lpNumberOfBytesRead=0x1c9aebd8*=0x16040, lpOverlapped=0x0) returned 1 [0049.999] CloseHandle (hObject=0x2b8) returned 1 [0050.029] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0050.029] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0050.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0050.033] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0050.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0050.033] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\README_3728769.txt" (normalized: "c:\\boot\\pt-br\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.033] GetFileType (hFile=0x2b8) returned 0x1 [0050.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0050.033] GetFileType (hFile=0x2b8) returned 0x1 [0050.033] WriteFile (in: hFile=0x2b8, lpBuffer=0x278e860*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x278e860*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0050.034] CloseHandle (hObject=0x2b8) returned 1 [0050.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.034] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0050.035] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0050.035] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.035] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.035] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.035] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.035] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.036] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0050.036] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0050.036] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.037] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.037] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.037] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.037] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.037] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0050.037] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.059] GetFileType (hFile=0x2b8) returned 0x1 [0050.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0050.059] GetFileType (hFile=0x2b8) returned 0x1 [0050.059] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x15e40 [0050.059] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=89654, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x15e36 [0050.059] ReadFile (in: hFile=0x2b8, lpBuffer=0x2791578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2791578*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0050.060] CloseHandle (hObject=0x2b8) returned 1 [0050.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0050.067] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0050.067] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x27fac40 | out: lpFileInformation=0x27fac40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40)) returned 1 [0050.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0050.067] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0050.067] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.067] GetFileType (hFile=0x2b8) returned 0x1 [0050.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0050.067] GetFileType (hFile=0x2b8) returned 0x1 [0050.068] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x15e40 [0050.068] ReadFile (in: hFile=0x2b8, lpBuffer=0x12754890, nNumberOfBytesToRead=0x15e40, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x12754890*, lpNumberOfBytesRead=0x1c9aebd8*=0x15e40, lpOverlapped=0x0) returned 1 [0050.069] CloseHandle (hObject=0x2b8) returned 1 [0050.104] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0050.105] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0050.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0050.126] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0050.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0050.126] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\README_3728769.txt" (normalized: "c:\\boot\\pt-pt\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.126] GetFileType (hFile=0x2b8) returned 0x1 [0050.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0050.126] GetFileType (hFile=0x2b8) returned 0x1 [0050.127] WriteFile (in: hFile=0x2b8, lpBuffer=0x2877c40*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x2877c40*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0050.129] CloseHandle (hObject=0x2b8) returned 1 [0050.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.129] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0050.129] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0050.129] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.130] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.130] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.131] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0050.131] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0050.131] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.131] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.132] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.132] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.132] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.132] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0050.132] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.132] GetFileType (hFile=0x2b8) returned 0x1 [0050.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0050.132] GetFileType (hFile=0x2b8) returned 0x1 [0050.132] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x16050 [0050.133] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=90182, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x16046 [0050.133] ReadFile (in: hFile=0x2b8, lpBuffer=0x287a958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x287a958*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0050.134] CloseHandle (hObject=0x2b8) returned 1 [0050.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0050.144] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0050.145] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x271d0b8 | out: lpFileInformation=0x271d0b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050)) returned 1 [0050.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0050.145] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0050.145] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.145] GetFileType (hFile=0x2b8) returned 0x1 [0050.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0050.145] GetFileType (hFile=0x2b8) returned 0x1 [0050.145] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x16050 [0050.146] ReadFile (in: hFile=0x2b8, lpBuffer=0x127d7f38, nNumberOfBytesToRead=0x16050, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x127d7f38*, lpNumberOfBytesRead=0x1c9aebd8*=0x16050, lpOverlapped=0x0) returned 1 [0050.147] CloseHandle (hObject=0x2b8) returned 1 [0050.187] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0050.187] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0050.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0050.191] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0050.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0050.191] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\README_3728769.txt" (normalized: "c:\\boot\\ru-ru\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.192] GetFileType (hFile=0x2b8) returned 0x1 [0050.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0050.192] GetFileType (hFile=0x2b8) returned 0x1 [0050.192] WriteFile (in: hFile=0x2b8, lpBuffer=0x27978a8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x27978a8*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0050.193] CloseHandle (hObject=0x2b8) returned 1 [0050.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.193] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0050.193] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0050.193] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.194] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.194] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.194] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.194] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.195] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0050.195] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0050.195] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.195] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.195] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.195] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.196] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.196] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0050.196] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.197] GetFileType (hFile=0x2b8) returned 0x1 [0050.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0050.197] GetFileType (hFile=0x2b8) returned 0x1 [0050.197] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x15640 [0050.197] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=87606, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x15636 [0050.197] ReadFile (in: hFile=0x2b8, lpBuffer=0x279a5c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x279a5c0*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0050.198] CloseHandle (hObject=0x2b8) returned 1 [0050.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0050.205] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0050.205] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2803c88 | out: lpFileInformation=0x2803c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640)) returned 1 [0050.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0050.205] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0050.205] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.205] GetFileType (hFile=0x2b8) returned 0x1 [0050.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0050.205] GetFileType (hFile=0x2b8) returned 0x1 [0050.205] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x15640 [0050.205] ReadFile (in: hFile=0x2b8, lpBuffer=0x1285c240, nNumberOfBytesToRead=0x15640, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x1285c240*, lpNumberOfBytesRead=0x1c9aebd8*=0x15640, lpOverlapped=0x0) returned 1 [0050.207] CloseHandle (hObject=0x2b8) returned 1 [0050.232] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0050.233] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0050.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0050.236] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0050.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0050.236] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\README_3728769.txt" (normalized: "c:\\boot\\sv-se\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.237] GetFileType (hFile=0x2b8) returned 0x1 [0050.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0050.237] GetFileType (hFile=0x2b8) returned 0x1 [0050.237] WriteFile (in: hFile=0x2b8, lpBuffer=0x287e1e0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x287e1e0*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0050.238] CloseHandle (hObject=0x2b8) returned 1 [0050.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.238] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0050.238] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0050.238] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.239] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.239] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.239] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.239] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.240] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0050.240] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0050.240] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.240] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.240] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.241] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.241] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.241] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0050.241] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.241] GetFileType (hFile=0x2b8) returned 0x1 [0050.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0050.241] GetFileType (hFile=0x2b8) returned 0x1 [0050.241] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x15440 [0050.241] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=87094, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x15436 [0050.241] ReadFile (in: hFile=0x2b8, lpBuffer=0x2880ef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2880ef8*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0050.243] CloseHandle (hObject=0x2b8) returned 1 [0050.243] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0050.259] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0050.259] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2718ce0 | out: lpFileInformation=0x2718ce0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440)) returned 1 [0050.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0050.259] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0050.259] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.259] GetFileType (hFile=0x2b8) returned 0x1 [0050.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0050.259] GetFileType (hFile=0x2b8) returned 0x1 [0050.259] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x15440 [0050.259] ReadFile (in: hFile=0x2b8, lpBuffer=0x128dc8e8, nNumberOfBytesToRead=0x15440, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x128dc8e8*, lpNumberOfBytesRead=0x1c9aebd8*=0x15440, lpOverlapped=0x0) returned 1 [0050.261] CloseHandle (hObject=0x2b8) returned 1 [0050.312] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0050.312] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0050.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0050.316] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0050.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0050.316] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\README_3728769.txt" (normalized: "c:\\boot\\tr-tr\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.316] GetFileType (hFile=0x2b8) returned 0x1 [0050.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0050.316] GetFileType (hFile=0x2b8) returned 0x1 [0050.316] WriteFile (in: hFile=0x2b8, lpBuffer=0x2795d78*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x2795d78*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0050.317] CloseHandle (hObject=0x2b8) returned 1 [0050.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.318] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0050.318] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0050.318] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.318] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.318] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.318] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.318] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.319] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0050.319] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0050.319] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.320] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.320] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.320] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.320] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.320] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0050.320] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.321] GetFileType (hFile=0x2b8) returned 0x1 [0050.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0050.321] GetFileType (hFile=0x2b8) returned 0x1 [0050.321] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x11440 [0050.321] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=70710, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x11436 [0050.321] ReadFile (in: hFile=0x2b8, lpBuffer=0x2798a90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2798a90*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0050.325] CloseHandle (hObject=0x2b8) returned 1 [0050.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0050.331] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0050.331] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x2802158 | out: lpFileInformation=0x2802158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440)) returned 1 [0050.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0050.331] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0050.331] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.332] GetFileType (hFile=0x2b8) returned 0x1 [0050.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0050.332] GetFileType (hFile=0x2b8) returned 0x1 [0050.332] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x11440 [0050.332] ReadFile (in: hFile=0x2b8, lpBuffer=0x2802370, nNumberOfBytesToRead=0x11440, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x2802370*, lpNumberOfBytesRead=0x1c9aebd8*=0x11440, lpOverlapped=0x0) returned 1 [0050.333] CloseHandle (hObject=0x2b8) returned 1 [0050.451] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0050.451] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0050.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0050.455] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0050.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0050.455] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\README_3728769.txt" (normalized: "c:\\boot\\zh-cn\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.456] GetFileType (hFile=0x2b8) returned 0x1 [0050.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0050.456] GetFileType (hFile=0x2b8) returned 0x1 [0050.456] WriteFile (in: hFile=0x2b8, lpBuffer=0x28c1820*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x28c1820*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0050.457] CloseHandle (hObject=0x2b8) returned 1 [0050.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.457] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0050.457] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0050.457] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.457] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.458] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.458] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.458] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.459] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0050.459] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0050.459] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.459] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.459] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.459] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.459] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.460] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0050.460] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.460] GetFileType (hFile=0x2b8) returned 0x1 [0050.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0050.460] GetFileType (hFile=0x2b8) returned 0x1 [0050.460] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x11250 [0050.460] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=70214, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x11246 [0050.460] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c4538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x28c4538*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0050.461] CloseHandle (hObject=0x2b8) returned 1 [0050.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0050.502] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0050.502] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x26eedd0 | out: lpFileInformation=0x26eedd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250)) returned 1 [0050.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0050.503] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0050.503] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.503] GetFileType (hFile=0x2b8) returned 0x1 [0050.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0050.503] GetFileType (hFile=0x2b8) returned 0x1 [0050.503] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x11250 [0050.503] ReadFile (in: hFile=0x2b8, lpBuffer=0x26eefe8, nNumberOfBytesToRead=0x11250, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x26eefe8*, lpNumberOfBytesRead=0x1c9aebd8*=0x11250, lpOverlapped=0x0) returned 1 [0050.504] CloseHandle (hObject=0x2b8) returned 1 [0050.540] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0050.540] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0050.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0050.543] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0050.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0050.544] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\README_3728769.txt" (normalized: "c:\\boot\\zh-hk\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.544] GetFileType (hFile=0x2b8) returned 0x1 [0050.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0050.544] GetFileType (hFile=0x2b8) returned 0x1 [0050.544] WriteFile (in: hFile=0x2b8, lpBuffer=0x27adf70*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x27adf70*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0050.545] CloseHandle (hObject=0x2b8) returned 1 [0050.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.545] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0050.545] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0050.545] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.546] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.546] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.546] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.546] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.547] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0050.547] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0050.547] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.547] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.548] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0050.548] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0050.548] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.548] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0050.548] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.548] GetFileType (hFile=0x2b8) returned 0x1 [0050.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0050.548] GetFileType (hFile=0x2b8) returned 0x1 [0050.548] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x11240 [0050.549] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=70198, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x11236 [0050.549] ReadFile (in: hFile=0x2b8, lpBuffer=0x27b0c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x27b0c88*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0050.550] CloseHandle (hObject=0x2b8) returned 1 [0050.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11170) returned 0x0 [0050.556] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0050.556] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x281a350 | out: lpFileInformation=0x281a350*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240)) returned 1 [0050.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0050.557] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0050.557] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.557] GetFileType (hFile=0x2b8) returned 0x1 [0050.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0050.557] GetFileType (hFile=0x2b8) returned 0x1 [0050.557] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x11240 [0050.557] ReadFile (in: hFile=0x2b8, lpBuffer=0x281a568, nNumberOfBytesToRead=0x11240, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x281a568*, lpNumberOfBytesRead=0x1c9aebd8*=0x11240, lpOverlapped=0x0) returned 1 [0050.558] CloseHandle (hObject=0x2b8) returned 1 [0050.585] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\bootmgr.exe.mui", lpFilePart=0x0) returned 0x1d [0050.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0050.585] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0050.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0050.592] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0050.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0050.593] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\README_3728769.txt" (normalized: "c:\\boot\\zh-tw\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.593] GetFileType (hFile=0x2b8) returned 0x1 [0050.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0050.593] GetFileType (hFile=0x2b8) returned 0x1 [0050.593] WriteFile (in: hFile=0x2b8, lpBuffer=0x2706d40*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x2706d40*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0050.594] CloseHandle (hObject=0x2b8) returned 1 [0050.596] GetFullPathNameW (in: lpFileName="C:\\Boot\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\README_3728769.txt", lpFilePart=0x0) returned 0x1a [0050.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebf0) returned 1 [0050.596] CreateFileW (lpFileName="C:\\Boot\\README_3728769.txt" (normalized: "c:\\boot\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.596] GetFileType (hFile=0x2b8) returned 0x1 [0050.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0050.596] GetFileType (hFile=0x2b8) returned 0x1 [0050.596] WriteFile (in: hFile=0x2b8, lpBuffer=0x270ad68*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aec38, lpOverlapped=0x0 | out: lpBuffer=0x270ad68*, lpNumberOfBytesWritten=0x1c9aec38*=0x5b3, lpOverlapped=0x0) returned 1 [0050.597] CloseHandle (hObject=0x2b8) returned 1 [0050.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0050.597] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd [0050.597] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe [0050.597] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.598] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.598] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.598] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0050.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0050.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0050.599] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd [0050.599] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe [0050.599] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.599] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.600] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.600] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0050.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0050.601] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\README_3728769.txt", lpFilePart=0x0) returned 0x20 [0050.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebf0) returned 1 [0050.601] CreateFileW (lpFileName="C:\\Config.Msi\\README_3728769.txt" (normalized: "c:\\config.msi\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0050.602] GetFileType (hFile=0x2b8) returned 0x1 [0050.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0050.602] GetFileType (hFile=0x2b8) returned 0x1 [0050.602] WriteFile (in: hFile=0x2b8, lpBuffer=0x27105f8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aec38, lpOverlapped=0x0 | out: lpBuffer=0x27105f8*, lpNumberOfBytesWritten=0x1c9aec38*=0x5b3, lpOverlapped=0x0) returned 1 [0050.603] CloseHandle (hObject=0x2b8) returned 1 [0050.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0050.603] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19 [0050.603] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\", lpFilePart=0x0) returned 0x1a [0050.603] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0050.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aecc0) returned 1 [0050.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0050.625] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0050.625] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0050.625] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.625] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.626] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0050.626] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0050.626] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0050.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0050.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0050.627] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0050.627] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0050.627] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.627] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.627] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0050.627] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.627] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0050.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0050.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.628] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0050.628] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0050.628] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.630] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.631] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0050.631] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0050.631] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0050.631] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0050.631] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0050.632] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0050.632] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0050.632] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0050.632] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0050.632] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0050.632] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0050.633] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0050.633] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0050.633] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0050.633] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0050.633] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0050.633] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0050.634] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0050.634] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0050.635] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0050.635] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0050.635] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.636] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.636] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0050.636] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0050.637] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0050.637] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0050.637] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0050.637] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0050.637] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0050.637] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0050.637] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0050.637] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0050.638] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0050.638] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0050.638] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0050.638] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0050.638] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0050.638] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0050.638] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0050.638] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.639] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0050.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0050.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0050.639] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0050.639] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0050.639] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.641] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.641] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0050.641] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0050.641] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0050.641] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.641] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0050.642] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0050.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0050.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0050.642] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0050.642] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0050.642] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0050.643] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.643] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0050.643] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0050.643] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0050.643] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.643] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.643] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0050.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0050.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0050.643] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpFilePart=0x0) returned 0x4a [0050.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0050.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.644] GetFileType (hFile=0x2b8) returned 0x1 [0050.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0050.644] GetFileType (hFile=0x2b8) returned 0x1 [0050.644] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x102fcbb [0050.644] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=16972977, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x102fcb1 [0050.645] ReadFile (in: hFile=0x2b8, lpBuffer=0x27201b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27201b8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0050.646] CloseHandle (hObject=0x2b8) returned 1 [0050.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11170) returned 0x0 [0050.648] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpFilePart=0x0) returned 0x4a [0050.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0050.649] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), fInfoLevelId=0x0, lpFileInformation=0x2789840 | out: lpFileInformation=0x2789840*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb)) returned 1 [0050.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0050.652] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpFilePart=0x0) returned 0x4a [0050.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0050.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.652] GetFileType (hFile=0x2b8) returned 0x1 [0050.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0050.652] GetFileType (hFile=0x2b8) returned 0x1 [0050.652] ReadFile (in: hFile=0x2b8, lpBuffer=0x126a62f8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x126a62f8*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0050.677] CloseHandle (hObject=0x2b8) returned 1 [0050.677] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpFilePart=0x0) returned 0x4a [0050.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0050.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0050.677] GetFileType (hFile=0x2b8) returned 0x1 [0050.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0050.677] GetFileType (hFile=0x2b8) returned 0x1 [0050.677] CoTaskMemAlloc (cb=0x1ea) returned 0x1cc70e60 [0050.758] CoTaskMemAlloc (cb=0xe) returned 0x1a7f7ec0 [0050.844] WriteFile (in: hFile=0x2b8, lpBuffer=0x127a6330*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127a6330*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0050.847] CloseHandle (hObject=0x2b8) returned 1 [0051.252] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpFilePart=0x0) returned 0x4a [0051.253] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpFilePart=0x0) returned 0x4a [0051.253] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpFilePart=0x0) returned 0x4a [0051.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0051.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0051.254] GetFileType (hFile=0x2b8) returned 0x1 [0051.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0051.254] GetFileType (hFile=0x2b8) returned 0x1 [0051.254] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x102fcbb [0051.254] WriteFile (in: hFile=0x2b8, lpBuffer=0x26aaa18*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26aaa18*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0051.312] CloseHandle (hObject=0x2b8) returned 1 [0051.664] CoTaskMemAlloc (cb=0x13) returned 0x1a7f7ea0 [0051.668] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpFilePart=0x0) returned 0x4a [0051.668] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RXhjZWxMUi5jYWI=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RXhjZWxMUi5jYWI=", lpFilePart=0x0) returned 0x4f [0051.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0051.669] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc6c70860, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x102fcc5)) returned 1 [0051.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0051.669] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RXhjZWxMUi5jYWI=" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\rxhjzwxmui5jywi=")) returned 1 [0051.748] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpFilePart=0x0) returned 0x4b [0051.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0051.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0051.748] GetFileType (hFile=0x2b8) returned 0x1 [0051.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0051.748] GetFileType (hFile=0x2b8) returned 0x1 [0051.748] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x263e00 [0051.748] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2506230, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x263df6 [0051.749] ReadFile (in: hFile=0x2b8, lpBuffer=0x26b1198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26b1198*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0051.750] CloseHandle (hObject=0x2b8) returned 1 [0051.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11490) returned 0x0 [0051.759] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpFilePart=0x0) returned 0x4b [0051.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0051.760] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x271aca0 | out: lpFileInformation=0x271aca0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00)) returned 1 [0051.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0051.762] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpFilePart=0x0) returned 0x4b [0051.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0051.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0051.762] GetFileType (hFile=0x2b8) returned 0x1 [0051.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0051.762] GetFileType (hFile=0x2b8) returned 0x1 [0051.762] ReadFile (in: hFile=0x2b8, lpBuffer=0x129a63a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x129a63a0*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0051.828] CloseHandle (hObject=0x2b8) returned 1 [0051.829] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpFilePart=0x0) returned 0x4b [0051.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0051.829] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0051.829] GetFileType (hFile=0x2b8) returned 0x1 [0051.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0051.829] GetFileType (hFile=0x2b8) returned 0x1 [0051.971] WriteFile (in: hFile=0x2b8, lpBuffer=0x12661968*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0051.974] CloseHandle (hObject=0x2b8) returned 1 [0052.023] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpFilePart=0x0) returned 0x4b [0052.024] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpFilePart=0x0) returned 0x4b [0052.024] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpFilePart=0x0) returned 0x4b [0052.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0052.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.024] GetFileType (hFile=0x2b8) returned 0x1 [0052.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0052.024] GetFileType (hFile=0x2b8) returned 0x1 [0052.024] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x263e00 [0052.024] WriteFile (in: hFile=0x2b8, lpBuffer=0x26a7420*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26a7420*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0052.025] CloseHandle (hObject=0x2b8) returned 1 [0052.080] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", lpFilePart=0x0) returned 0x4b [0052.080] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RXhjZWxNVUkubXNp", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RXhjZWxNVUkubXNp", lpFilePart=0x0) returned 0x4f [0052.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0052.080] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc7074d80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x263e0a)) returned 1 [0052.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0052.080] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RXhjZWxNVUkubXNp" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\rxhjzwxnvukubxnp")) returned 1 [0052.081] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0052.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0052.081] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.081] GetFileType (hFile=0x2b8) returned 0x1 [0052.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0052.081] GetFileType (hFile=0x2b8) returned 0x1 [0052.081] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x61d [0052.081] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1555, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x613 [0052.081] ReadFile (in: hFile=0x2b8, lpBuffer=0x26ae6a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26ae6a0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0052.083] CloseHandle (hObject=0x2b8) returned 1 [0052.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0052.092] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0052.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0052.092] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x27430c8 | out: lpFileInformation=0x27430c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1 [0052.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0052.092] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0052.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0052.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.092] GetFileType (hFile=0x2b8) returned 0x1 [0052.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0052.093] GetFileType (hFile=0x2b8) returned 0x1 [0052.093] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x61d [0052.093] ReadFile (in: hFile=0x2b8, lpBuffer=0x27439c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27439c8*, lpNumberOfBytesRead=0x1c9aeb38*=0x61d, lpOverlapped=0x0) returned 1 [0052.093] CloseHandle (hObject=0x2b8) returned 1 [0052.130] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0052.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0052.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.131] GetFileType (hFile=0x2b8) returned 0x1 [0052.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0052.131] GetFileType (hFile=0x2b8) returned 0x1 [0052.131] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c04b0*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27c04b0*, lpNumberOfBytesWritten=0x1c9aea78*=0x620, lpOverlapped=0x0) returned 1 [0052.132] CloseHandle (hObject=0x2b8) returned 1 [0052.133] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0052.133] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0052.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0052.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.133] GetFileType (hFile=0x2b8) returned 0x1 [0052.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0052.133] GetFileType (hFile=0x2b8) returned 0x1 [0052.133] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x620 [0052.134] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c22f0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27c22f0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0052.134] CloseHandle (hObject=0x2b8) returned 1 [0052.134] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0052.134] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RXhjZWxNVUkueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RXhjZWxNVUkueG1s", lpFilePart=0x0) returned 0x4f [0052.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0052.135] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc710d300, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x62a)) returned 1 [0052.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0052.135] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RXhjZWxNVUkueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\rxhjzwxnvukueg1s")) returned 1 [0052.135] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0052.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0052.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.136] GetFileType (hFile=0x2b8) returned 0x1 [0052.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0052.136] GetFileType (hFile=0x2b8) returned 0x1 [0052.136] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x8f8 [0052.136] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2286, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x8ee [0052.136] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c3700, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27c3700*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0052.138] CloseHandle (hObject=0x2b8) returned 1 [0052.138] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0052.144] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0052.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0052.144] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x282d298 | out: lpFileInformation=0x282d298*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8)) returned 1 [0052.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0052.144] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0052.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0052.144] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.144] GetFileType (hFile=0x2b8) returned 0x1 [0052.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0052.144] GetFileType (hFile=0x2b8) returned 0x1 [0052.144] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x8f8 [0052.144] ReadFile (in: hFile=0x2b8, lpBuffer=0x282de60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x282de60*, lpNumberOfBytesRead=0x1c9aeb38*=0x8f8, lpOverlapped=0x0) returned 1 [0052.145] CloseHandle (hObject=0x2b8) returned 1 [0052.193] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0052.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0052.193] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.194] GetFileType (hFile=0x2b8) returned 0x1 [0052.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0052.194] GetFileType (hFile=0x2b8) returned 0x1 [0052.194] WriteFile (in: hFile=0x2b8, lpBuffer=0x270aa68*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x270aa68*, lpNumberOfBytesWritten=0x1c9aea78*=0x900, lpOverlapped=0x0) returned 1 [0052.195] CloseHandle (hObject=0x2b8) returned 1 [0052.196] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0052.196] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0052.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0052.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.196] GetFileType (hFile=0x2b8) returned 0x1 [0052.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0052.196] GetFileType (hFile=0x2b8) returned 0x1 [0052.196] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x900 [0052.196] WriteFile (in: hFile=0x2b8, lpBuffer=0x270c890*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x270c890*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0052.202] CloseHandle (hObject=0x2b8) returned 1 [0052.203] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0052.203] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0052.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0052.203] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc71a5880, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x90a)) returned 1 [0052.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0052.203] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0052.204] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0052.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0052.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0052.204] GetFileType (hFile=0x2b8) returned 0x1 [0052.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0052.204] GetFileType (hFile=0x2b8) returned 0x1 [0052.205] WriteFile (in: hFile=0x2b8, lpBuffer=0x2710bc8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2710bc8*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0052.206] CloseHandle (hObject=0x2b8) returned 1 [0052.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0052.206] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0052.206] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0052.206] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0052.225] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.225] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0052.225] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0052.225] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0052.225] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.225] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0052.225] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0052.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0052.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0052.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0052.226] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0052.226] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0052.226] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0052.231] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.231] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0052.231] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0052.231] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0052.232] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.232] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0052.232] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0052.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0052.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0052.233] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpFilePart=0x0) returned 0x50 [0052.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0052.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.233] GetFileType (hFile=0x2b8) returned 0x1 [0052.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0052.234] GetFileType (hFile=0x2b8) returned 0x1 [0052.234] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x263400 [0052.234] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2503670, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2633f6 [0052.234] ReadFile (in: hFile=0x2b8, lpBuffer=0x27179c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27179c0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0052.235] CloseHandle (hObject=0x2b8) returned 1 [0052.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0052.241] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpFilePart=0x0) returned 0x50 [0052.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0052.242] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x2781558 | out: lpFileInformation=0x2781558*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400)) returned 1 [0052.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0052.246] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpFilePart=0x0) returned 0x50 [0052.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0052.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.246] GetFileType (hFile=0x2b8) returned 0x1 [0052.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0052.246] GetFileType (hFile=0x2b8) returned 0x1 [0052.246] ReadFile (in: hFile=0x2b8, lpBuffer=0x127619a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0052.256] CloseHandle (hObject=0x2b8) returned 1 [0052.262] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpFilePart=0x0) returned 0x50 [0052.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0052.262] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.262] GetFileType (hFile=0x2b8) returned 0x1 [0052.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0052.262] GetFileType (hFile=0x2b8) returned 0x1 [0052.367] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0052.370] CloseHandle (hObject=0x2b8) returned 1 [0052.461] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpFilePart=0x0) returned 0x50 [0052.462] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpFilePart=0x0) returned 0x50 [0052.462] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpFilePart=0x0) returned 0x50 [0052.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0052.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.462] GetFileType (hFile=0x2b8) returned 0x1 [0052.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0052.462] GetFileType (hFile=0x2b8) returned 0x1 [0052.462] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x263400 [0052.462] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bbfd0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26bbfd0*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0052.462] CloseHandle (hObject=0x2b8) returned 1 [0052.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", lpFilePart=0x0) returned 0x50 [0052.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UG93ZXJQb2ludE1VSS5tc2k=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UG93ZXJQb2ludE1VSS5tc2k=", lpFilePart=0x0) returned 0x57 [0052.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0052.519] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc749f400, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x26340a)) returned 1 [0052.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0052.520] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UG93ZXJQb2ludE1VSS5tc2k=" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\ug93zxjqb2lude1vss5tc2k=")) returned 1 [0052.520] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0052.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0052.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.520] GetFileType (hFile=0x2b8) returned 0x1 [0052.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0052.520] GetFileType (hFile=0x2b8) returned 0x1 [0052.520] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x5aa [0052.521] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1440, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x5a0 [0052.521] ReadFile (in: hFile=0x2b8, lpBuffer=0x26bd430, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26bd430*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0052.522] CloseHandle (hObject=0x2b8) returned 1 [0052.523] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0052.529] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0052.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0052.529] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2746c88 | out: lpFileInformation=0x2746c88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa)) returned 1 [0052.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0052.530] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0052.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0052.530] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.530] GetFileType (hFile=0x2b8) returned 0x1 [0052.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0052.530] GetFileType (hFile=0x2b8) returned 0x1 [0052.530] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x5aa [0052.530] ReadFile (in: hFile=0x2b8, lpBuffer=0x2747548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2747548*, lpNumberOfBytesRead=0x1c9aeb38*=0x5aa, lpOverlapped=0x0) returned 1 [0052.530] CloseHandle (hObject=0x2b8) returned 1 [0052.564] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0052.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0052.564] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.566] GetFileType (hFile=0x2b8) returned 0x1 [0052.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0052.566] GetFileType (hFile=0x2b8) returned 0x1 [0052.566] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c1278*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27c1278*, lpNumberOfBytesWritten=0x1c9aea78*=0x5b0, lpOverlapped=0x0) returned 1 [0052.567] CloseHandle (hObject=0x2b8) returned 1 [0052.568] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0052.568] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0052.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0052.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.568] GetFileType (hFile=0x2b8) returned 0x1 [0052.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0052.568] GetFileType (hFile=0x2b8) returned 0x1 [0052.568] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x5b0 [0052.568] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c3110*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27c3110*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0052.569] CloseHandle (hObject=0x2b8) returned 1 [0052.569] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0052.569] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UG93ZXJQb2ludE1VSS54bWw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UG93ZXJQb2ludE1VSS54bWw=", lpFilePart=0x0) returned 0x57 [0052.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0052.569] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc7511820, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x5ba)) returned 1 [0052.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0052.569] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UG93ZXJQb2ludE1VSS54bWw=" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\ug93zxjqb2lude1vss54bww=")) returned 1 [0052.570] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpFilePart=0x0) returned 0x48 [0052.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0052.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.588] GetFileType (hFile=0x2b8) returned 0x1 [0052.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0052.588] GetFileType (hFile=0x2b8) returned 0x1 [0052.588] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x431a290 [0052.588] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=70361734, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x431a286 [0052.588] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c6df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27c6df8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0052.590] CloseHandle (hObject=0x2b8) returned 1 [0052.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0052.606] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpFilePart=0x0) returned 0x48 [0052.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0052.606] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x26e5088 | out: lpFileInformation=0x26e5088*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290)) returned 1 [0052.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0052.608] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpFilePart=0x0) returned 0x48 [0052.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0052.608] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.609] GetFileType (hFile=0x2b8) returned 0x1 [0052.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0052.609] GetFileType (hFile=0x2b8) returned 0x1 [0052.609] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61a48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0052.633] CloseHandle (hObject=0x2b8) returned 1 [0052.633] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpFilePart=0x0) returned 0x48 [0052.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0052.634] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0052.634] GetFileType (hFile=0x2b8) returned 0x1 [0052.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0052.634] GetFileType (hFile=0x2b8) returned 0x1 [0052.736] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0052.739] CloseHandle (hObject=0x2b8) returned 1 [0053.133] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpFilePart=0x0) returned 0x48 [0053.134] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpFilePart=0x0) returned 0x48 [0053.134] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpFilePart=0x0) returned 0x48 [0053.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0053.134] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.134] GetFileType (hFile=0x2b8) returned 0x1 [0053.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0053.134] GetFileType (hFile=0x2b8) returned 0x1 [0053.134] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x431a290 [0053.135] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bed00*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26bed00*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0053.135] CloseHandle (hObject=0x2b8) returned 1 [0053.437] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpFilePart=0x0) returned 0x48 [0053.437] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UHB0TFIuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UHB0TFIuY2Fi", lpFilePart=0x0) returned 0x4b [0053.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0053.437] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc7ccdfa0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x431a29a)) returned 1 [0053.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0053.438] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UHB0TFIuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\uhb0tfiuy2fi")) returned 1 [0053.438] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0053.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0053.438] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.438] GetFileType (hFile=0x2b8) returned 0x1 [0053.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0053.438] GetFileType (hFile=0x2b8) returned 0x1 [0053.438] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x75e [0053.439] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1876, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x754 [0053.439] ReadFile (in: hFile=0x2b8, lpBuffer=0x26c5448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26c5448*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0053.440] CloseHandle (hObject=0x2b8) returned 1 [0053.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0053.448] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0053.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0053.448] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2730c38 | out: lpFileInformation=0x2730c38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e)) returned 1 [0053.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0053.448] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0053.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0053.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.448] GetFileType (hFile=0x2b8) returned 0x1 [0053.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0053.448] GetFileType (hFile=0x2b8) returned 0x1 [0053.448] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x75e [0053.448] ReadFile (in: hFile=0x2b8, lpBuffer=0x2731668, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2731668*, lpNumberOfBytesRead=0x1c9aeb38*=0x75e, lpOverlapped=0x0) returned 1 [0053.448] CloseHandle (hObject=0x2b8) returned 1 [0053.473] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0053.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0053.473] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.474] GetFileType (hFile=0x2b8) returned 0x1 [0053.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0053.474] GetFileType (hFile=0x2b8) returned 0x1 [0053.474] WriteFile (in: hFile=0x2b8, lpBuffer=0x27abe10*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27abe10*, lpNumberOfBytesWritten=0x1c9aea78*=0x760, lpOverlapped=0x0) returned 1 [0053.476] CloseHandle (hObject=0x2b8) returned 1 [0053.477] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0053.477] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0053.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0053.477] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.477] GetFileType (hFile=0x2b8) returned 0x1 [0053.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0053.477] GetFileType (hFile=0x2b8) returned 0x1 [0053.477] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x760 [0053.477] WriteFile (in: hFile=0x2b8, lpBuffer=0x27adc38*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27adc38*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0053.477] CloseHandle (hObject=0x2b8) returned 1 [0053.478] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0053.478] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0053.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0053.478] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc7d403c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x76a)) returned 1 [0053.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0053.478] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0053.479] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0053.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0053.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0053.479] GetFileType (hFile=0x2b8) returned 0x1 [0053.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0053.479] GetFileType (hFile=0x2b8) returned 0x1 [0053.479] WriteFile (in: hFile=0x2b8, lpBuffer=0x27b1f70*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x27b1f70*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0053.480] CloseHandle (hObject=0x2b8) returned 1 [0053.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0053.480] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0053.480] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0053.481] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0053.483] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.484] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0053.484] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0053.484] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0053.484] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.484] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0053.484] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0053.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0053.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0053.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0053.485] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0053.485] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0053.485] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0053.486] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.486] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0053.487] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0053.487] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0053.487] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.487] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0053.487] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0053.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0053.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0053.488] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpFilePart=0x0) returned 0x4f [0053.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0053.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.490] GetFileType (hFile=0x2b8) returned 0x1 [0053.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0053.490] GetFileType (hFile=0x2b8) returned 0x1 [0053.490] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x265c00 [0053.490] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2513910, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x265bf6 [0053.490] ReadFile (in: hFile=0x2b8, lpBuffer=0x27b6478, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27b6478*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0053.491] CloseHandle (hObject=0x2b8) returned 1 [0053.492] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0053.497] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpFilePart=0x0) returned 0x4f [0053.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0053.497] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), fInfoLevelId=0x0, lpFileInformation=0x2820010 | out: lpFileInformation=0x2820010*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00)) returned 1 [0053.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0053.502] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpFilePart=0x0) returned 0x4f [0053.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0053.502] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.502] GetFileType (hFile=0x2b8) returned 0x1 [0053.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0053.502] GetFileType (hFile=0x2b8) returned 0x1 [0053.502] ReadFile (in: hFile=0x2b8, lpBuffer=0x128619d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0053.517] CloseHandle (hObject=0x2b8) returned 1 [0053.517] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpFilePart=0x0) returned 0x4f [0053.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0053.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.518] GetFileType (hFile=0x2b8) returned 0x1 [0053.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0053.518] GetFileType (hFile=0x2b8) returned 0x1 [0053.663] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0053.666] CloseHandle (hObject=0x2b8) returned 1 [0053.706] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpFilePart=0x0) returned 0x4f [0053.706] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpFilePart=0x0) returned 0x4f [0053.706] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpFilePart=0x0) returned 0x4f [0053.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0053.706] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.706] GetFileType (hFile=0x2b8) returned 0x1 [0053.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0053.706] GetFileType (hFile=0x2b8) returned 0x1 [0053.706] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x265c00 [0053.706] WriteFile (in: hFile=0x2b8, lpBuffer=0x26e6ab0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26e6ab0*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0053.706] CloseHandle (hObject=0x2b8) returned 1 [0053.752] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", lpFilePart=0x0) returned 0x4f [0053.752] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UHVibGlzaGVyTVVJLm1zaQ==", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UHVibGlzaGVyTVVJLm1zaQ==", lpFilePart=0x0) returned 0x57 [0053.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0053.752] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc7fc7b20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x265c0a)) returned 1 [0053.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0053.753] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UHVibGlzaGVyTVVJLm1zaQ==" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\uhvibglzagvytvvjlm1zaq==")) returned 1 [0053.753] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0053.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0053.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.754] GetFileType (hFile=0x2b8) returned 0x1 [0053.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0053.754] GetFileType (hFile=0x2b8) returned 0x1 [0053.754] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x5aa [0053.754] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1440, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x5a0 [0053.754] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e7f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26e7f00*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0053.755] CloseHandle (hObject=0x2b8) returned 1 [0053.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0053.761] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0053.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0053.762] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2751a98 | out: lpFileInformation=0x2751a98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa)) returned 1 [0053.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0053.762] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0053.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0053.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.762] GetFileType (hFile=0x2b8) returned 0x1 [0053.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0053.762] GetFileType (hFile=0x2b8) returned 0x1 [0053.762] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x5aa [0053.762] ReadFile (in: hFile=0x2b8, lpBuffer=0x2752348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2752348*, lpNumberOfBytesRead=0x1c9aeb38*=0x5aa, lpOverlapped=0x0) returned 1 [0053.762] CloseHandle (hObject=0x2b8) returned 1 [0053.788] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0053.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0053.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.789] GetFileType (hFile=0x2b8) returned 0x1 [0053.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0053.789] GetFileType (hFile=0x2b8) returned 0x1 [0053.789] WriteFile (in: hFile=0x2b8, lpBuffer=0x27ce5e8*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27ce5e8*, lpNumberOfBytesWritten=0x1c9aea78*=0x5b0, lpOverlapped=0x0) returned 1 [0053.790] CloseHandle (hObject=0x2b8) returned 1 [0053.791] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0053.791] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0053.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0053.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.791] GetFileType (hFile=0x2b8) returned 0x1 [0053.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0053.791] GetFileType (hFile=0x2b8) returned 0x1 [0053.792] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x5b0 [0053.792] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d0460*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27d0460*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0053.792] CloseHandle (hObject=0x2b8) returned 1 [0053.792] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0053.792] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UHVibGlzaGVyTVVJLnhtbA==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UHVibGlzaGVyTVVJLnhtbA==", lpFilePart=0x0) returned 0x57 [0053.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0053.792] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc8039f40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x5ba)) returned 1 [0053.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0053.793] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UHVibGlzaGVyTVVJLnhtbA==" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\uhvibglzagvytvvjlnhtba==")) returned 1 [0053.793] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpFilePart=0x0) returned 0x48 [0053.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0053.793] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.793] GetFileType (hFile=0x2b8) returned 0x1 [0053.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0053.794] GetFileType (hFile=0x2b8) returned 0x1 [0053.794] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x97f3f4 [0053.794] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=9958378, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x97f3ea [0053.794] ReadFile (in: hFile=0x2b8, lpBuffer=0x27d1898, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27d1898*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0053.795] CloseHandle (hObject=0x2b8) returned 1 [0053.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0053.797] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpFilePart=0x0) returned 0x48 [0053.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0053.797] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), fInfoLevelId=0x0, lpFileInformation=0x283b510 | out: lpFileInformation=0x283b510*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4)) returned 1 [0053.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0053.855] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpFilePart=0x0) returned 0x48 [0053.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0053.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.855] GetFileType (hFile=0x2b8) returned 0x1 [0053.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0053.855] GetFileType (hFile=0x2b8) returned 0x1 [0053.855] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0053.889] CloseHandle (hObject=0x2b8) returned 1 [0053.889] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpFilePart=0x0) returned 0x48 [0053.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0053.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0053.889] GetFileType (hFile=0x2b8) returned 0x1 [0053.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0053.889] GetFileType (hFile=0x2b8) returned 0x1 [0053.980] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0053.983] CloseHandle (hObject=0x2b8) returned 1 [0054.299] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpFilePart=0x0) returned 0x48 [0054.299] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpFilePart=0x0) returned 0x48 [0054.299] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpFilePart=0x0) returned 0x48 [0054.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0054.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0054.300] GetFileType (hFile=0x2b8) returned 0x1 [0054.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0054.300] GetFileType (hFile=0x2b8) returned 0x1 [0054.300] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x97f3f4 [0054.300] WriteFile (in: hFile=0x2b8, lpBuffer=0x276d630*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x276d630*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0054.300] CloseHandle (hObject=0x2b8) returned 1 [0054.597] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpFilePart=0x0) returned 0x48 [0054.597] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UHViTFIuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UHViTFIuY2Fi", lpFilePart=0x0) returned 0x4b [0054.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0054.597] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc8737fe0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x97f3fe)) returned 1 [0054.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0054.597] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UHViTFIuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\uhvitfiuy2fi")) returned 1 [0054.598] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0054.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0054.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0054.598] GetFileType (hFile=0x2b8) returned 0x1 [0054.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0054.598] GetFileType (hFile=0x2b8) returned 0x1 [0054.598] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x648 [0054.598] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1598, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x63e [0054.598] ReadFile (in: hFile=0x2b8, lpBuffer=0x27714d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27714d8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0054.600] CloseHandle (hObject=0x2b8) returned 1 [0054.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0054.637] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0054.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0054.637] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x26dced8 | out: lpFileInformation=0x26dced8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648)) returned 1 [0054.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0054.637] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0054.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0054.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0054.638] GetFileType (hFile=0x2b8) returned 0x1 [0054.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0054.638] GetFileType (hFile=0x2b8) returned 0x1 [0054.638] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x648 [0054.638] ReadFile (in: hFile=0x2b8, lpBuffer=0x26dd7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26dd7f0*, lpNumberOfBytesRead=0x1c9aeb38*=0x648, lpOverlapped=0x0) returned 1 [0054.638] CloseHandle (hObject=0x2b8) returned 1 [0054.668] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0054.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0054.668] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0054.669] GetFileType (hFile=0x2b8) returned 0x1 [0054.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0054.669] GetFileType (hFile=0x2b8) returned 0x1 [0054.669] WriteFile (in: hFile=0x2b8, lpBuffer=0x27574f0*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27574f0*, lpNumberOfBytesWritten=0x1c9aea78*=0x650, lpOverlapped=0x0) returned 1 [0054.669] CloseHandle (hObject=0x2b8) returned 1 [0054.671] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0054.671] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0054.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0054.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0054.671] GetFileType (hFile=0x2b8) returned 0x1 [0054.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0054.671] GetFileType (hFile=0x2b8) returned 0x1 [0054.671] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x650 [0054.671] WriteFile (in: hFile=0x2b8, lpBuffer=0x2759318*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2759318*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0054.671] CloseHandle (hObject=0x2b8) returned 1 [0054.672] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0054.672] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0054.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0054.672] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc87f66c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x65a)) returned 1 [0054.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0054.672] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0054.673] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0054.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0054.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0054.673] GetFileType (hFile=0x2b8) returned 0x1 [0054.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0054.673] GetFileType (hFile=0x2b8) returned 0x1 [0054.673] WriteFile (in: hFile=0x2b8, lpBuffer=0x275d650*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x275d650*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0054.674] CloseHandle (hObject=0x2b8) returned 1 [0054.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0054.674] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0054.674] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0054.674] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0054.697] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0054.698] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.698] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0054.698] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0054.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0054.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0054.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0054.699] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0054.699] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0054.699] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0054.700] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.701] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.701] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0054.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0054.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0054.702] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpFilePart=0x0) returned 0x4a [0054.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0054.702] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0054.703] GetFileType (hFile=0x2b8) returned 0x1 [0054.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0054.703] GetFileType (hFile=0x2b8) returned 0x1 [0054.703] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xe21fcc [0054.703] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=14819266, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xe21fc2 [0054.703] ReadFile (in: hFile=0x2b8, lpBuffer=0x27643c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27643c8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0054.705] CloseHandle (hObject=0x2b8) returned 1 [0054.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0054.711] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpFilePart=0x0) returned 0x4a [0054.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0054.711] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), fInfoLevelId=0x0, lpFileInformation=0x27ce0c0 | out: lpFileInformation=0x27ce0c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc)) returned 1 [0054.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0054.713] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpFilePart=0x0) returned 0x4a [0054.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0054.713] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0054.713] GetFileType (hFile=0x2b8) returned 0x1 [0054.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0054.714] GetFileType (hFile=0x2b8) returned 0x1 [0054.714] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0054.737] CloseHandle (hObject=0x2b8) returned 1 [0054.737] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpFilePart=0x0) returned 0x4a [0054.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0054.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0054.737] GetFileType (hFile=0x2b8) returned 0x1 [0054.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0054.737] GetFileType (hFile=0x2b8) returned 0x1 [0054.817] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0054.820] CloseHandle (hObject=0x2b8) returned 1 [0055.279] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpFilePart=0x0) returned 0x4a [0055.279] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpFilePart=0x0) returned 0x4a [0055.280] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpFilePart=0x0) returned 0x4a [0055.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0055.280] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.280] GetFileType (hFile=0x2b8) returned 0x1 [0055.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0055.280] GetFileType (hFile=0x2b8) returned 0x1 [0055.280] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0xe21fcc [0055.281] WriteFile (in: hFile=0x2b8, lpBuffer=0x26aa6b0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26aa6b0*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0055.343] CloseHandle (hObject=0x2b8) returned 1 [0055.618] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpFilePart=0x0) returned 0x4a [0055.618] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\T3V0bGtMUi5jYWI=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\T3V0bGtMUi5jYWI=", lpFilePart=0x0) returned 0x4f [0055.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0055.618] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc9071520, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe21fd6)) returned 1 [0055.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0055.618] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\T3V0bGtMUi5jYWI=" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\t3v0bgtmui5jywi=")) returned 1 [0055.619] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpFilePart=0x0) returned 0x4d [0055.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0055.620] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.620] GetFileType (hFile=0x2b8) returned 0x1 [0055.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0055.620] GetFileType (hFile=0x2b8) returned 0x1 [0055.620] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2bba00 [0055.620] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2865654, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2bb9f6 [0055.620] ReadFile (in: hFile=0x2b8, lpBuffer=0x26b0e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26b0e20*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0055.622] CloseHandle (hObject=0x2b8) returned 1 [0055.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0055.629] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpFilePart=0x0) returned 0x4d [0055.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0055.629] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x271a9b8 | out: lpFileInformation=0x271a9b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00)) returned 1 [0055.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0055.632] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpFilePart=0x0) returned 0x4d [0055.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0055.632] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.632] GetFileType (hFile=0x2b8) returned 0x1 [0055.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0055.632] GetFileType (hFile=0x2b8) returned 0x1 [0055.632] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0055.657] CloseHandle (hObject=0x2b8) returned 1 [0055.657] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpFilePart=0x0) returned 0x4d [0055.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0055.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.657] GetFileType (hFile=0x2b8) returned 0x1 [0055.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0055.657] GetFileType (hFile=0x2b8) returned 0x1 [0055.774] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a61a48*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0055.777] CloseHandle (hObject=0x2b8) returned 1 [0055.832] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpFilePart=0x0) returned 0x4d [0055.833] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpFilePart=0x0) returned 0x4d [0055.833] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpFilePart=0x0) returned 0x4d [0055.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0055.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.833] GetFileType (hFile=0x2b8) returned 0x1 [0055.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0055.833] GetFileType (hFile=0x2b8) returned 0x1 [0055.833] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x2bba00 [0055.834] WriteFile (in: hFile=0x2b8, lpBuffer=0x26a9b78*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26a9b78*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0055.834] CloseHandle (hObject=0x2b8) returned 1 [0055.873] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", lpFilePart=0x0) returned 0x4d [0055.873] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\T3V0bG9va01VSS5tc2k=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\T3V0bG9va01VSS5tc2k=", lpFilePart=0x0) returned 0x53 [0055.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0055.873] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc92d2b20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x2bba0a)) returned 1 [0055.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0055.873] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\T3V0bG9va01VSS5tc2k=" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\t3v0bg9va01vss5tc2k=")) returned 1 [0055.874] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0055.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0055.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.874] GetFileType (hFile=0x2b8) returned 0x1 [0055.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0055.874] GetFileType (hFile=0x2b8) returned 0x1 [0055.874] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xc72 [0055.874] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=3176, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xc68 [0055.874] ReadFile (in: hFile=0x2b8, lpBuffer=0x26ab838, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26ab838*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0055.876] CloseHandle (hObject=0x2b8) returned 1 [0055.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0055.886] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0055.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0055.886] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x27408a0 | out: lpFileInformation=0x27408a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72)) returned 1 [0055.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0055.886] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0055.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0055.887] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.887] GetFileType (hFile=0x2b8) returned 0x1 [0055.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0055.887] GetFileType (hFile=0x2b8) returned 0x1 [0055.887] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xc72 [0055.887] ReadFile (in: hFile=0x2b8, lpBuffer=0x2741808, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2741808*, lpNumberOfBytesRead=0x1c9aeb38*=0xc72, lpOverlapped=0x0) returned 1 [0055.887] CloseHandle (hObject=0x2b8) returned 1 [0055.912] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0055.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0055.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.913] GetFileType (hFile=0x2b8) returned 0x1 [0055.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0055.913] GetFileType (hFile=0x2b8) returned 0x1 [0055.913] WriteFile (in: hFile=0x2b8, lpBuffer=0x27bda80*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27bda80*, lpNumberOfBytesWritten=0x1c9aea78*=0xc80, lpOverlapped=0x0) returned 1 [0055.914] CloseHandle (hObject=0x2b8) returned 1 [0055.915] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0055.915] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0055.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0055.915] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.915] GetFileType (hFile=0x2b8) returned 0x1 [0055.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0055.915] GetFileType (hFile=0x2b8) returned 0x1 [0055.915] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xc80 [0055.915] WriteFile (in: hFile=0x2b8, lpBuffer=0x27bf8e0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27bf8e0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0055.916] CloseHandle (hObject=0x2b8) returned 1 [0055.916] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0055.916] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\T3V0bG9va01VSS54bWw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\T3V0bG9va01VSS54bWw=", lpFilePart=0x0) returned 0x53 [0055.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0055.916] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc9344f40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xc8a)) returned 1 [0055.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0055.916] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\T3V0bG9va01VSS54bWw=" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\t3v0bg9va01vss54bww=")) returned 1 [0055.917] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0055.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0055.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.918] GetFileType (hFile=0x2b8) returned 0x1 [0055.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0055.918] GetFileType (hFile=0x2b8) returned 0x1 [0055.918] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x106f [0055.918] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=4197, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1065 [0055.918] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c0d08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27c0d08*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0055.920] CloseHandle (hObject=0x2b8) returned 1 [0055.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0055.934] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0055.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0055.934] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e9f38 | out: lpFileInformation=0x26e9f38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f)) returned 1 [0055.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0055.934] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0055.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0055.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.934] GetFileType (hFile=0x2b8) returned 0x1 [0055.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0055.934] GetFileType (hFile=0x2b8) returned 0x1 [0055.934] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x106f [0055.934] ReadFile (in: hFile=0x2b8, lpBuffer=0x26ea1f0, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26ea1f0*, lpNumberOfBytesRead=0x1c9aeb38*=0x106f, lpOverlapped=0x0) returned 1 [0055.935] CloseHandle (hObject=0x2b8) returned 1 [0055.969] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0055.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0055.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.970] GetFileType (hFile=0x2b8) returned 0x1 [0055.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0055.970] GetFileType (hFile=0x2b8) returned 0x1 [0055.970] WriteFile (in: hFile=0x2b8, lpBuffer=0x2766010*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2766010*, lpNumberOfBytesWritten=0x1c9aebc8*=0x1070, lpOverlapped=0x0) returned 1 [0055.971] CloseHandle (hObject=0x2b8) returned 1 [0055.972] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0055.972] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0055.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0055.972] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0055.972] GetFileType (hFile=0x2b8) returned 0x1 [0055.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0055.972] GetFileType (hFile=0x2b8) returned 0x1 [0055.972] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x1070 [0055.972] WriteFile (in: hFile=0x2b8, lpBuffer=0x2768010*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2768010*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0055.973] CloseHandle (hObject=0x2b8) returned 1 [0055.981] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0055.981] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0055.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0055.981] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc93dd4c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x107a)) returned 1 [0055.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0055.981] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0055.982] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0055.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0055.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0055.983] GetFileType (hFile=0x2b8) returned 0x1 [0055.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0055.983] GetFileType (hFile=0x2b8) returned 0x1 [0055.983] WriteFile (in: hFile=0x2b8, lpBuffer=0x276c348*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x276c348*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0055.984] CloseHandle (hObject=0x2b8) returned 1 [0055.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0055.984] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0055.984] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0055.984] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0056.034] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.034] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0056.034] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0056.034] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0056.034] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0056.035] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0056.035] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0056.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0056.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0056.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0056.035] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0056.035] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0056.035] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0056.035] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.036] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0056.036] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0056.036] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0056.036] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0056.036] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0056.036] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0056.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0056.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0056.036] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0056.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0056.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0056.037] GetFileType (hFile=0x2b8) returned 0x1 [0056.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0056.037] GetFileType (hFile=0x2b8) returned 0x1 [0056.037] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x978 [0056.037] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2414, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x96e [0056.037] ReadFile (in: hFile=0x2b8, lpBuffer=0x2772f80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2772f80*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0056.039] CloseHandle (hObject=0x2b8) returned 1 [0056.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0056.044] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0056.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0056.044] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x27dcb18 | out: lpFileInformation=0x27dcb18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978)) returned 1 [0056.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0056.045] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0056.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0056.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0056.045] GetFileType (hFile=0x2b8) returned 0x1 [0056.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0056.045] GetFileType (hFile=0x2b8) returned 0x1 [0056.045] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x978 [0056.045] ReadFile (in: hFile=0x2b8, lpBuffer=0x27dd760, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27dd760*, lpNumberOfBytesRead=0x1c9aeb38*=0x978, lpOverlapped=0x0) returned 1 [0056.045] CloseHandle (hObject=0x2b8) returned 1 [0056.069] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0056.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0056.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0056.070] GetFileType (hFile=0x2b8) returned 0x1 [0056.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0056.070] GetFileType (hFile=0x2b8) returned 0x1 [0056.070] WriteFile (in: hFile=0x2b8, lpBuffer=0x28581b8*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x28581b8*, lpNumberOfBytesWritten=0x1c9aea78*=0x980, lpOverlapped=0x0) returned 1 [0056.071] CloseHandle (hObject=0x2b8) returned 1 [0056.072] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0056.072] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0056.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0056.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0056.072] GetFileType (hFile=0x2b8) returned 0x1 [0056.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0056.072] GetFileType (hFile=0x2b8) returned 0x1 [0056.072] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x980 [0056.072] WriteFile (in: hFile=0x2b8, lpBuffer=0x2859fe0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2859fe0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0056.072] CloseHandle (hObject=0x2b8) returned 1 [0056.073] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0056.073] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0056.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0056.073] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc94c1d00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x98a)) returned 1 [0056.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0056.073] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0056.076] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpFilePart=0x0) returned 0x49 [0056.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0056.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0056.076] GetFileType (hFile=0x2b8) returned 0x1 [0056.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0056.076] GetFileType (hFile=0x2b8) returned 0x1 [0056.076] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x29c6dbd [0056.076] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=43806131, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x29c6db3 [0056.076] ReadFile (in: hFile=0x2b8, lpBuffer=0x285b3e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x285b3e0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0056.078] CloseHandle (hObject=0x2b8) returned 1 [0056.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0056.091] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpFilePart=0x0) returned 0x49 [0056.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0056.091] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x26e1028 | out: lpFileInformation=0x26e1028*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd)) returned 1 [0056.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0056.096] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpFilePart=0x0) returned 0x49 [0056.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0056.096] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0056.097] GetFileType (hFile=0x2b8) returned 0x1 [0056.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0056.097] GetFileType (hFile=0x2b8) returned 0x1 [0056.097] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0056.113] CloseHandle (hObject=0x2b8) returned 1 [0056.114] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpFilePart=0x0) returned 0x49 [0056.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0056.114] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0056.114] GetFileType (hFile=0x2b8) returned 0x1 [0056.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0056.114] GetFileType (hFile=0x2b8) returned 0x1 [0056.235] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0056.239] CloseHandle (hObject=0x2b8) returned 1 [0056.701] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpFilePart=0x0) returned 0x49 [0056.701] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpFilePart=0x0) returned 0x49 [0056.701] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpFilePart=0x0) returned 0x49 [0056.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0056.702] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0056.702] GetFileType (hFile=0x2b8) returned 0x1 [0056.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0056.702] GetFileType (hFile=0x2b8) returned 0x1 [0056.702] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x29c6dbd [0056.702] WriteFile (in: hFile=0x2b8, lpBuffer=0x26c99e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26c99e8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0056.702] CloseHandle (hObject=0x2b8) returned 1 [0057.000] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpFilePart=0x0) returned 0x49 [0057.000] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\V29yZExSLmNhYg==", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\V29yZExSLmNhYg==", lpFilePart=0x0) returned 0x4f [0057.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0057.000] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc9d16a00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dc7)) returned 1 [0057.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0057.001] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\V29yZExSLmNhYg==" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\v29yzexslmnhyg==")) returned 1 [0057.001] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpFilePart=0x0) returned 0x4a [0057.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0057.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.002] GetFileType (hFile=0x2b8) returned 0x1 [0057.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0057.002] GetFileType (hFile=0x2b8) returned 0x1 [0057.002] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x267e00 [0057.002] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2522614, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x267df6 [0057.002] ReadFile (in: hFile=0x2b8, lpBuffer=0x26cd8a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26cd8a0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0057.004] CloseHandle (hObject=0x2b8) returned 1 [0057.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0057.011] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpFilePart=0x0) returned 0x4a [0057.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0057.011] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x27377b0 | out: lpFileInformation=0x27377b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00)) returned 1 [0057.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0057.014] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpFilePart=0x0) returned 0x4a [0057.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0057.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.014] GetFileType (hFile=0x2b8) returned 0x1 [0057.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0057.014] GetFileType (hFile=0x2b8) returned 0x1 [0057.014] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61a48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0057.035] CloseHandle (hObject=0x2b8) returned 1 [0057.040] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpFilePart=0x0) returned 0x4a [0057.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0057.041] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.041] GetFileType (hFile=0x2b8) returned 0x1 [0057.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0057.041] GetFileType (hFile=0x2b8) returned 0x1 [0057.176] WriteFile (in: hFile=0x2b8, lpBuffer=0x128619d8*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0057.179] CloseHandle (hObject=0x2b8) returned 1 [0057.213] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpFilePart=0x0) returned 0x4a [0057.213] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpFilePart=0x0) returned 0x4a [0057.213] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpFilePart=0x0) returned 0x4a [0057.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0057.213] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.213] GetFileType (hFile=0x2b8) returned 0x1 [0057.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0057.213] GetFileType (hFile=0x2b8) returned 0x1 [0057.214] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x267e00 [0057.214] WriteFile (in: hFile=0x2b8, lpBuffer=0x26c0c48*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26c0c48*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0057.214] CloseHandle (hObject=0x2b8) returned 1 [0057.276] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", lpFilePart=0x0) returned 0x4a [0057.276] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\V29yZE1VSS5tc2k=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\V29yZE1VSS5tc2k=", lpFilePart=0x0) returned 0x4f [0057.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0057.276] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc9fc42c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x267e0a)) returned 1 [0057.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0057.277] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\V29yZE1VSS5tc2k=" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\v29yze1vss5tc2k=")) returned 1 [0057.277] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0057.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0057.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.277] GetFileType (hFile=0x2b8) returned 0x1 [0057.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0057.277] GetFileType (hFile=0x2b8) returned 0x1 [0057.277] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x708 [0057.278] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1790, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x6fe [0057.278] ReadFile (in: hFile=0x2b8, lpBuffer=0x26c6600, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26c6600*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0057.280] CloseHandle (hObject=0x2b8) returned 1 [0057.285] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0057.295] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0057.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0057.295] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x275b5c0 | out: lpFileInformation=0x275b5c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708)) returned 1 [0057.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0057.295] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0057.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0057.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.295] GetFileType (hFile=0x2b8) returned 0x1 [0057.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0057.296] GetFileType (hFile=0x2b8) returned 0x1 [0057.296] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x708 [0057.296] ReadFile (in: hFile=0x2b8, lpBuffer=0x275bf98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x275bf98*, lpNumberOfBytesRead=0x1c9aeb38*=0x708, lpOverlapped=0x0) returned 1 [0057.296] CloseHandle (hObject=0x2b8) returned 1 [0057.376] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0057.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0057.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.377] GetFileType (hFile=0x2b8) returned 0x1 [0057.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0057.377] GetFileType (hFile=0x2b8) returned 0x1 [0057.377] WriteFile (in: hFile=0x2b8, lpBuffer=0x2716ea8*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x2716ea8*, lpNumberOfBytesWritten=0x1c9aea78*=0x710, lpOverlapped=0x0) returned 1 [0057.378] CloseHandle (hObject=0x2b8) returned 1 [0057.379] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0057.379] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0057.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0057.379] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.379] GetFileType (hFile=0x2b8) returned 0x1 [0057.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0057.379] GetFileType (hFile=0x2b8) returned 0x1 [0057.379] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x710 [0057.379] WriteFile (in: hFile=0x2b8, lpBuffer=0x2718cd8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2718cd8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0057.380] CloseHandle (hObject=0x2b8) returned 1 [0057.380] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0057.380] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\V29yZE1VSS54bWw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\V29yZE1VSS54bWw=", lpFilePart=0x0) returned 0x4f [0057.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0057.380] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xca0cec60, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x71a)) returned 1 [0057.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0057.380] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\V29yZE1VSS54bWw=" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\v29yze1vss54bww=")) returned 1 [0057.381] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0057.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0057.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0057.382] GetFileType (hFile=0x2b8) returned 0x1 [0057.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0057.382] GetFileType (hFile=0x2b8) returned 0x1 [0057.382] WriteFile (in: hFile=0x2b8, lpBuffer=0x271d020*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x271d020*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0057.383] CloseHandle (hObject=0x2b8) returned 1 [0057.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0057.383] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0057.383] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0057.383] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0057.386] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.386] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0057.386] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0057.386] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0057.387] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0057.387] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0057.387] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.387] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.387] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0057.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0057.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0057.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0057.388] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0057.389] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0057.389] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0057.389] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.390] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0057.390] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0057.390] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0057.390] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0057.390] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0057.391] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.391] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.391] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0057.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0057.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0057.392] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpFilePart=0x0) returned 0x4b [0057.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0057.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.393] GetFileType (hFile=0x2b8) returned 0x1 [0057.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0057.393] GetFileType (hFile=0x2b8) returned 0x1 [0057.393] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xd4200 [0057.393] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=868854, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xd41f6 [0057.393] ReadFile (in: hFile=0x2b8, lpBuffer=0x2721b40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2721b40*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0057.395] CloseHandle (hObject=0x2b8) returned 1 [0057.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0057.402] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpFilePart=0x0) returned 0x4b [0057.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0057.402] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), fInfoLevelId=0x0, lpFileInformation=0x278b6d8 | out: lpFileInformation=0x278b6d8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0057.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0057.402] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpFilePart=0x0) returned 0x4b [0057.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0057.402] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.402] GetFileType (hFile=0x2b8) returned 0x1 [0057.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0057.402] GetFileType (hFile=0x2b8) returned 0x1 [0057.402] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xd4200 [0057.405] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb38*=0xd4200, lpOverlapped=0x0) returned 1 [0057.419] CloseHandle (hObject=0x2b8) returned 1 [0057.544] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpFilePart=0x0) returned 0x4b [0057.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0057.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.552] GetFileType (hFile=0x2b8) returned 0x1 [0057.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0057.552] GetFileType (hFile=0x2b8) returned 0x1 [0057.552] WriteFile (in: hFile=0x2b8, lpBuffer=0x12735ba0*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12735ba0*, lpNumberOfBytesWritten=0x1c9aebc8*=0xd4210, lpOverlapped=0x0) returned 1 [0057.566] CloseHandle (hObject=0x2b8) returned 1 [0057.574] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpFilePart=0x0) returned 0x4b [0057.574] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpFilePart=0x0) returned 0x4b [0057.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0057.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.574] GetFileType (hFile=0x2b8) returned 0x1 [0057.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0057.574] GetFileType (hFile=0x2b8) returned 0x1 [0057.574] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xd4210 [0057.574] WriteFile (in: hFile=0x2b8, lpBuffer=0x26befb0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26befb0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0057.575] CloseHandle (hObject=0x2b8) returned 1 [0057.580] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", lpFilePart=0x0) returned 0x4b [0057.580] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\UHJvb2ZpbmcubXNp", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\UHJvb2ZpbmcubXNp", lpFilePart=0x0) returned 0x4f [0057.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0057.580] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xca2bde40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd421a)) returned 1 [0057.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0057.580] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\UHJvb2ZpbmcubXNp" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\uhjvb2zpbmcubxnp")) returned 1 [0057.580] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0057.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0057.581] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.581] GetFileType (hFile=0x2b8) returned 0x1 [0057.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0057.581] GetFileType (hFile=0x2b8) returned 0x1 [0057.581] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x32b [0057.581] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=801, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x321 [0057.581] ReadFile (in: hFile=0x2b8, lpBuffer=0x26c03c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26c03c8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0057.583] CloseHandle (hObject=0x2b8) returned 1 [0057.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0057.590] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0057.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0057.590] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), fInfoLevelId=0x0, lpFileInformation=0x27371b8 | out: lpFileInformation=0x27371b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b)) returned 1 [0057.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0057.590] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0057.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0057.590] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.591] GetFileType (hFile=0x2b8) returned 0x1 [0057.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0057.591] GetFileType (hFile=0x2b8) returned 0x1 [0057.591] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x32b [0057.591] ReadFile (in: hFile=0x2b8, lpBuffer=0x2750c18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2750c18*, lpNumberOfBytesRead=0x1c9aeb38*=0x32b, lpOverlapped=0x0) returned 1 [0057.591] CloseHandle (hObject=0x2b8) returned 1 [0057.654] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0057.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0057.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.655] GetFileType (hFile=0x2b8) returned 0x1 [0057.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0057.655] GetFileType (hFile=0x2b8) returned 0x1 [0057.655] WriteFile (in: hFile=0x2b8, lpBuffer=0x26e6820*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x26e6820*, lpNumberOfBytesWritten=0x1c9aea78*=0x330, lpOverlapped=0x0) returned 1 [0057.673] CloseHandle (hObject=0x2b8) returned 1 [0057.674] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0057.674] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0057.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0057.674] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.674] GetFileType (hFile=0x2b8) returned 0x1 [0057.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0057.674] GetFileType (hFile=0x2b8) returned 0x1 [0057.674] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x330 [0057.674] WriteFile (in: hFile=0x2b8, lpBuffer=0x26eb118*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26eb118*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0057.675] CloseHandle (hObject=0x2b8) returned 1 [0057.675] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0057.675] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\UHJvb2ZpbmcueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\UHJvb2ZpbmcueG1s", lpFilePart=0x0) returned 0x4f [0057.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0057.675] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xca3a2680, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x33a)) returned 1 [0057.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0057.675] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\UHJvb2ZpbmcueG1s" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\uhjvb2zpbmcueg1s")) returned 1 [0057.676] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0057.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0057.676] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.676] GetFileType (hFile=0x2b8) returned 0x1 [0057.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0057.676] GetFileType (hFile=0x2b8) returned 0x1 [0057.676] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x16fc [0057.677] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=5874, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x16f2 [0057.677] ReadFile (in: hFile=0x2b8, lpBuffer=0x26ec528, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26ec528*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0057.678] CloseHandle (hObject=0x2b8) returned 1 [0057.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0057.684] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0057.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0057.684] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x27560c0 | out: lpFileInformation=0x27560c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc)) returned 1 [0057.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0057.684] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0057.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0057.684] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.685] GetFileType (hFile=0x2b8) returned 0x1 [0057.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0057.685] GetFileType (hFile=0x2b8) returned 0x1 [0057.685] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x16fc [0057.685] ReadFile (in: hFile=0x2b8, lpBuffer=0x2756378, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2756378*, lpNumberOfBytesRead=0x1c9aeb38*=0x16fc, lpOverlapped=0x0) returned 1 [0057.686] CloseHandle (hObject=0x2b8) returned 1 [0057.696] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0057.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0057.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.697] GetFileType (hFile=0x2b8) returned 0x1 [0057.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0057.697] GetFileType (hFile=0x2b8) returned 0x1 [0057.697] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d4268*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27d4268*, lpNumberOfBytesWritten=0x1c9aebc8*=0x1700, lpOverlapped=0x0) returned 1 [0057.698] CloseHandle (hObject=0x2b8) returned 1 [0057.699] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0057.699] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0057.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0057.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.699] GetFileType (hFile=0x2b8) returned 0x1 [0057.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0057.699] GetFileType (hFile=0x2b8) returned 0x1 [0057.699] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x1700 [0057.699] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d68f8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27d68f8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0057.699] CloseHandle (hObject=0x2b8) returned 1 [0057.700] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0057.700] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0057.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0057.700] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xca3c87e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x170a)) returned 1 [0057.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0057.700] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0057.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0057.700] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0057.700] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0057.701] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0057.701] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.701] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0057.701] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0057.701] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0057.701] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.701] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0057.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0057.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0057.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0057.702] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0057.702] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0057.702] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0057.702] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.703] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0057.703] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0057.703] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0057.703] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0057.703] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0057.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0057.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0057.703] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpFilePart=0x0) returned 0x51 [0057.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0057.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.704] GetFileType (hFile=0x2b8) returned 0x1 [0057.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0057.704] GetFileType (hFile=0x2b8) returned 0x1 [0057.704] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xaf35ed [0057.704] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=11482595, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xaf35e3 [0057.704] ReadFile (in: hFile=0x2b8, lpBuffer=0x27dad80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27dad80*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0057.706] CloseHandle (hObject=0x2b8) returned 1 [0057.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x114e0) returned 0x0 [0057.708] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpFilePart=0x0) returned 0x51 [0057.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0057.708] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x28449f8 | out: lpFileInformation=0x28449f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed)) returned 1 [0057.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0057.710] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpFilePart=0x0) returned 0x51 [0057.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0057.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.711] GetFileType (hFile=0x2b8) returned 0x1 [0057.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0057.711] GetFileType (hFile=0x2b8) returned 0x1 [0057.711] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a86448, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x12a86448*, lpNumberOfBytesRead=0x1c9aea78*=0x100000, lpOverlapped=0x0) returned 1 [0057.736] CloseHandle (hObject=0x2b8) returned 1 [0057.736] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpFilePart=0x0) returned 0x51 [0057.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0057.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0057.737] GetFileType (hFile=0x2b8) returned 0x1 [0057.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0057.737] GetFileType (hFile=0x2b8) returned 0x1 [0057.849] WriteFile (in: hFile=0x2b8, lpBuffer=0x12b86480*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aead8, lpOverlapped=0x0 | out: lpBuffer=0x12b86480*, lpNumberOfBytesWritten=0x1c9aead8*=0x100000, lpOverlapped=0x0) returned 1 [0057.852] CloseHandle (hObject=0x2b8) returned 1 [0058.201] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.202] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae560, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.202] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0058.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.202] GetFileType (hFile=0x2b8) returned 0x1 [0058.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0058.202] GetFileType (hFile=0x2b8) returned 0x1 [0058.202] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9c8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9c8*=0) returned 0xaf35ed [0058.203] WriteFile (in: hFile=0x2b8, lpBuffer=0x26af840*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x26af840*, lpNumberOfBytesWritten=0x1c9aea88*=0xa, lpOverlapped=0x0) returned 1 [0058.203] CloseHandle (hObject=0x2b8) returned 1 [0058.351] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.352] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UHJvb2YuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UHJvb2YuY2Fi", lpFilePart=0x0) returned 0x54 [0058.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0058.352] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeaf0 | out: lpFileInformation=0x1c9aeaf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xca9bbee0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xaf35f7)) returned 1 [0058.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0058.352] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UHJvb2YuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\uhjvb2yuy2fi")) returned 1 [0058.352] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0058.352] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.353] GetFileType (hFile=0x2b8) returned 0x1 [0058.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0058.353] GetFileType (hFile=0x2b8) returned 0x1 [0058.353] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xd5c00 [0058.353] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=875510, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xd5bf6 [0058.353] ReadFile (in: hFile=0x2b8, lpBuffer=0x26b3538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x26b3538*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0058.354] CloseHandle (hObject=0x2b8) returned 1 [0058.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x114e0) returned 0x0 [0058.361] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0058.361] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x271d6e0 | out: lpFileInformation=0x271d6e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00)) returned 1 [0058.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0058.361] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0058.361] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.362] GetFileType (hFile=0x2b8) returned 0x1 [0058.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0058.362] GetFileType (hFile=0x2b8) returned 0x1 [0058.362] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xd5c00 [0058.365] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0xd5c00, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aea98*=0xd5c00, lpOverlapped=0x0) returned 1 [0058.372] CloseHandle (hObject=0x2b8) returned 1 [0058.495] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0058.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.503] GetFileType (hFile=0x2b8) returned 0x1 [0058.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0058.503] GetFileType (hFile=0x2b8) returned 0x1 [0058.503] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a8e648*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x12a8e648*, lpNumberOfBytesWritten=0x1c9aeb28*=0xd5c10, lpOverlapped=0x0) returned 1 [0058.518] CloseHandle (hObject=0x2b8) returned 1 [0058.518] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.518] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0058.519] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.519] GetFileType (hFile=0x2b8) returned 0x1 [0058.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0058.519] GetFileType (hFile=0x2b8) returned 0x1 [0058.519] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xd5c10 [0058.519] WriteFile (in: hFile=0x2b8, lpBuffer=0x26ac210*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x26ac210*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0058.519] CloseHandle (hObject=0x2b8) returned 1 [0058.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UHJvb2YubXNp", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UHJvb2YubXNp", lpFilePart=0x0) returned 0x54 [0058.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0058.519] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xcab5ee00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd5c1a)) returned 1 [0058.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0058.520] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UHJvb2YubXNp" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\uhjvb2yubxnp")) returned 1 [0058.520] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0058.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0058.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.520] GetFileType (hFile=0x2b8) returned 0x1 [0058.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0058.520] GetFileType (hFile=0x2b8) returned 0x1 [0058.520] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x543 [0058.520] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1337, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x539 [0058.521] ReadFile (in: hFile=0x2b8, lpBuffer=0x26aecd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x26aecd0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0058.539] CloseHandle (hObject=0x2b8) returned 1 [0058.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x114e0) returned 0x0 [0058.549] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0058.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0058.549] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x2745a28 | out: lpFileInformation=0x2745a28*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543)) returned 1 [0058.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0058.549] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0058.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0058.549] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.550] GetFileType (hFile=0x2b8) returned 0x1 [0058.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0058.550] GetFileType (hFile=0x2b8) returned 0x1 [0058.550] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x543 [0058.550] ReadFile (in: hFile=0x2b8, lpBuffer=0x2746260, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2746260*, lpNumberOfBytesRead=0x1c9aea98*=0x543, lpOverlapped=0x0) returned 1 [0058.550] CloseHandle (hObject=0x2b8) returned 1 [0058.574] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0058.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0058.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.575] GetFileType (hFile=0x2b8) returned 0x1 [0058.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0058.575] GetFileType (hFile=0x2b8) returned 0x1 [0058.578] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0058.578] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0058.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0058.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.578] GetFileType (hFile=0x2b8) returned 0x1 [0058.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0058.578] GetFileType (hFile=0x2b8) returned 0x1 [0058.578] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x550 [0058.590] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0058.590] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UHJvb2YueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UHJvb2YueG1s", lpFilePart=0x0) returned 0x54 [0058.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0058.590] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xcabf7380, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x55a)) returned 1 [0058.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0058.590] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UHJvb2YueG1s" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\uhjvb2yueg1s")) returned 1 [0058.592] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\README_3728769.txt", lpFilePart=0x0) returned 0x5a [0058.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0058.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0058.594] GetFileType (hFile=0x2b8) returned 0x1 [0058.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0058.594] GetFileType (hFile=0x2b8) returned 0x1 [0058.594] WriteFile (in: hFile=0x2b8, lpBuffer=0x26986f0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x26986f0*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0058.595] CloseHandle (hObject=0x2b8) returned 1 [0058.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0058.595] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0058.595] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0058.596] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0058.596] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.596] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0058.596] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0058.596] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0058.596] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0058.596] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0058.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0058.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0058.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0058.597] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0058.597] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0058.597] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0058.597] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.598] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0058.598] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0058.598] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0058.598] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0058.598] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0058.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0058.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0058.598] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0058.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.599] GetFileType (hFile=0x2b8) returned 0x1 [0058.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0058.599] GetFileType (hFile=0x2b8) returned 0x1 [0058.599] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xd02aea [0058.599] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=13642464, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xd02ae0 [0058.600] ReadFile (in: hFile=0x2b8, lpBuffer=0x269c948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x269c948*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0058.601] CloseHandle (hObject=0x2b8) returned 1 [0058.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x114e0) returned 0x0 [0058.608] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0058.608] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x27065c0 | out: lpFileInformation=0x27065c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea)) returned 1 [0058.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0058.610] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0058.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.610] GetFileType (hFile=0x2b8) returned 0x1 [0058.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0058.610] GetFileType (hFile=0x2b8) returned 0x1 [0058.611] ReadFile (in: hFile=0x2b8, lpBuffer=0x12b64290, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x12b64290*, lpNumberOfBytesRead=0x1c9aea78*=0x100000, lpOverlapped=0x0) returned 1 [0058.630] CloseHandle (hObject=0x2b8) returned 1 [0058.636] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0058.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.637] GetFileType (hFile=0x2b8) returned 0x1 [0058.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0058.637] GetFileType (hFile=0x2b8) returned 0x1 [0058.912] WriteFile (in: hFile=0x2b8, lpBuffer=0x12c642c8*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aead8, lpOverlapped=0x0 | out: lpBuffer=0x12c642c8*, lpNumberOfBytesWritten=0x1c9aead8*=0x100000, lpOverlapped=0x0) returned 1 [0058.918] CloseHandle (hObject=0x2b8) returned 1 [0058.918] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.919] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae560, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.920] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0058.920] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.920] GetFileType (hFile=0x2b8) returned 0x1 [0058.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0058.920] GetFileType (hFile=0x2b8) returned 0x1 [0058.920] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9c8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9c8*=0) returned 0xd02aea [0058.920] WriteFile (in: hFile=0x2b8, lpBuffer=0x2680a80*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x2680a80*, lpNumberOfBytesWritten=0x1c9aea88*=0xa, lpOverlapped=0x0) returned 1 [0058.921] CloseHandle (hObject=0x2b8) returned 1 [0058.921] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpFilePart=0x0) returned 0x51 [0058.921] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UHJvb2YuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UHJvb2YuY2Fi", lpFilePart=0x0) returned 0x54 [0058.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0058.921] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeaf0 | out: lpFileInformation=0x1c9aeaf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcaf3d1c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd02af4)) returned 1 [0058.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0058.922] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UHJvb2YuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\uhjvb2yuy2fi")) returned 1 [0058.922] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0058.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.922] GetFileType (hFile=0x2b8) returned 0x1 [0058.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0058.923] GetFileType (hFile=0x2b8) returned 0x1 [0058.923] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xd7200 [0058.923] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=881142, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xd71f6 [0058.923] ReadFile (in: hFile=0x2b8, lpBuffer=0x2681ed0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2681ed0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0058.924] CloseHandle (hObject=0x2b8) returned 1 [0058.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x114e0) returned 0x0 [0058.933] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0058.934] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x2716ad8 | out: lpFileInformation=0x2716ad8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200)) returned 1 [0058.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0058.934] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpFilePart=0x0) returned 0x51 [0058.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0058.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0058.934] GetFileType (hFile=0x2b8) returned 0x1 [0058.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0058.934] GetFileType (hFile=0x2b8) returned 0x1 [0058.934] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xd7200 [0058.938] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0xd7200, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aea98*=0xd7200, lpOverlapped=0x0) returned 1 [0058.944] CloseHandle (hObject=0x2b8) returned 1 [0059.106] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0059.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.113] GetFileType (hFile=0x2b8) returned 0x1 [0059.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0059.113] GetFileType (hFile=0x2b8) returned 0x1 [0059.113] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a95448*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x12a95448*, lpNumberOfBytesWritten=0x1c9aeb28*=0xd7210, lpOverlapped=0x0) returned 1 [0059.127] CloseHandle (hObject=0x2b8) returned 1 [0059.128] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.128] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0059.128] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.128] GetFileType (hFile=0x2b8) returned 0x1 [0059.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0059.128] GetFileType (hFile=0x2b8) returned 0x1 [0059.128] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xd7210 [0059.129] WriteFile (in: hFile=0x2b8, lpBuffer=0x2680e40*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2680e40*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0059.129] CloseHandle (hObject=0x2b8) returned 1 [0059.129] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.129] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UHJvb2YubXNp", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UHJvb2YubXNp", lpFilePart=0x0) returned 0x54 [0059.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0059.129] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcb12c3a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd721a)) returned 1 [0059.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0059.129] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UHJvb2YubXNp" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\uhjvb2yubxnp")) returned 1 [0059.130] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0059.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.130] GetFileType (hFile=0x2b8) returned 0x1 [0059.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0059.130] GetFileType (hFile=0x2b8) returned 0x1 [0059.130] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x5b1 [0059.130] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1447, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x5a7 [0059.130] ReadFile (in: hFile=0x2b8, lpBuffer=0x2682290, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2682290*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0059.150] CloseHandle (hObject=0x2b8) returned 1 [0059.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x114e0) returned 0x0 [0059.160] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0059.161] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x26d2ef8 | out: lpFileInformation=0x26d2ef8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1)) returned 1 [0059.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0059.161] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0059.161] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.161] GetFileType (hFile=0x2b8) returned 0x1 [0059.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0059.161] GetFileType (hFile=0x2b8) returned 0x1 [0059.161] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x5b1 [0059.161] ReadFile (in: hFile=0x2b8, lpBuffer=0x26d37a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x26d37a0*, lpNumberOfBytesRead=0x1c9aea98*=0x5b1, lpOverlapped=0x0) returned 1 [0059.161] CloseHandle (hObject=0x2b8) returned 1 [0059.196] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0059.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.197] GetFileType (hFile=0x2b8) returned 0x1 [0059.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0059.197] GetFileType (hFile=0x2b8) returned 0x1 [0059.198] WriteFile (in: hFile=0x2b8, lpBuffer=0x274d1e8*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x274d1e8*, lpNumberOfBytesWritten=0x1c9ae9d8*=0x5c0, lpOverlapped=0x0) returned 1 [0059.198] CloseHandle (hObject=0x2b8) returned 1 [0059.199] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.199] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0059.199] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.199] GetFileType (hFile=0x2b8) returned 0x1 [0059.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0059.199] GetFileType (hFile=0x2b8) returned 0x1 [0059.199] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x5c0 [0059.199] WriteFile (in: hFile=0x2b8, lpBuffer=0x274f050*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x274f050*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0059.199] CloseHandle (hObject=0x2b8) returned 1 [0059.200] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.200] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UHJvb2YueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UHJvb2YueG1s", lpFilePart=0x0) returned 0x54 [0059.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0059.200] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcb1c4920, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x5ca)) returned 1 [0059.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0059.200] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UHJvb2YueG1s" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\uhjvb2yueg1s")) returned 1 [0059.201] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\README_3728769.txt", lpFilePart=0x0) returned 0x5a [0059.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0059.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0059.203] GetFileType (hFile=0x2b8) returned 0x1 [0059.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0059.203] GetFileType (hFile=0x2b8) returned 0x1 [0059.204] WriteFile (in: hFile=0x2b8, lpBuffer=0x27533e8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x27533e8*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0059.204] CloseHandle (hObject=0x2b8) returned 1 [0059.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0059.205] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0059.205] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0059.205] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0059.205] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.205] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0059.205] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0059.205] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0059.206] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.206] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0059.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0059.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0059.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0059.206] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0059.206] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0059.206] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0059.206] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.206] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0059.207] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0059.207] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0059.207] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0059.207] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0059.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0059.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0059.207] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpFilePart=0x0) returned 0x51 [0059.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0059.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.207] GetFileType (hFile=0x2b8) returned 0x1 [0059.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0059.208] GetFileType (hFile=0x2b8) returned 0x1 [0059.208] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x1416b54 [0059.208] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=21064522, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x1416b4a [0059.208] ReadFile (in: hFile=0x2b8, lpBuffer=0x2757640, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2757640*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0059.210] CloseHandle (hObject=0x2b8) returned 1 [0059.211] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpFilePart=0x0) returned 0x51 [0059.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0059.212] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x27c12f8 | out: lpFileInformation=0x27c12f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54)) returned 1 [0059.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0059.214] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpFilePart=0x0) returned 0x51 [0059.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0059.214] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.214] GetFileType (hFile=0x2b8) returned 0x1 [0059.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0059.214] GetFileType (hFile=0x2b8) returned 0x1 [0059.214] ReadFile (in: hFile=0x2b8, lpBuffer=0x12b6c690, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x12b6c690*, lpNumberOfBytesRead=0x1c9aea78*=0x100000, lpOverlapped=0x0) returned 1 [0059.239] CloseHandle (hObject=0x2b8) returned 1 [0059.239] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpFilePart=0x0) returned 0x51 [0059.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0059.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.240] GetFileType (hFile=0x2b8) returned 0x1 [0059.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0059.240] GetFileType (hFile=0x2b8) returned 0x1 [0059.397] WriteFile (in: hFile=0x2b8, lpBuffer=0x12c6c6c8*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aead8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c6c8*, lpNumberOfBytesWritten=0x1c9aead8*=0x100000, lpOverlapped=0x0) returned 1 [0059.400] CloseHandle (hObject=0x2b8) returned 1 [0059.401] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpFilePart=0x0) returned 0x51 [0059.401] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae560, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpFilePart=0x0) returned 0x51 [0059.402] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpFilePart=0x0) returned 0x51 [0059.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0059.402] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.402] GetFileType (hFile=0x2b8) returned 0x1 [0059.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0059.402] GetFileType (hFile=0x2b8) returned 0x1 [0059.402] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9c8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9c8*=0) returned 0x1416b54 [0059.402] WriteFile (in: hFile=0x2b8, lpBuffer=0x26986c0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x26986c0*, lpNumberOfBytesWritten=0x1c9aea88*=0xa, lpOverlapped=0x0) returned 1 [0059.402] CloseHandle (hObject=0x2b8) returned 1 [0059.402] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpFilePart=0x0) returned 0x51 [0059.402] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UHJvb2YuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UHJvb2YuY2Fi", lpFilePart=0x0) returned 0x54 [0059.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0059.403] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeaf0 | out: lpFileInformation=0x1c9aeaf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcb3b3b00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1416b5e)) returned 1 [0059.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0059.403] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UHJvb2YuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\uhjvb2yuy2fi")) returned 1 [0059.403] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0059.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.422] GetFileType (hFile=0x2b8) returned 0x1 [0059.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0059.422] GetFileType (hFile=0x2b8) returned 0x1 [0059.422] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xd8400 [0059.422] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=885750, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xd83f6 [0059.422] ReadFile (in: hFile=0x2b8, lpBuffer=0x269c3b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x269c3b8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0059.424] CloseHandle (hObject=0x2b8) returned 1 [0059.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x114e0) returned 0x0 [0059.434] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0059.434] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x26bdee0 | out: lpFileInformation=0x26bdee0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400)) returned 1 [0059.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0059.434] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0059.434] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.435] GetFileType (hFile=0x2b8) returned 0x1 [0059.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0059.435] GetFileType (hFile=0x2b8) returned 0x1 [0059.435] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xd8400 [0059.438] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0xd8400, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aea98*=0xd8400, lpOverlapped=0x0) returned 1 [0059.445] CloseHandle (hObject=0x2b8) returned 1 [0059.569] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0059.569] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.577] GetFileType (hFile=0x2b8) returned 0x1 [0059.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0059.577] GetFileType (hFile=0x2b8) returned 0x1 [0059.577] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a9ae48*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x12a9ae48*, lpNumberOfBytesWritten=0x1c9aeb28*=0xd8410, lpOverlapped=0x0) returned 1 [0059.591] CloseHandle (hObject=0x2b8) returned 1 [0059.592] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.592] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0059.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.592] GetFileType (hFile=0x2b8) returned 0x1 [0059.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0059.592] GetFileType (hFile=0x2b8) returned 0x1 [0059.592] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xd8410 [0059.592] WriteFile (in: hFile=0x2b8, lpBuffer=0x26a4690*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x26a4690*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0059.592] CloseHandle (hObject=0x2b8) returned 1 [0059.593] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", lpFilePart=0x0) returned 0x51 [0059.593] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UHJvb2YubXNp", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UHJvb2YubXNp", lpFilePart=0x0) returned 0x54 [0059.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0059.593] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcb5a2ce0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd841a)) returned 1 [0059.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0059.593] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UHJvb2YubXNp" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\uhjvb2yubxnp")) returned 1 [0059.594] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0059.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.594] GetFileType (hFile=0x2b8) returned 0x1 [0059.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0059.594] GetFileType (hFile=0x2b8) returned 0x1 [0059.594] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x5b2 [0059.594] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1448, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x5a8 [0059.594] ReadFile (in: hFile=0x2b8, lpBuffer=0x26a5ae0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x26a5ae0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0059.613] CloseHandle (hObject=0x2b8) returned 1 [0059.620] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0059.620] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x2712428 | out: lpFileInformation=0x2712428*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2)) returned 1 [0059.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0059.620] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0059.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.621] GetFileType (hFile=0x2b8) returned 0x1 [0059.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0059.621] GetFileType (hFile=0x2b8) returned 0x1 [0059.621] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x5b2 [0059.621] ReadFile (in: hFile=0x2b8, lpBuffer=0x2712cd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2712cd0*, lpNumberOfBytesRead=0x1c9aea98*=0x5b2, lpOverlapped=0x0) returned 1 [0059.621] CloseHandle (hObject=0x2b8) returned 1 [0059.645] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0059.645] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.646] GetFileType (hFile=0x2b8) returned 0x1 [0059.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0059.646] GetFileType (hFile=0x2b8) returned 0x1 [0059.646] WriteFile (in: hFile=0x2b8, lpBuffer=0x278cc58*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x278cc58*, lpNumberOfBytesWritten=0x1c9ae9d8*=0x5c0, lpOverlapped=0x0) returned 1 [0059.647] CloseHandle (hObject=0x2b8) returned 1 [0059.647] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.647] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0059.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.648] GetFileType (hFile=0x2b8) returned 0x1 [0059.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0059.648] GetFileType (hFile=0x2b8) returned 0x1 [0059.648] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x5c0 [0059.648] WriteFile (in: hFile=0x2b8, lpBuffer=0x278eac0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x278eac0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0059.648] CloseHandle (hObject=0x2b8) returned 1 [0059.648] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0059.648] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UHJvb2YueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UHJvb2YueG1s", lpFilePart=0x0) returned 0x54 [0059.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0059.648] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcb615100, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x5ca)) returned 1 [0059.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0059.648] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UHJvb2YueG1s" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\uhjvb2yueg1s")) returned 1 [0059.649] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\README_3728769.txt", lpFilePart=0x0) returned 0x5a [0059.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0059.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0059.651] GetFileType (hFile=0x2b8) returned 0x1 [0059.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0059.651] GetFileType (hFile=0x2b8) returned 0x1 [0059.651] WriteFile (in: hFile=0x2b8, lpBuffer=0x2792e58*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x2792e58*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0059.652] CloseHandle (hObject=0x2b8) returned 1 [0059.653] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0059.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0059.653] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0059.653] GetFileType (hFile=0x2b8) returned 0x1 [0059.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0059.653] GetFileType (hFile=0x2b8) returned 0x1 [0059.653] WriteFile (in: hFile=0x2b8, lpBuffer=0x2796f60*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2796f60*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0059.654] CloseHandle (hObject=0x2b8) returned 1 [0059.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0059.657] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0059.657] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0059.657] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0059.659] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.660] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0059.660] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0059.660] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0059.660] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0059.660] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.660] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0059.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0059.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0059.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0059.661] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0059.661] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0059.661] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0059.662] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.662] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0059.663] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0059.663] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0059.663] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0059.663] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0059.663] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0059.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0059.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0059.664] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpFilePart=0x0) returned 0x4e [0059.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0059.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.665] GetFileType (hFile=0x2b8) returned 0x1 [0059.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0059.665] GetFileType (hFile=0x2b8) returned 0x1 [0059.665] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xd5600 [0059.665] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=873974, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xd55f6 [0059.665] ReadFile (in: hFile=0x2b8, lpBuffer=0x279b450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x279b450*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0059.667] CloseHandle (hObject=0x2b8) returned 1 [0059.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0059.674] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpFilePart=0x0) returned 0x4e [0059.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0059.674] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), fInfoLevelId=0x0, lpFileInformation=0x2804fe8 | out: lpFileInformation=0x2804fe8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600)) returned 1 [0059.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0059.674] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpFilePart=0x0) returned 0x4e [0059.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0059.674] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.674] GetFileType (hFile=0x2b8) returned 0x1 [0059.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0059.674] GetFileType (hFile=0x2b8) returned 0x1 [0059.674] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xd5600 [0059.678] ReadFile (in: hFile=0x2b8, lpBuffer=0x12739da0, nNumberOfBytesToRead=0xd5600, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12739da0*, lpNumberOfBytesRead=0x1c9aeb38*=0xd5600, lpOverlapped=0x0) returned 1 [0059.685] CloseHandle (hObject=0x2b8) returned 1 [0059.837] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpFilePart=0x0) returned 0x4e [0059.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0059.837] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.844] GetFileType (hFile=0x2b8) returned 0x1 [0059.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0059.845] GetFileType (hFile=0x2b8) returned 0x1 [0059.845] WriteFile (in: hFile=0x2b8, lpBuffer=0x12661968*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesWritten=0x1c9aebc8*=0xd5610, lpOverlapped=0x0) returned 1 [0059.858] CloseHandle (hObject=0x2b8) returned 1 [0059.859] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpFilePart=0x0) returned 0x4e [0059.859] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpFilePart=0x0) returned 0x4e [0059.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0059.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.860] GetFileType (hFile=0x2b8) returned 0x1 [0059.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0059.860] GetFileType (hFile=0x2b8) returned 0x1 [0059.860] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xd5610 [0059.860] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bfcf8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26bfcf8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0059.860] CloseHandle (hObject=0x2b8) returned 1 [0059.860] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", lpFilePart=0x0) returned 0x4e [0059.860] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\T2ZmaWNlMzJNVUkubXNp", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\T2ZmaWNlMzJNVUkubXNp", lpFilePart=0x0) returned 0x53 [0059.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0059.860] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcb82a440, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd561a)) returned 1 [0059.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0059.860] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\T2ZmaWNlMzJNVUkubXNp" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\t2zmawnlmzjnvukubxnp")) returned 1 [0059.861] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0059.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0059.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.861] GetFileType (hFile=0x2b8) returned 0x1 [0059.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0059.861] GetFileType (hFile=0x2b8) returned 0x1 [0059.861] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x567 [0059.861] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1373, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x55d [0059.861] ReadFile (in: hFile=0x2b8, lpBuffer=0x26c1130, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26c1130*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0059.863] CloseHandle (hObject=0x2b8) returned 1 [0059.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0059.869] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0059.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0059.870] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), fInfoLevelId=0x0, lpFileInformation=0x272bbf0 | out: lpFileInformation=0x272bbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567)) returned 1 [0059.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0059.870] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0059.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0059.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.870] GetFileType (hFile=0x2b8) returned 0x1 [0059.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0059.870] GetFileType (hFile=0x2b8) returned 0x1 [0059.870] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x567 [0059.870] ReadFile (in: hFile=0x2b8, lpBuffer=0x272c448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x272c448*, lpNumberOfBytesRead=0x1c9aeb38*=0x567, lpOverlapped=0x0) returned 1 [0059.870] CloseHandle (hObject=0x2b8) returned 1 [0059.899] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0059.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0059.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.900] GetFileType (hFile=0x2b8) returned 0x1 [0059.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0059.900] GetFileType (hFile=0x2b8) returned 0x1 [0059.900] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a5d00*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27a5d00*, lpNumberOfBytesWritten=0x1c9aea78*=0x570, lpOverlapped=0x0) returned 1 [0059.901] CloseHandle (hObject=0x2b8) returned 1 [0059.901] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0059.901] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0059.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0059.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.901] GetFileType (hFile=0x2b8) returned 0x1 [0059.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0059.901] GetFileType (hFile=0x2b8) returned 0x1 [0059.901] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x570 [0059.901] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a7b60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27a7b60*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0059.902] CloseHandle (hObject=0x2b8) returned 1 [0059.902] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0059.902] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\T2ZmaWNlMzJNVUkueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\T2ZmaWNlMzJNVUkueG1s", lpFilePart=0x0) returned 0x53 [0059.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0059.902] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcb89c860, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x57a)) returned 1 [0059.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0059.902] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\T2ZmaWNlMzJNVUkueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\t2zmawnlmzjnvukueg1s")) returned 1 [0059.903] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpFilePart=0x0) returned 0x4b [0059.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0059.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.903] GetFileType (hFile=0x2b8) returned 0x1 [0059.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0059.903] GetFileType (hFile=0x2b8) returned 0x1 [0059.903] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2cb13b [0059.903] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2928945, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2cb131 [0059.903] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a8f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27a8f90*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0059.905] CloseHandle (hObject=0x2b8) returned 1 [0059.906] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpFilePart=0x0) returned 0x4b [0059.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0059.906] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), fInfoLevelId=0x0, lpFileInformation=0x2812c08 | out: lpFileInformation=0x2812c08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b)) returned 1 [0059.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0059.915] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpFilePart=0x0) returned 0x4b [0059.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0059.915] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.915] GetFileType (hFile=0x2b8) returned 0x1 [0059.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0059.915] GetFileType (hFile=0x2b8) returned 0x1 [0059.915] ReadFile (in: hFile=0x2b8, lpBuffer=0x129ba010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x129ba010*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0059.926] CloseHandle (hObject=0x2b8) returned 1 [0059.932] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpFilePart=0x0) returned 0x4b [0059.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0059.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0059.932] GetFileType (hFile=0x2b8) returned 0x1 [0059.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0059.932] GetFileType (hFile=0x2b8) returned 0x1 [0060.059] WriteFile (in: hFile=0x2b8, lpBuffer=0x128619d8*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0060.062] CloseHandle (hObject=0x2b8) returned 1 [0060.062] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpFilePart=0x0) returned 0x4b [0060.062] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpFilePart=0x0) returned 0x4b [0060.062] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpFilePart=0x0) returned 0x4b [0060.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.063] GetFileType (hFile=0x2b8) returned 0x1 [0060.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.063] GetFileType (hFile=0x2b8) returned 0x1 [0060.063] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x2cb13b [0060.063] WriteFile (in: hFile=0x2b8, lpBuffer=0x26abad0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26abad0*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0060.063] CloseHandle (hObject=0x2b8) returned 1 [0060.063] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpFilePart=0x0) returned 0x4b [0060.063] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\T1dPVzMyTFIuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\T1dPVzMyTFIuY2Fi", lpFilePart=0x0) returned 0x4f [0060.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0060.063] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcba19620, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x2cb145)) returned 1 [0060.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0060.063] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\T1dPVzMyTFIuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\t1dpvzmytfiuy2fi")) returned 1 [0060.064] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0060.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.064] GetFileType (hFile=0x2b8) returned 0x1 [0060.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0060.064] GetFileType (hFile=0x2b8) returned 0x1 [0060.064] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x93a [0060.064] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2352, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x930 [0060.064] ReadFile (in: hFile=0x2b8, lpBuffer=0x26acee0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26acee0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0060.066] CloseHandle (hObject=0x2b8) returned 1 [0060.068] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0060.068] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x27189f0 | out: lpFileInformation=0x27189f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a)) returned 1 [0060.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0060.068] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0060.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.068] GetFileType (hFile=0x2b8) returned 0x1 [0060.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0060.068] GetFileType (hFile=0x2b8) returned 0x1 [0060.068] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x93a [0060.068] ReadFile (in: hFile=0x2b8, lpBuffer=0x2719600, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2719600*, lpNumberOfBytesRead=0x1c9aeb38*=0x93a, lpOverlapped=0x0) returned 1 [0060.068] CloseHandle (hObject=0x2b8) returned 1 [0060.088] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0060.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.089] GetFileType (hFile=0x2b8) returned 0x1 [0060.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0060.089] GetFileType (hFile=0x2b8) returned 0x1 [0060.089] WriteFile (in: hFile=0x2b8, lpBuffer=0x27941b0*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27941b0*, lpNumberOfBytesWritten=0x1c9aea78*=0x940, lpOverlapped=0x0) returned 1 [0060.090] CloseHandle (hObject=0x2b8) returned 1 [0060.090] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.090] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0060.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.091] GetFileType (hFile=0x2b8) returned 0x1 [0060.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0060.091] GetFileType (hFile=0x2b8) returned 0x1 [0060.091] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x940 [0060.091] WriteFile (in: hFile=0x2b8, lpBuffer=0x2795fd8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2795fd8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0060.091] CloseHandle (hObject=0x2b8) returned 1 [0060.091] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.091] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0060.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0060.091] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcba658e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x94a)) returned 1 [0060.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0060.092] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0060.092] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0060.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0060.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0060.093] GetFileType (hFile=0x2b8) returned 0x1 [0060.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0060.093] GetFileType (hFile=0x2b8) returned 0x1 [0060.093] WriteFile (in: hFile=0x2b8, lpBuffer=0x279a310*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x279a310*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0060.094] CloseHandle (hObject=0x2b8) returned 1 [0060.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0060.094] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0060.094] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0060.094] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0060.096] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.096] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0060.096] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0060.096] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0060.096] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0060.096] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0060.096] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0060.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0060.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0060.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0060.098] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0060.098] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0060.098] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0060.098] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.099] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0060.099] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0060.099] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0060.099] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0060.099] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0060.099] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0060.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0060.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0060.100] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpFilePart=0x0) returned 0x48 [0060.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0060.100] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.101] GetFileType (hFile=0x2b8) returned 0x1 [0060.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0060.101] GetFileType (hFile=0x2b8) returned 0x1 [0060.101] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1200204 [0060.101] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=18874874, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x12001fa [0060.101] ReadFile (in: hFile=0x2b8, lpBuffer=0x279e7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x279e7e0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0060.103] CloseHandle (hObject=0x2b8) returned 1 [0060.105] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpFilePart=0x0) returned 0x48 [0060.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0060.105] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), fInfoLevelId=0x0, lpFileInformation=0x2808498 | out: lpFileInformation=0x2808498*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204)) returned 1 [0060.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0060.161] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpFilePart=0x0) returned 0x48 [0060.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.161] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.162] GetFileType (hFile=0x2b8) returned 0x1 [0060.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.162] GetFileType (hFile=0x2b8) returned 0x1 [0060.162] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0060.180] CloseHandle (hObject=0x2b8) returned 1 [0060.192] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpFilePart=0x0) returned 0x48 [0060.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.193] GetFileType (hFile=0x2b8) returned 0x1 [0060.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.193] GetFileType (hFile=0x2b8) returned 0x1 [0060.306] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0060.309] CloseHandle (hObject=0x2b8) returned 1 [0060.310] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpFilePart=0x0) returned 0x48 [0060.310] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpFilePart=0x0) returned 0x48 [0060.310] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpFilePart=0x0) returned 0x48 [0060.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.311] GetFileType (hFile=0x2b8) returned 0x1 [0060.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.311] GetFileType (hFile=0x2b8) returned 0x1 [0060.311] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x1200204 [0060.311] WriteFile (in: hFile=0x2b8, lpBuffer=0x269ae48*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x269ae48*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0060.311] CloseHandle (hObject=0x2b8) returned 1 [0060.311] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpFilePart=0x0) returned 0x48 [0060.311] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\SW5mTFIuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\SW5mTFIuY2Fi", lpFilePart=0x0) returned 0x4b [0060.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0060.311] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcbc7ac20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x120020e)) returned 1 [0060.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0060.311] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\SW5mTFIuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\sw5mtfiuy2fi")) returned 1 [0060.312] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpFilePart=0x0) returned 0x4e [0060.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0060.312] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.312] GetFileType (hFile=0x2b8) returned 0x1 [0060.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0060.312] GetFileType (hFile=0x2b8) returned 0x1 [0060.312] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2fac00 [0060.312] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=3124214, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2fabf6 [0060.313] ReadFile (in: hFile=0x2b8, lpBuffer=0x269c258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x269c258*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0060.321] CloseHandle (hObject=0x2b8) returned 1 [0060.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0060.329] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpFilePart=0x0) returned 0x4e [0060.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0060.329] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x2705df0 | out: lpFileInformation=0x2705df0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00)) returned 1 [0060.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0060.362] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpFilePart=0x0) returned 0x4e [0060.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.362] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.362] GetFileType (hFile=0x2b8) returned 0x1 [0060.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.362] GetFileType (hFile=0x2b8) returned 0x1 [0060.362] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0060.408] CloseHandle (hObject=0x2b8) returned 1 [0060.408] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpFilePart=0x0) returned 0x4e [0060.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.409] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.409] GetFileType (hFile=0x2b8) returned 0x1 [0060.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.409] GetFileType (hFile=0x2b8) returned 0x1 [0060.492] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0060.495] CloseHandle (hObject=0x2b8) returned 1 [0060.495] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpFilePart=0x0) returned 0x4e [0060.496] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpFilePart=0x0) returned 0x4e [0060.496] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpFilePart=0x0) returned 0x4e [0060.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.496] GetFileType (hFile=0x2b8) returned 0x1 [0060.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.496] GetFileType (hFile=0x2b8) returned 0x1 [0060.496] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x2fac00 [0060.496] WriteFile (in: hFile=0x2b8, lpBuffer=0x267c798*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x267c798*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0060.497] CloseHandle (hObject=0x2b8) returned 1 [0060.497] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", lpFilePart=0x0) returned 0x4e [0060.497] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\SW5mb1BhdGhNVUkubXNp", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\SW5mb1BhdGhNVUkubXNp", lpFilePart=0x0) returned 0x53 [0060.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0060.497] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcbe43ca0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x2fac0a)) returned 1 [0060.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0060.497] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\SW5mb1BhdGhNVUkubXNp" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\sw5mb1bhdghnvukubxnp")) returned 1 [0060.498] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0060.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0060.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.498] GetFileType (hFile=0x2b8) returned 0x1 [0060.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0060.498] GetFileType (hFile=0x2b8) returned 0x1 [0060.498] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x4cf [0060.498] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1221, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x4c5 [0060.498] ReadFile (in: hFile=0x2b8, lpBuffer=0x267dbd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267dbd0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0060.500] CloseHandle (hObject=0x2b8) returned 1 [0060.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0060.506] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0060.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0060.506] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e7768 | out: lpFileInformation=0x26e7768*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf)) returned 1 [0060.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0060.506] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0060.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0060.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.506] GetFileType (hFile=0x2b8) returned 0x1 [0060.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0060.506] GetFileType (hFile=0x2b8) returned 0x1 [0060.506] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x4cf [0060.506] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e7f28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26e7f28*, lpNumberOfBytesRead=0x1c9aeb38*=0x4cf, lpOverlapped=0x0) returned 1 [0060.506] CloseHandle (hObject=0x2b8) returned 1 [0060.552] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0060.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0060.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.553] GetFileType (hFile=0x2b8) returned 0x1 [0060.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0060.553] GetFileType (hFile=0x2b8) returned 0x1 [0060.553] WriteFile (in: hFile=0x2b8, lpBuffer=0x2763d60*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x2763d60*, lpNumberOfBytesWritten=0x1c9aea78*=0x4d0, lpOverlapped=0x0) returned 1 [0060.554] CloseHandle (hObject=0x2b8) returned 1 [0060.555] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0060.555] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0060.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0060.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.555] GetFileType (hFile=0x2b8) returned 0x1 [0060.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0060.555] GetFileType (hFile=0x2b8) returned 0x1 [0060.555] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4d0 [0060.555] WriteFile (in: hFile=0x2b8, lpBuffer=0x2765bc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2765bc0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0060.555] CloseHandle (hObject=0x2b8) returned 1 [0060.555] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0060.555] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\SW5mb1BhdGhNVUkueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\SW5mb1BhdGhNVUkueG1s", lpFilePart=0x0) returned 0x53 [0060.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0060.555] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcbeb60c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4da)) returned 1 [0060.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0060.556] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\SW5mb1BhdGhNVUkueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\sw5mb1bhdghnvukueg1s")) returned 1 [0060.556] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0060.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.556] GetFileType (hFile=0x2b8) returned 0x1 [0060.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0060.556] GetFileType (hFile=0x2b8) returned 0x1 [0060.556] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x73c [0060.556] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1842, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x732 [0060.557] ReadFile (in: hFile=0x2b8, lpBuffer=0x2766fe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2766fe8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0060.558] CloseHandle (hObject=0x2b8) returned 1 [0060.560] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0060.560] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x27d0b80 | out: lpFileInformation=0x27d0b80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c)) returned 1 [0060.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0060.560] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0060.560] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.560] GetFileType (hFile=0x2b8) returned 0x1 [0060.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0060.560] GetFileType (hFile=0x2b8) returned 0x1 [0060.560] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x73c [0060.561] ReadFile (in: hFile=0x2b8, lpBuffer=0x27d1590, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27d1590*, lpNumberOfBytesRead=0x1c9aeb38*=0x73c, lpOverlapped=0x0) returned 1 [0060.561] CloseHandle (hObject=0x2b8) returned 1 [0060.571] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0060.571] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.572] GetFileType (hFile=0x2b8) returned 0x1 [0060.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0060.572] GetFileType (hFile=0x2b8) returned 0x1 [0060.572] WriteFile (in: hFile=0x2b8, lpBuffer=0x284b4a8*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x284b4a8*, lpNumberOfBytesWritten=0x1c9aea78*=0x740, lpOverlapped=0x0) returned 1 [0060.573] CloseHandle (hObject=0x2b8) returned 1 [0060.574] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.574] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0060.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.574] GetFileType (hFile=0x2b8) returned 0x1 [0060.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0060.574] GetFileType (hFile=0x2b8) returned 0x1 [0060.574] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x740 [0060.574] WriteFile (in: hFile=0x2b8, lpBuffer=0x284d2d0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x284d2d0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0060.574] CloseHandle (hObject=0x2b8) returned 1 [0060.574] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.574] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0060.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0060.574] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcbf02380, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x74a)) returned 1 [0060.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0060.575] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0060.575] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0060.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0060.575] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0060.575] GetFileType (hFile=0x2b8) returned 0x1 [0060.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0060.576] GetFileType (hFile=0x2b8) returned 0x1 [0060.576] WriteFile (in: hFile=0x2b8, lpBuffer=0x2851608*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2851608*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0060.577] CloseHandle (hObject=0x2b8) returned 1 [0060.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0060.577] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0060.577] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0060.577] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0060.577] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.577] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0060.578] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0060.578] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0060.578] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0060.578] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0060.578] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0060.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0060.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0060.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0060.578] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0060.579] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0060.579] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0060.579] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.579] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0060.579] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0060.579] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0060.579] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0060.580] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0060.580] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0060.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0060.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0060.580] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0060.580] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.581] GetFileType (hFile=0x2b8) returned 0x1 [0060.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0060.581] GetFileType (hFile=0x2b8) returned 0x1 [0060.581] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1861 [0060.581] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=6231, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1857 [0060.581] ReadFile (in: hFile=0x2b8, lpBuffer=0x28559c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28559c0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0060.582] CloseHandle (hObject=0x2b8) returned 1 [0060.602] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0060.602] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x26f8250 | out: lpFileInformation=0x26f8250*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861)) returned 1 [0060.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0060.602] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0060.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.602] GetFileType (hFile=0x2b8) returned 0x1 [0060.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0060.602] GetFileType (hFile=0x2b8) returned 0x1 [0060.602] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x1861 [0060.602] ReadFile (in: hFile=0x2b8, lpBuffer=0x26f8508, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26f8508*, lpNumberOfBytesRead=0x1c9aeb38*=0x1861, lpOverlapped=0x0) returned 1 [0060.603] CloseHandle (hObject=0x2b8) returned 1 [0060.638] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0060.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.639] GetFileType (hFile=0x2b8) returned 0x1 [0060.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0060.639] GetFileType (hFile=0x2b8) returned 0x1 [0060.639] WriteFile (in: hFile=0x2b8, lpBuffer=0x2776b28*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2776b28*, lpNumberOfBytesWritten=0x1c9aebc8*=0x1870, lpOverlapped=0x0) returned 1 [0060.640] CloseHandle (hObject=0x2b8) returned 1 [0060.640] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.640] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0060.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.640] GetFileType (hFile=0x2b8) returned 0x1 [0060.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0060.640] GetFileType (hFile=0x2b8) returned 0x1 [0060.640] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x1870 [0060.640] WriteFile (in: hFile=0x2b8, lpBuffer=0x2779328*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2779328*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0060.640] CloseHandle (hObject=0x2b8) returned 1 [0060.641] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0060.641] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0060.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0060.641] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0xcbf9a900, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x187a)) returned 1 [0060.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0060.641] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0060.643] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpFilePart=0x0) returned 0x4a [0060.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0060.643] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.644] GetFileType (hFile=0x2b8) returned 0x1 [0060.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0060.644] GetFileType (hFile=0x2b8) returned 0x1 [0060.644] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x30780dd [0060.644] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=50823379, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x30780d3 [0060.644] ReadFile (in: hFile=0x2b8, lpBuffer=0x277a728, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x277a728*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0060.646] CloseHandle (hObject=0x2b8) returned 1 [0060.648] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpFilePart=0x0) returned 0x4a [0060.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0060.648] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), fInfoLevelId=0x0, lpFileInformation=0x27e43e0 | out: lpFileInformation=0x27e43e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd)) returned 1 [0060.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0060.650] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpFilePart=0x0) returned 0x4a [0060.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.650] GetFileType (hFile=0x2b8) returned 0x1 [0060.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.650] GetFileType (hFile=0x2b8) returned 0x1 [0060.651] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0060.679] CloseHandle (hObject=0x2b8) returned 1 [0060.679] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpFilePart=0x0) returned 0x4a [0060.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.679] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.679] GetFileType (hFile=0x2b8) returned 0x1 [0060.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.679] GetFileType (hFile=0x2b8) returned 0x1 [0060.841] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a61a48*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0060.846] CloseHandle (hObject=0x2b8) returned 1 [0060.847] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpFilePart=0x0) returned 0x4a [0060.848] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpFilePart=0x0) returned 0x4a [0060.848] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpFilePart=0x0) returned 0x4a [0060.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.848] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.848] GetFileType (hFile=0x2b8) returned 0x1 [0060.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.848] GetFileType (hFile=0x2b8) returned 0x1 [0060.848] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x30780dd [0060.848] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bd790*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26bd790*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0060.849] CloseHandle (hObject=0x2b8) returned 1 [0060.849] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpFilePart=0x0) returned 0x4a [0060.849] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VmlzaW9MUi5jYWI=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VmlzaW9MUi5jYWI=", lpFilePart=0x0) returned 0x4f [0060.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0060.849] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0xcc189ae0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x30780e7)) returned 1 [0060.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0060.850] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VmlzaW9MUi5jYWI=" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\vmlzaw9mui5jywi=")) returned 1 [0060.850] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpFilePart=0x0) returned 0x4b [0060.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0060.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.850] GetFileType (hFile=0x2b8) returned 0x1 [0060.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0060.850] GetFileType (hFile=0x2b8) returned 0x1 [0060.850] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2ab000 [0060.851] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2797558, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2aaff6 [0060.851] ReadFile (in: hFile=0x2b8, lpBuffer=0x26beba8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26beba8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0060.852] CloseHandle (hObject=0x2b8) returned 1 [0060.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0060.864] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpFilePart=0x0) returned 0x4b [0060.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0060.864] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), fInfoLevelId=0x0, lpFileInformation=0x26a5b20 | out: lpFileInformation=0x26a5b20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000)) returned 1 [0060.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0060.868] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpFilePart=0x0) returned 0x4b [0060.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.868] GetFileType (hFile=0x2b8) returned 0x1 [0060.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.868] GetFileType (hFile=0x2b8) returned 0x1 [0060.868] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0060.906] CloseHandle (hObject=0x2b8) returned 1 [0060.906] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpFilePart=0x0) returned 0x4b [0060.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0060.906] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0060.906] GetFileType (hFile=0x2b8) returned 0x1 [0060.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0060.906] GetFileType (hFile=0x2b8) returned 0x1 [0061.039] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpFilePart=0x0) returned 0x4b [0061.039] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpFilePart=0x0) returned 0x4b [0061.039] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpFilePart=0x0) returned 0x4b [0061.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.040] GetFileType (hFile=0x2b8) returned 0x1 [0061.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.040] GetFileType (hFile=0x2b8) returned 0x1 [0061.040] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x2ab000 [0061.040] WriteFile (in: hFile=0x2b8, lpBuffer=0x2690940*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2690940*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0061.040] CloseHandle (hObject=0x2b8) returned 1 [0061.041] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", lpFilePart=0x0) returned 0x4b [0061.041] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VmlzaW9NVUkubXNp", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VmlzaW9NVUkubXNp", lpFilePart=0x0) returned 0x4f [0061.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0061.041] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0xcc378cc0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x2ab00a)) returned 1 [0061.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0061.041] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VmlzaW9NVUkubXNp" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\vmlzaw9nvukubxnp")) returned 1 [0061.042] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0061.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0061.042] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.042] GetFileType (hFile=0x2b8) returned 0x1 [0061.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0061.043] GetFileType (hFile=0x2b8) returned 0x1 [0061.043] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x251f [0061.043] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=9493, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2515 [0061.043] ReadFile (in: hFile=0x2b8, lpBuffer=0x2691d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2691d58*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0061.045] CloseHandle (hObject=0x2b8) returned 1 [0061.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0061.051] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0061.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0061.052] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), fInfoLevelId=0x0, lpFileInformation=0x26fbe70 | out: lpFileInformation=0x26fbe70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f)) returned 1 [0061.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0061.052] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0061.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0061.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.052] GetFileType (hFile=0x2b8) returned 0x1 [0061.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0061.052] GetFileType (hFile=0x2b8) returned 0x1 [0061.052] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x251f [0061.052] ReadFile (in: hFile=0x2b8, lpBuffer=0x26fc138, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26fc138*, lpNumberOfBytesRead=0x1c9aeb38*=0x251f, lpOverlapped=0x0) returned 1 [0061.069] CloseHandle (hObject=0x2b8) returned 1 [0061.116] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0061.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0061.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.118] GetFileType (hFile=0x2b8) returned 0x1 [0061.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0061.118] GetFileType (hFile=0x2b8) returned 0x1 [0061.118] WriteFile (in: hFile=0x2b8, lpBuffer=0x2781300*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2781300*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2520, lpOverlapped=0x0) returned 1 [0061.119] CloseHandle (hObject=0x2b8) returned 1 [0061.119] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0061.119] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0061.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0061.119] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.119] GetFileType (hFile=0x2b8) returned 0x1 [0061.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0061.119] GetFileType (hFile=0x2b8) returned 0x1 [0061.119] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2520 [0061.119] WriteFile (in: hFile=0x2b8, lpBuffer=0x27847d0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27847d0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0061.120] CloseHandle (hObject=0x2b8) returned 1 [0061.120] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0061.120] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VmlzaW9NVUkueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VmlzaW9NVUkueG1s", lpFilePart=0x0) returned 0x4f [0061.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0061.120] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0xcc411240, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x252a)) returned 1 [0061.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0061.120] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VmlzaW9NVUkueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\vmlzaw9nvukueg1s")) returned 1 [0061.122] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0061.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0061.122] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0061.122] GetFileType (hFile=0x2b8) returned 0x1 [0061.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0061.123] GetFileType (hFile=0x2b8) returned 0x1 [0061.123] WriteFile (in: hFile=0x2b8, lpBuffer=0x2788b18*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2788b18*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0061.124] CloseHandle (hObject=0x2b8) returned 1 [0061.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0061.124] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0061.124] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0061.124] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0061.127] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.127] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0061.127] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0061.127] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0061.127] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.127] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.127] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0061.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0061.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0061.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0061.129] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0061.129] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0061.129] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808540 [0061.130] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.130] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0061.130] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0061.130] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0061.130] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.130] FindNextFileW (in: hFindFile=0x1a808540, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.130] FindClose (in: hFindFile=0x1a808540 | out: hFindFile=0x1a808540) returned 1 [0061.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0061.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0061.131] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpFilePart=0x0) returned 0x4d [0061.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0061.131] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.132] GetFileType (hFile=0x2b8) returned 0x1 [0061.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0061.132] GetFileType (hFile=0x2b8) returned 0x1 [0061.132] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x263400 [0061.132] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2503670, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2633f6 [0061.132] ReadFile (in: hFile=0x2b8, lpBuffer=0x278cff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x278cff8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0061.134] CloseHandle (hObject=0x2b8) returned 1 [0061.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x114e0) returned 0x0 [0061.141] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpFilePart=0x0) returned 0x4d [0061.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0061.141] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x27f6b90 | out: lpFileInformation=0x27f6b90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400)) returned 1 [0061.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0061.143] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpFilePart=0x0) returned 0x4d [0061.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.144] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.144] GetFileType (hFile=0x2b8) returned 0x1 [0061.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.144] GetFileType (hFile=0x2b8) returned 0x1 [0061.144] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61a48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0061.169] CloseHandle (hObject=0x2b8) returned 1 [0061.169] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpFilePart=0x0) returned 0x4d [0061.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.169] GetFileType (hFile=0x2b8) returned 0x1 [0061.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.169] GetFileType (hFile=0x2b8) returned 0x1 [0061.300] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpFilePart=0x0) returned 0x4d [0061.301] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpFilePart=0x0) returned 0x4d [0061.301] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpFilePart=0x0) returned 0x4d [0061.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.301] GetFileType (hFile=0x2b8) returned 0x1 [0061.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.301] GetFileType (hFile=0x2b8) returned 0x1 [0061.301] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x263400 [0061.301] WriteFile (in: hFile=0x2b8, lpBuffer=0x270bfa8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x270bfa8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0061.301] CloseHandle (hObject=0x2b8) returned 1 [0061.301] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", lpFilePart=0x0) returned 0x4d [0061.301] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\T25lTm90ZU1VSS5tc2k=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\T25lTm90ZU1VSS5tc2k=", lpFilePart=0x0) returned 0x53 [0061.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0061.302] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcc5da2c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x26340a)) returned 1 [0061.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0061.302] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\T25lTm90ZU1VSS5tc2k=" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\t25ltm90zu1vss5tc2k=")) returned 1 [0061.303] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0061.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0061.303] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.303] GetFileType (hFile=0x2b8) returned 0x1 [0061.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0061.303] GetFileType (hFile=0x2b8) returned 0x1 [0061.303] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x646 [0061.303] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1596, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x63c [0061.304] ReadFile (in: hFile=0x2b8, lpBuffer=0x270d3e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x270d3e0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0061.305] CloseHandle (hObject=0x2b8) returned 1 [0061.307] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0061.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0061.307] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2776f78 | out: lpFileInformation=0x2776f78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646)) returned 1 [0061.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0061.307] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0061.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0061.307] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.308] GetFileType (hFile=0x2b8) returned 0x1 [0061.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0061.308] GetFileType (hFile=0x2b8) returned 0x1 [0061.308] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x646 [0061.308] ReadFile (in: hFile=0x2b8, lpBuffer=0x27778b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27778b0*, lpNumberOfBytesRead=0x1c9aeb38*=0x646, lpOverlapped=0x0) returned 1 [0061.308] CloseHandle (hObject=0x2b8) returned 1 [0061.343] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0061.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0061.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.344] GetFileType (hFile=0x2b8) returned 0x1 [0061.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0061.344] GetFileType (hFile=0x2b8) returned 0x1 [0061.344] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f15c8*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27f15c8*, lpNumberOfBytesWritten=0x1c9aea78*=0x650, lpOverlapped=0x0) returned 1 [0061.345] CloseHandle (hObject=0x2b8) returned 1 [0061.345] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0061.345] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0061.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0061.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.345] GetFileType (hFile=0x2b8) returned 0x1 [0061.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0061.345] GetFileType (hFile=0x2b8) returned 0x1 [0061.345] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x650 [0061.345] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f3428*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27f3428*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0061.346] CloseHandle (hObject=0x2b8) returned 1 [0061.346] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0061.346] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\T25lTm90ZU1VSS54bWw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\T25lTm90ZU1VSS54bWw=", lpFilePart=0x0) returned 0x53 [0061.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0061.346] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcc64c6e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x65a)) returned 1 [0061.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0061.346] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\T25lTm90ZU1VSS54bWw=" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\t25ltm90zu1vss54bww=")) returned 1 [0061.346] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpFilePart=0x0) returned 0x4a [0061.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0061.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.373] GetFileType (hFile=0x2b8) returned 0x1 [0061.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0061.373] GetFileType (hFile=0x2b8) returned 0x1 [0061.373] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x10a5df8 [0061.373] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=17456622, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x10a5dee [0061.374] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f70f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27f70f8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0061.375] CloseHandle (hObject=0x2b8) returned 1 [0061.377] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpFilePart=0x0) returned 0x4a [0061.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0061.377] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x2860db0 | out: lpFileInformation=0x2860db0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8)) returned 1 [0061.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0061.448] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpFilePart=0x0) returned 0x4a [0061.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.448] GetFileType (hFile=0x2b8) returned 0x1 [0061.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.448] GetFileType (hFile=0x2b8) returned 0x1 [0061.448] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0061.472] CloseHandle (hObject=0x2b8) returned 1 [0061.472] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpFilePart=0x0) returned 0x4a [0061.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.472] GetFileType (hFile=0x2b8) returned 0x1 [0061.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.473] GetFileType (hFile=0x2b8) returned 0x1 [0061.587] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0061.590] CloseHandle (hObject=0x2b8) returned 1 [0061.590] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpFilePart=0x0) returned 0x4a [0061.591] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpFilePart=0x0) returned 0x4a [0061.591] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpFilePart=0x0) returned 0x4a [0061.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.591] GetFileType (hFile=0x2b8) returned 0x1 [0061.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.591] GetFileType (hFile=0x2b8) returned 0x1 [0061.591] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x10a5df8 [0061.591] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bae88*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26bae88*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0061.591] CloseHandle (hObject=0x2b8) returned 1 [0061.592] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpFilePart=0x0) returned 0x4a [0061.592] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\T25vdGVMUi5jYWI=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\T25vdGVMUi5jYWI=", lpFilePart=0x0) returned 0x4f [0061.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0061.592] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcc8adce0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x10a5e02)) returned 1 [0061.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0061.592] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\T25vdGVMUi5jYWI=" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\t25vdgvmui5jywi=")) returned 1 [0061.592] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0061.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0061.593] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.593] GetFileType (hFile=0x2b8) returned 0x1 [0061.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0061.593] GetFileType (hFile=0x2b8) returned 0x1 [0061.593] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x7c4 [0061.593] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1978, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x7ba [0061.593] ReadFile (in: hFile=0x2b8, lpBuffer=0x26bc298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26bc298*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0061.595] CloseHandle (hObject=0x2b8) returned 1 [0061.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0061.601] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0061.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0061.602] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2725f50 | out: lpFileInformation=0x2725f50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4)) returned 1 [0061.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0061.602] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0061.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0061.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.602] GetFileType (hFile=0x2b8) returned 0x1 [0061.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0061.602] GetFileType (hFile=0x2b8) returned 0x1 [0061.602] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x7c4 [0061.602] ReadFile (in: hFile=0x2b8, lpBuffer=0x27269e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27269e8*, lpNumberOfBytesRead=0x1c9aeb38*=0x7c4, lpOverlapped=0x0) returned 1 [0061.602] CloseHandle (hObject=0x2b8) returned 1 [0061.627] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0061.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0061.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.628] GetFileType (hFile=0x2b8) returned 0x1 [0061.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0061.628] GetFileType (hFile=0x2b8) returned 0x1 [0061.628] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a0e70*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27a0e70*, lpNumberOfBytesWritten=0x1c9aea78*=0x7d0, lpOverlapped=0x0) returned 1 [0061.629] CloseHandle (hObject=0x2b8) returned 1 [0061.629] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0061.629] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0061.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0061.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.629] GetFileType (hFile=0x2b8) returned 0x1 [0061.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0061.630] GetFileType (hFile=0x2b8) returned 0x1 [0061.630] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x7d0 [0061.630] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a2c98*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27a2c98*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0061.630] CloseHandle (hObject=0x2b8) returned 1 [0061.630] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0061.630] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0061.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0061.630] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcc8f9fa0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x7da)) returned 1 [0061.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0061.630] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0061.631] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0061.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0061.631] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0061.631] GetFileType (hFile=0x2b8) returned 0x1 [0061.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0061.631] GetFileType (hFile=0x2b8) returned 0x1 [0061.631] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a6fd0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x27a6fd0*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0061.632] CloseHandle (hObject=0x2b8) returned 1 [0061.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0061.632] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0061.633] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0061.633] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0061.637] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.637] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0061.637] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0061.637] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0061.637] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.637] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.638] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0061.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0061.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0061.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0061.639] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0061.639] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0061.639] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0061.640] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.640] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0061.640] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0061.640] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0061.640] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.641] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.641] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0061.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0061.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0061.641] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpFilePart=0x0) returned 0x4d [0061.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0061.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.643] GetFileType (hFile=0x2b8) returned 0x1 [0061.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0061.643] GetFileType (hFile=0x2b8) returned 0x1 [0061.643] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x265400 [0061.643] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2511862, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2653f6 [0061.643] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ab4b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27ab4b0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0061.645] CloseHandle (hObject=0x2b8) returned 1 [0061.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0061.651] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpFilePart=0x0) returned 0x4d [0061.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0061.651] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x2815168 | out: lpFileInformation=0x2815168*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400)) returned 1 [0061.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0061.683] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpFilePart=0x0) returned 0x4d [0061.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.683] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.683] GetFileType (hFile=0x2b8) returned 0x1 [0061.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.683] GetFileType (hFile=0x2b8) returned 0x1 [0061.683] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0061.702] CloseHandle (hObject=0x2b8) returned 1 [0061.707] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpFilePart=0x0) returned 0x4d [0061.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.707] GetFileType (hFile=0x2b8) returned 0x1 [0061.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.707] GetFileType (hFile=0x2b8) returned 0x1 [0061.819] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0061.823] CloseHandle (hObject=0x2b8) returned 1 [0061.823] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpFilePart=0x0) returned 0x4d [0061.823] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpFilePart=0x0) returned 0x4d [0061.823] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpFilePart=0x0) returned 0x4d [0061.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.824] GetFileType (hFile=0x2b8) returned 0x1 [0061.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.824] GetFileType (hFile=0x2b8) returned 0x1 [0061.824] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x265400 [0061.824] WriteFile (in: hFile=0x2b8, lpBuffer=0x267c798*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x267c798*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0061.824] CloseHandle (hObject=0x2b8) returned 1 [0061.824] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", lpFilePart=0x0) returned 0x4d [0061.824] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UHJvamVjdE1VSS5tc2k=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UHJvamVjdE1VSS5tc2k=", lpFilePart=0x0) returned 0x53 [0061.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0061.824] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xccae9180, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x26540a)) returned 1 [0061.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0061.824] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UHJvamVjdE1VSS5tc2k=" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\uhjvamvjde1vss5tc2k=")) returned 1 [0061.825] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0061.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0061.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.826] GetFileType (hFile=0x2b8) returned 0x1 [0061.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0061.826] GetFileType (hFile=0x2b8) returned 0x1 [0061.826] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x5ac [0061.826] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1442, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x5a2 [0061.826] ReadFile (in: hFile=0x2b8, lpBuffer=0x267dbd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267dbd0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0061.828] CloseHandle (hObject=0x2b8) returned 1 [0061.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0061.834] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0061.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0061.834] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e7888 | out: lpFileInformation=0x26e7888*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac)) returned 1 [0061.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0061.834] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0061.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0061.834] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.834] GetFileType (hFile=0x2b8) returned 0x1 [0061.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0061.834] GetFileType (hFile=0x2b8) returned 0x1 [0061.834] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x5ac [0061.834] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e8128, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26e8128*, lpNumberOfBytesRead=0x1c9aeb38*=0x5ac, lpOverlapped=0x0) returned 1 [0061.835] CloseHandle (hObject=0x2b8) returned 1 [0061.863] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0061.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0061.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.864] GetFileType (hFile=0x2b8) returned 0x1 [0061.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0061.864] GetFileType (hFile=0x2b8) returned 0x1 [0061.864] WriteFile (in: hFile=0x2b8, lpBuffer=0x2761b18*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x2761b18*, lpNumberOfBytesWritten=0x1c9aea78*=0x5b0, lpOverlapped=0x0) returned 1 [0061.865] CloseHandle (hObject=0x2b8) returned 1 [0061.865] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0061.865] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0061.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0061.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.865] GetFileType (hFile=0x2b8) returned 0x1 [0061.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0061.865] GetFileType (hFile=0x2b8) returned 0x1 [0061.865] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x5b0 [0061.865] WriteFile (in: hFile=0x2b8, lpBuffer=0x2763978*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2763978*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0061.865] CloseHandle (hObject=0x2b8) returned 1 [0061.866] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0061.866] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UHJvamVjdE1VSS54bWw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UHJvamVjdE1VSS54bWw=", lpFilePart=0x0) returned 0x53 [0061.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0061.866] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xccb35440, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x5ba)) returned 1 [0061.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0061.866] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UHJvamVjdE1VSS54bWw=" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\uhjvamvjde1vss54bww=")) returned 1 [0061.866] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpFilePart=0x0) returned 0x49 [0061.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0061.866] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.867] GetFileType (hFile=0x2b8) returned 0x1 [0061.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0061.867] GetFileType (hFile=0x2b8) returned 0x1 [0061.867] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x7e1dcd [0061.868] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=8265155, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x7e1dc3 [0061.868] ReadFile (in: hFile=0x2b8, lpBuffer=0x2764da0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2764da0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0061.869] CloseHandle (hObject=0x2b8) returned 1 [0061.871] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpFilePart=0x0) returned 0x49 [0061.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0061.871] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x27ceb38 | out: lpFileInformation=0x27ceb38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd)) returned 1 [0061.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0061.873] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpFilePart=0x0) returned 0x49 [0061.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.873] GetFileType (hFile=0x2b8) returned 0x1 [0061.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.873] GetFileType (hFile=0x2b8) returned 0x1 [0061.873] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0061.919] CloseHandle (hObject=0x2b8) returned 1 [0061.919] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpFilePart=0x0) returned 0x49 [0061.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0061.919] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0061.919] GetFileType (hFile=0x2b8) returned 0x1 [0061.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0061.919] GetFileType (hFile=0x2b8) returned 0x1 [0062.025] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a61a48*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0062.028] CloseHandle (hObject=0x2b8) returned 1 [0062.028] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpFilePart=0x0) returned 0x49 [0062.029] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpFilePart=0x0) returned 0x49 [0062.029] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpFilePart=0x0) returned 0x49 [0062.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0062.029] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.029] GetFileType (hFile=0x2b8) returned 0x1 [0062.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0062.029] GetFileType (hFile=0x2b8) returned 0x1 [0062.029] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x7e1dcd [0062.029] WriteFile (in: hFile=0x2b8, lpBuffer=0x267c758*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x267c758*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0062.029] CloseHandle (hObject=0x2b8) returned 1 [0062.029] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpFilePart=0x0) returned 0x49 [0062.029] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UHJvakxSLmNhYg==", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UHJvakxSLmNhYg==", lpFilePart=0x0) returned 0x4f [0062.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0062.029] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xcccd8360, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dd7)) returned 1 [0062.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0062.030] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UHJvakxSLmNhYg==" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\uhjvakxslmnhyg==")) returned 1 [0062.030] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0062.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.034] GetFileType (hFile=0x2b8) returned 0x1 [0062.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0062.034] GetFileType (hFile=0x2b8) returned 0x1 [0062.034] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x750 [0062.034] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1862, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x746 [0062.034] ReadFile (in: hFile=0x2b8, lpBuffer=0x267db68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267db68*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0062.035] CloseHandle (hObject=0x2b8) returned 1 [0062.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0062.041] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0062.041] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x26ca3a8 | out: lpFileInformation=0x26ca3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0062.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0062.041] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0062.041] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.041] GetFileType (hFile=0x2b8) returned 0x1 [0062.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0062.041] GetFileType (hFile=0x2b8) returned 0x1 [0062.041] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x750 [0062.041] ReadFile (in: hFile=0x2b8, lpBuffer=0x26cadc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26cadc8*, lpNumberOfBytesRead=0x1c9aeb38*=0x750, lpOverlapped=0x0) returned 1 [0062.041] CloseHandle (hObject=0x2b8) returned 1 [0062.084] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0062.084] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.085] GetFileType (hFile=0x2b8) returned 0x1 [0062.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0062.085] GetFileType (hFile=0x2b8) returned 0x1 [0062.085] WriteFile (in: hFile=0x2b8, lpBuffer=0x2745020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x2745020*, lpNumberOfBytesWritten=0x1c9aea78*=0x760, lpOverlapped=0x0) returned 1 [0062.086] CloseHandle (hObject=0x2b8) returned 1 [0062.086] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.086] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0062.086] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.086] GetFileType (hFile=0x2b8) returned 0x1 [0062.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0062.086] GetFileType (hFile=0x2b8) returned 0x1 [0062.086] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x760 [0062.087] WriteFile (in: hFile=0x2b8, lpBuffer=0x2746e48*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2746e48*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0062.087] CloseHandle (hObject=0x2b8) returned 1 [0062.087] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.087] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0062.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0062.087] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xccd708e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x76a)) returned 1 [0062.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0062.087] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0062.088] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0062.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0062.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0062.109] GetFileType (hFile=0x2b8) returned 0x1 [0062.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0062.109] GetFileType (hFile=0x2b8) returned 0x1 [0062.109] WriteFile (in: hFile=0x2b8, lpBuffer=0x274da28*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x274da28*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0062.111] CloseHandle (hObject=0x2b8) returned 1 [0062.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0062.111] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0062.111] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0062.111] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0062.113] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.113] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0062.113] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0062.113] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0062.113] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0062.114] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.114] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0062.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0062.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0062.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0062.114] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0062.115] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0062.115] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0062.115] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.116] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0062.116] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0062.116] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0062.116] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0062.116] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0062.116] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0062.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0062.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0062.117] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpFilePart=0x0) returned 0x4b [0062.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0062.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.119] GetFileType (hFile=0x2b8) returned 0x1 [0062.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0062.119] GetFileType (hFile=0x2b8) returned 0x1 [0062.119] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x3e7e1f [0062.119] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=4095509, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x3e7e15 [0062.119] ReadFile (in: hFile=0x2b8, lpBuffer=0x2751f10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2751f10*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0062.121] CloseHandle (hObject=0x2b8) returned 1 [0062.121] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0062.127] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpFilePart=0x0) returned 0x4b [0062.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0062.127] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x27bbca8 | out: lpFileInformation=0x27bbca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f)) returned 1 [0062.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0062.131] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpFilePart=0x0) returned 0x4b [0062.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0062.131] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.132] GetFileType (hFile=0x2b8) returned 0x1 [0062.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0062.132] GetFileType (hFile=0x2b8) returned 0x1 [0062.132] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0062.145] CloseHandle (hObject=0x2b8) returned 1 [0062.150] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpFilePart=0x0) returned 0x4b [0062.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0062.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.150] GetFileType (hFile=0x2b8) returned 0x1 [0062.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0062.151] GetFileType (hFile=0x2b8) returned 0x1 [0062.286] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0062.290] CloseHandle (hObject=0x2b8) returned 1 [0062.290] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpFilePart=0x0) returned 0x4b [0062.290] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpFilePart=0x0) returned 0x4b [0062.290] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpFilePart=0x0) returned 0x4b [0062.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0062.291] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.291] GetFileType (hFile=0x2b8) returned 0x1 [0062.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0062.291] GetFileType (hFile=0x2b8) returned 0x1 [0062.291] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x3e7e1f [0062.291] WriteFile (in: hFile=0x2b8, lpBuffer=0x2690f28*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2690f28*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0062.291] CloseHandle (hObject=0x2b8) returned 1 [0062.291] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpFilePart=0x0) returned 0x4b [0062.291] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\R3Jvb3ZlTFIuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\R3Jvb3ZlTFIuY2Fi", lpFilePart=0x0) returned 0x4f [0062.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0062.291] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xccf5fac0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e29)) returned 1 [0062.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0062.292] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\R3Jvb3ZlTFIuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\r3jvb3zltfiuy2fi")) returned 1 [0062.292] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpFilePart=0x0) returned 0x4c [0062.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0062.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.292] GetFileType (hFile=0x2b8) returned 0x1 [0062.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0062.292] GetFileType (hFile=0x2b8) returned 0x1 [0062.292] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x264400 [0062.292] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2507766, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2643f6 [0062.293] ReadFile (in: hFile=0x2b8, lpBuffer=0x2692348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2692348*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0062.294] CloseHandle (hObject=0x2b8) returned 1 [0062.295] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0062.305] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpFilePart=0x0) returned 0x4c [0062.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0062.305] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x26b5330 | out: lpFileInformation=0x26b5330*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400)) returned 1 [0062.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0062.308] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpFilePart=0x0) returned 0x4c [0062.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0062.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.308] GetFileType (hFile=0x2b8) returned 0x1 [0062.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0062.308] GetFileType (hFile=0x2b8) returned 0x1 [0062.308] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61a48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0062.350] CloseHandle (hObject=0x2b8) returned 1 [0062.350] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpFilePart=0x0) returned 0x4c [0062.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0062.351] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.351] GetFileType (hFile=0x2b8) returned 0x1 [0062.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0062.351] GetFileType (hFile=0x2b8) returned 0x1 [0062.469] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0062.472] CloseHandle (hObject=0x2b8) returned 1 [0062.472] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpFilePart=0x0) returned 0x4c [0062.472] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpFilePart=0x0) returned 0x4c [0062.472] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpFilePart=0x0) returned 0x4c [0062.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0062.473] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.473] GetFileType (hFile=0x2b8) returned 0x1 [0062.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0062.473] GetFileType (hFile=0x2b8) returned 0x1 [0062.473] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x264400 [0062.473] WriteFile (in: hFile=0x2b8, lpBuffer=0x26a61e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26a61e8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0062.473] CloseHandle (hObject=0x2b8) returned 1 [0062.473] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", lpFilePart=0x0) returned 0x4c [0062.473] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\R3Jvb3ZlTVVJLm1zaQ==", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\R3Jvb3ZlTVVJLm1zaQ==", lpFilePart=0x0) returned 0x53 [0062.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0062.473] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcd1029e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x26440a)) returned 1 [0062.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0062.474] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\R3Jvb3ZlTVVJLm1zaQ==" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\r3jvb3zltvvjlm1zaq==")) returned 1 [0062.474] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0062.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0062.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.474] GetFileType (hFile=0x2b8) returned 0x1 [0062.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0062.475] GetFileType (hFile=0x2b8) returned 0x1 [0062.475] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x391 [0062.475] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=903, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x387 [0062.475] ReadFile (in: hFile=0x2b8, lpBuffer=0x26a7620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26a7620*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0062.477] CloseHandle (hObject=0x2b8) returned 1 [0062.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0062.483] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0062.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0062.483] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x27120f0 | out: lpFileInformation=0x27120f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391)) returned 1 [0062.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0062.483] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0062.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0062.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.484] GetFileType (hFile=0x2b8) returned 0x1 [0062.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0062.484] GetFileType (hFile=0x2b8) returned 0x1 [0062.484] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x391 [0062.484] ReadFile (in: hFile=0x2b8, lpBuffer=0x2712778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2712778*, lpNumberOfBytesRead=0x1c9aeb38*=0x391, lpOverlapped=0x0) returned 1 [0062.484] CloseHandle (hObject=0x2b8) returned 1 [0062.515] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0062.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0062.516] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.516] GetFileType (hFile=0x2b8) returned 0x1 [0062.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0062.517] GetFileType (hFile=0x2b8) returned 0x1 [0062.517] WriteFile (in: hFile=0x2b8, lpBuffer=0x278bc00*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x278bc00*, lpNumberOfBytesWritten=0x1c9aea78*=0x3a0, lpOverlapped=0x0) returned 1 [0062.517] CloseHandle (hObject=0x2b8) returned 1 [0062.518] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0062.518] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0062.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0062.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.518] GetFileType (hFile=0x2b8) returned 0x1 [0062.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0062.518] GetFileType (hFile=0x2b8) returned 0x1 [0062.518] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x3a0 [0062.518] WriteFile (in: hFile=0x2b8, lpBuffer=0x278da60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x278da60*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0062.518] CloseHandle (hObject=0x2b8) returned 1 [0062.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0062.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\R3Jvb3ZlTVVJLnhtbA==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\R3Jvb3ZlTVVJLnhtbA==", lpFilePart=0x0) returned 0x53 [0062.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0062.519] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcd174e00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x3aa)) returned 1 [0062.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0062.519] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\R3Jvb3ZlTVVJLnhtbA==" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\r3jvb3zltvvjlnhtba==")) returned 1 [0062.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0062.519] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.520] GetFileType (hFile=0x2b8) returned 0x1 [0062.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0062.520] GetFileType (hFile=0x2b8) returned 0x1 [0062.520] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x5ac [0062.520] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1442, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x5a2 [0062.520] ReadFile (in: hFile=0x2b8, lpBuffer=0x278ee88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x278ee88*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0062.521] CloseHandle (hObject=0x2b8) returned 1 [0062.522] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0062.524] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0062.524] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x27f8b40 | out: lpFileInformation=0x27f8b40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac)) returned 1 [0062.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0062.524] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0062.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.524] GetFileType (hFile=0x2b8) returned 0x1 [0062.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0062.524] GetFileType (hFile=0x2b8) returned 0x1 [0062.524] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x5ac [0062.525] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f93c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27f93c0*, lpNumberOfBytesRead=0x1c9aeb38*=0x5ac, lpOverlapped=0x0) returned 1 [0062.525] CloseHandle (hObject=0x2b8) returned 1 [0062.593] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0062.593] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.594] GetFileType (hFile=0x2b8) returned 0x1 [0062.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0062.594] GetFileType (hFile=0x2b8) returned 0x1 [0062.594] WriteFile (in: hFile=0x2b8, lpBuffer=0x27128c0*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27128c0*, lpNumberOfBytesWritten=0x1c9aea78*=0x5b0, lpOverlapped=0x0) returned 1 [0062.595] CloseHandle (hObject=0x2b8) returned 1 [0062.595] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.595] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0062.595] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.596] GetFileType (hFile=0x2b8) returned 0x1 [0062.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0062.596] GetFileType (hFile=0x2b8) returned 0x1 [0062.596] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x5b0 [0062.596] WriteFile (in: hFile=0x2b8, lpBuffer=0x27146e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27146e8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0062.596] CloseHandle (hObject=0x2b8) returned 1 [0062.596] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0062.596] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0062.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0062.596] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcd2334e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x5ba)) returned 1 [0062.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0062.596] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0062.597] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0062.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0062.597] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0062.597] GetFileType (hFile=0x2b8) returned 0x1 [0062.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0062.597] GetFileType (hFile=0x2b8) returned 0x1 [0062.598] WriteFile (in: hFile=0x2b8, lpBuffer=0x2718a20*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2718a20*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0062.598] CloseHandle (hObject=0x2b8) returned 1 [0062.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0062.599] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0062.599] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0062.599] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0062.601] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.601] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0062.602] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0062.602] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0062.602] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0062.602] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0062.602] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0062.602] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0062.602] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0062.602] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0062.603] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0062.603] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0062.603] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0062.603] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0062.603] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0062.603] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0062.603] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0062.603] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0062.603] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.604] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0062.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0062.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0062.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0062.604] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0062.604] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0062.605] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0062.605] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.606] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0062.606] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0062.606] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0062.606] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0062.606] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0062.606] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0062.606] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0062.606] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0062.607] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0062.607] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0062.607] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0062.607] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0062.607] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0062.607] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0062.607] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0062.608] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0062.608] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0062.608] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0062.608] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0062.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0062.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0062.609] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0062.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0062.609] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.611] GetFileType (hFile=0x2b8) returned 0x1 [0062.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0062.611] GetFileType (hFile=0x2b8) returned 0x1 [0062.611] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x91975 [0062.612] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=596331, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x9196b [0062.612] ReadFile (in: hFile=0x2b8, lpBuffer=0x27203a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27203a8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0062.614] CloseHandle (hObject=0x2b8) returned 1 [0062.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0062.615] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0062.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0062.615] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x278a060 | out: lpFileInformation=0x278a060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975)) returned 1 [0062.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0062.616] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0062.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0062.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.616] GetFileType (hFile=0x2b8) returned 0x1 [0062.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0062.616] GetFileType (hFile=0x2b8) returned 0x1 [0062.616] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x91975 [0062.619] ReadFile (in: hFile=0x2b8, lpBuffer=0x128619d8, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesRead=0x1c9aeb38*=0x91975, lpOverlapped=0x0) returned 1 [0062.625] CloseHandle (hObject=0x2b8) returned 1 [0062.852] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0062.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0062.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.852] GetFileType (hFile=0x2b8) returned 0x1 [0062.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0062.852] GetFileType (hFile=0x2b8) returned 0x1 [0062.852] WriteFile (in: hFile=0x2b8, lpBuffer=0x12984d30*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12984d30*, lpNumberOfBytesWritten=0x1c9aebc8*=0x91980, lpOverlapped=0x0) returned 1 [0062.862] CloseHandle (hObject=0x2b8) returned 1 [0062.863] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0062.863] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0062.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0062.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.863] GetFileType (hFile=0x2b8) returned 0x1 [0062.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0062.864] GetFileType (hFile=0x2b8) returned 0x1 [0062.864] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x91980 [0062.864] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bb098*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26bb098*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0062.864] CloseHandle (hObject=0x2b8) returned 1 [0062.864] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0062.864] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\YnJhbmRpbmcueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\YnJhbmRpbmcueG1s", lpFilePart=0x0) returned 0x4f [0062.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0062.864] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xcd4bac40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x9198a)) returned 1 [0062.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0062.864] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\YnJhbmRpbmcueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\ynjhbmrpbmcueg1s")) returned 1 [0062.867] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpFilePart=0x0) returned 0x47 [0062.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0062.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.891] GetFileType (hFile=0x2b8) returned 0x1 [0062.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0062.891] GetFileType (hFile=0x2b8) returned 0x1 [0062.891] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xccb88 [0062.891] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=838526, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xccb7e [0062.891] ReadFile (in: hFile=0x2b8, lpBuffer=0x26bff58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26bff58*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0062.892] CloseHandle (hObject=0x2b8) returned 1 [0062.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0062.900] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpFilePart=0x0) returned 0x47 [0062.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0062.900] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), fInfoLevelId=0x0, lpFileInformation=0x2741d18 | out: lpFileInformation=0x2741d18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88)) returned 1 [0062.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0062.900] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpFilePart=0x0) returned 0x47 [0062.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0062.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0062.900] GetFileType (hFile=0x2b8) returned 0x1 [0062.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0062.900] GetFileType (hFile=0x2b8) returned 0x1 [0062.901] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xccb88 [0062.902] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a166e8, nNumberOfBytesToRead=0xccb88, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12a166e8*, lpNumberOfBytesRead=0x1c9aeb38*=0xccb88, lpOverlapped=0x0) returned 1 [0062.917] CloseHandle (hObject=0x2b8) returned 1 [0063.032] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpFilePart=0x0) returned 0x47 [0063.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0063.032] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.039] GetFileType (hFile=0x2b8) returned 0x1 [0063.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0063.039] GetFileType (hFile=0x2b8) returned 0x1 [0063.039] WriteFile (in: hFile=0x2b8, lpBuffer=0x128c7c58*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x128c7c58*, lpNumberOfBytesWritten=0x1c9aebc8*=0xccb90, lpOverlapped=0x0) returned 1 [0063.078] CloseHandle (hObject=0x2b8) returned 1 [0063.081] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpFilePart=0x0) returned 0x47 [0063.081] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpFilePart=0x0) returned 0x47 [0063.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0063.081] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.081] GetFileType (hFile=0x2b8) returned 0x1 [0063.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0063.081] GetFileType (hFile=0x2b8) returned 0x1 [0063.081] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xccb90 [0063.081] WriteFile (in: hFile=0x2b8, lpBuffer=0x267eae0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x267eae0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0063.081] CloseHandle (hObject=0x2b8) returned 1 [0063.081] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", lpFilePart=0x0) returned 0x47 [0063.081] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\RFcyMC5FWEU=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\RFcyMC5FWEU=", lpFilePart=0x0) returned 0x4b [0063.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0063.082] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xcd6cff80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xccb9a)) returned 1 [0063.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0063.082] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\RFcyMC5FWEU=" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\rfcymc5fweu=")) returned 1 [0063.082] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpFilePart=0x0) returned 0x4a [0063.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0063.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.082] GetFileType (hFile=0x2b8) returned 0x1 [0063.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0063.083] GetFileType (hFile=0x2b8) returned 0x1 [0063.083] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x80760 [0063.083] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=526166, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x80756 [0063.083] ReadFile (in: hFile=0x2b8, lpBuffer=0x267fed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267fed8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0063.084] CloseHandle (hObject=0x2b8) returned 1 [0063.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0063.091] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpFilePart=0x0) returned 0x4a [0063.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0063.091] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), fInfoLevelId=0x0, lpFileInformation=0x26eb150 | out: lpFileInformation=0x26eb150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760)) returned 1 [0063.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0063.091] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpFilePart=0x0) returned 0x4a [0063.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0063.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.091] GetFileType (hFile=0x2b8) returned 0x1 [0063.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0063.092] GetFileType (hFile=0x2b8) returned 0x1 [0063.092] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x80760 [0063.137] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x80760, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb38*=0x80760, lpOverlapped=0x0) returned 1 [0063.145] CloseHandle (hObject=0x2b8) returned 1 [0063.214] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpFilePart=0x0) returned 0x4a [0063.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0063.214] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.219] GetFileType (hFile=0x2b8) returned 0x1 [0063.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0063.219] GetFileType (hFile=0x2b8) returned 0x1 [0063.219] WriteFile (in: hFile=0x2b8, lpBuffer=0x128e3f28*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x128e3f28*, lpNumberOfBytesWritten=0x1c9aebc8*=0x80770, lpOverlapped=0x0) returned 1 [0063.245] CloseHandle (hObject=0x2b8) returned 1 [0063.245] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpFilePart=0x0) returned 0x4a [0063.245] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpFilePart=0x0) returned 0x4a [0063.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0063.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.245] GetFileType (hFile=0x2b8) returned 0x1 [0063.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0063.245] GetFileType (hFile=0x2b8) returned 0x1 [0063.245] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x80770 [0063.245] WriteFile (in: hFile=0x2b8, lpBuffer=0x2712ed8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2712ed8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0063.246] CloseHandle (hObject=0x2b8) returned 1 [0063.246] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", lpFilePart=0x0) returned 0x4a [0063.246] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ZHdkY3cyMC5kbGw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ZHdkY3cyMC5kbGw=", lpFilePart=0x0) returned 0x4f [0063.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0063.246] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xcd872ea0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x8077a)) returned 1 [0063.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0063.246] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ZHdkY3cyMC5kbGw=" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\zhdky3cymc5kbgw=")) returned 1 [0063.247] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpFilePart=0x0) returned 0x4b [0063.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0063.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.247] GetFileType (hFile=0x2b8) returned 0x1 [0063.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0063.247] GetFileType (hFile=0x2b8) returned 0x1 [0063.247] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x7eda0 [0063.247] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=519574, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x7ed96 [0063.247] ReadFile (in: hFile=0x2b8, lpBuffer=0x27142f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27142f0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0063.249] CloseHandle (hObject=0x2b8) returned 1 [0063.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0063.254] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpFilePart=0x0) returned 0x4b [0063.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0063.255] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), fInfoLevelId=0x0, lpFileInformation=0x277e0c8 | out: lpFileInformation=0x277e0c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0)) returned 1 [0063.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0063.255] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpFilePart=0x0) returned 0x4b [0063.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0063.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.255] GetFileType (hFile=0x2b8) returned 0x1 [0063.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0063.255] GetFileType (hFile=0x2b8) returned 0x1 [0063.255] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x7eda0 [0063.257] ReadFile (in: hFile=0x2b8, lpBuffer=0x129646d0, nNumberOfBytesToRead=0x7eda0, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x129646d0*, lpNumberOfBytesRead=0x1c9aeb38*=0x7eda0, lpOverlapped=0x0) returned 1 [0063.267] CloseHandle (hObject=0x2b8) returned 1 [0063.325] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpFilePart=0x0) returned 0x4b [0063.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0063.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.329] GetFileType (hFile=0x2b8) returned 0x1 [0063.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0063.329] GetFileType (hFile=0x2b8) returned 0x1 [0063.329] WriteFile (in: hFile=0x2b8, lpBuffer=0x1285d090*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x1285d090*, lpNumberOfBytesWritten=0x1c9aebc8*=0x7edb0, lpOverlapped=0x0) returned 1 [0063.337] CloseHandle (hObject=0x2b8) returned 1 [0063.338] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpFilePart=0x0) returned 0x4b [0063.338] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpFilePart=0x0) returned 0x4b [0063.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0063.338] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.338] GetFileType (hFile=0x2b8) returned 0x1 [0063.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0063.338] GetFileType (hFile=0x2b8) returned 0x1 [0063.338] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x7edb0 [0063.338] WriteFile (in: hFile=0x2b8, lpBuffer=0x26985e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26985e8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0063.338] CloseHandle (hObject=0x2b8) returned 1 [0063.338] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", lpFilePart=0x0) returned 0x4b [0063.338] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ZHd0cmlnMjAuZXhl", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ZHd0cmlnMjAuZXhl", lpFilePart=0x0) returned 0x4f [0063.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0063.339] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xcd9576e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x7edba)) returned 1 [0063.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0063.339] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ZHd0cmlnMjAuZXhl" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\zhd0cmlnmjauzxhl")) returned 1 [0063.339] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpFilePart=0x0) returned 0x5a [0063.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0063.339] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.340] GetFileType (hFile=0x2b8) returned 0x1 [0063.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0063.340] GetFileType (hFile=0x2b8) returned 0x1 [0063.340] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x741 [0063.340] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1847, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x737 [0063.340] ReadFile (in: hFile=0x2b8, lpBuffer=0x2699a40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2699a40*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0063.342] CloseHandle (hObject=0x2b8) returned 1 [0063.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0063.347] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpFilePart=0x0) returned 0x5a [0063.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0063.347] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), fInfoLevelId=0x0, lpFileInformation=0x27036f8 | out: lpFileInformation=0x27036f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741)) returned 1 [0063.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0063.348] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpFilePart=0x0) returned 0x5a [0063.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0063.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.348] GetFileType (hFile=0x2b8) returned 0x1 [0063.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0063.348] GetFileType (hFile=0x2b8) returned 0x1 [0063.348] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x741 [0063.348] ReadFile (in: hFile=0x2b8, lpBuffer=0x2704198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2704198*, lpNumberOfBytesRead=0x1c9aeb38*=0x741, lpOverlapped=0x0) returned 1 [0063.348] CloseHandle (hObject=0x2b8) returned 1 [0063.357] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpFilePart=0x0) returned 0x5a [0063.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0063.357] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.358] GetFileType (hFile=0x2b8) returned 0x1 [0063.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0063.358] GetFileType (hFile=0x2b8) returned 0x1 [0063.358] WriteFile (in: hFile=0x2b8, lpBuffer=0x277e3e0*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x277e3e0*, lpNumberOfBytesWritten=0x1c9aea78*=0x750, lpOverlapped=0x0) returned 1 [0063.359] CloseHandle (hObject=0x2b8) returned 1 [0063.360] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpFilePart=0x0) returned 0x5a [0063.360] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpFilePart=0x0) returned 0x5a [0063.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0063.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.360] GetFileType (hFile=0x2b8) returned 0x1 [0063.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0063.360] GetFileType (hFile=0x2b8) returned 0x1 [0063.360] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x750 [0063.360] WriteFile (in: hFile=0x2b8, lpBuffer=0x27802e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27802e8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0063.360] CloseHandle (hObject=0x2b8) returned 1 [0063.360] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpFilePart=0x0) returned 0x5a [0063.360] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\TWljcm9zb2Z0LlZDOTAuQ1JULm1hbmlmZXN0", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\TWljcm9zb2Z0LlZDOTAuQ1JULm1hbmlmZXN0", lpFilePart=0x0) returned 0x63 [0063.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0063.360] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xcd97d840, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x75a)) returned 1 [0063.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0063.361] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\TWljcm9zb2Z0LlZDOTAuQ1JULm1hbmlmZXN0" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\twljcm9zb2z0llzdotauq1julm1hbmlmzxn0")) returned 1 [0063.361] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpFilePart=0x0) returned 0x4a [0063.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0063.361] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.362] GetFileType (hFile=0x2b8) returned 0x1 [0063.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0063.362] GetFileType (hFile=0x2b8) returned 0x1 [0063.362] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xa0200 [0063.362] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=655862, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xa01f6 [0063.362] ReadFile (in: hFile=0x2b8, lpBuffer=0x2781768, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2781768*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0063.364] CloseHandle (hObject=0x2b8) returned 1 [0063.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0063.365] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpFilePart=0x0) returned 0x4a [0063.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0063.366] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), fInfoLevelId=0x0, lpFileInformation=0x27eb4c0 | out: lpFileInformation=0x27eb4c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200)) returned 1 [0063.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0063.366] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpFilePart=0x0) returned 0x4a [0063.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0063.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.366] GetFileType (hFile=0x2b8) returned 0x1 [0063.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0063.366] GetFileType (hFile=0x2b8) returned 0x1 [0063.366] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xa0200 [0063.367] ReadFile (in: hFile=0x2b8, lpBuffer=0x129e34a8, nNumberOfBytesToRead=0xa0200, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x129e34a8*, lpNumberOfBytesRead=0x1c9aeb38*=0xa0200, lpOverlapped=0x0) returned 1 [0063.379] CloseHandle (hObject=0x2b8) returned 1 [0063.423] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpFilePart=0x0) returned 0x4a [0063.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0063.423] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.449] GetFileType (hFile=0x2b8) returned 0x1 [0063.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0063.449] GetFileType (hFile=0x2b8) returned 0x1 [0063.449] WriteFile (in: hFile=0x2b8, lpBuffer=0x128e2210*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x128e2210*, lpNumberOfBytesWritten=0x1c9aebc8*=0xa0210, lpOverlapped=0x0) returned 1 [0063.460] CloseHandle (hObject=0x2b8) returned 1 [0063.461] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpFilePart=0x0) returned 0x4a [0063.461] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpFilePart=0x0) returned 0x4a [0063.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0063.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.461] GetFileType (hFile=0x2b8) returned 0x1 [0063.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0063.461] GetFileType (hFile=0x2b8) returned 0x1 [0063.461] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xa0210 [0063.461] WriteFile (in: hFile=0x2b8, lpBuffer=0x26a8710*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26a8710*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0063.461] CloseHandle (hObject=0x2b8) returned 1 [0063.462] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", lpFilePart=0x0) returned 0x4a [0063.462] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\bXN2Y3I5MC5kbGw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\bXN2Y3I5MC5kbGw=", lpFilePart=0x0) returned 0x4f [0063.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0063.462] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xcda881e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xa021a)) returned 1 [0063.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0063.462] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\bXN2Y3I5MC5kbGw=" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\bxn2y3i5mc5kbgw=")) returned 1 [0063.462] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpFilePart=0x0) returned 0x4b [0063.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0063.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.463] GetFileType (hFile=0x2b8) returned 0x1 [0063.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0063.463] GetFileType (hFile=0x2b8) returned 0x1 [0063.463] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xd79282 [0063.463] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=14127736, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xd79278 [0063.465] ReadFile (in: hFile=0x2b8, lpBuffer=0x26a9b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26a9b28*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0063.467] CloseHandle (hObject=0x2b8) returned 1 [0063.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0063.473] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpFilePart=0x0) returned 0x4b [0063.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0063.473] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x2713900 | out: lpFileInformation=0x2713900*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282)) returned 1 [0063.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0063.501] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpFilePart=0x0) returned 0x4b [0063.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0063.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.501] GetFileType (hFile=0x2b8) returned 0x1 [0063.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0063.501] GetFileType (hFile=0x2b8) returned 0x1 [0063.501] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0063.525] CloseHandle (hObject=0x2b8) returned 1 [0063.525] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpFilePart=0x0) returned 0x4b [0063.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0063.525] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.526] GetFileType (hFile=0x2b8) returned 0x1 [0063.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0063.526] GetFileType (hFile=0x2b8) returned 0x1 [0063.635] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpFilePart=0x0) returned 0x4b [0063.635] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpFilePart=0x0) returned 0x4b [0063.635] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpFilePart=0x0) returned 0x4b [0063.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0063.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.636] GetFileType (hFile=0x2b8) returned 0x1 [0063.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0063.636] GetFileType (hFile=0x2b8) returned 0x1 [0063.636] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0xd79282 [0063.636] WriteFile (in: hFile=0x2b8, lpBuffer=0x267d110*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x267d110*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0063.636] CloseHandle (hObject=0x2b8) returned 1 [0063.636] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpFilePart=0x0) returned 0x4b [0063.636] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTFIuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTFIuY2Fi", lpFilePart=0x0) returned 0x4f [0063.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0063.636] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcdc2b100, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd7928c)) returned 1 [0063.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0063.636] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTFIuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\t2zmawnltfiuy2fi")) returned 1 [0063.637] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpFilePart=0x0) returned 0x4c [0063.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0063.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.637] GetFileType (hFile=0x2b8) returned 0x1 [0063.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0063.637] GetFileType (hFile=0x2b8) returned 0x1 [0063.637] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x387e00 [0063.638] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=3702262, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x387df6 [0063.638] ReadFile (in: hFile=0x2b8, lpBuffer=0x267e530, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267e530*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0063.639] CloseHandle (hObject=0x2b8) returned 1 [0063.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11580) returned 0x0 [0063.645] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpFilePart=0x0) returned 0x4c [0063.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0063.645] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x26e81e8 | out: lpFileInformation=0x26e81e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00)) returned 1 [0063.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0063.649] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpFilePart=0x0) returned 0x4c [0063.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0063.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.650] GetFileType (hFile=0x2b8) returned 0x1 [0063.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0063.650] GetFileType (hFile=0x2b8) returned 0x1 [0063.650] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0063.675] CloseHandle (hObject=0x2b8) returned 1 [0063.675] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpFilePart=0x0) returned 0x4c [0063.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0063.676] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.676] GetFileType (hFile=0x2b8) returned 0x1 [0063.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0063.676] GetFileType (hFile=0x2b8) returned 0x1 [0063.783] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a61a48*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0063.786] CloseHandle (hObject=0x2b8) returned 1 [0063.786] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpFilePart=0x0) returned 0x4c [0063.787] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpFilePart=0x0) returned 0x4c [0063.787] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpFilePart=0x0) returned 0x4c [0063.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0063.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.787] GetFileType (hFile=0x2b8) returned 0x1 [0063.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0063.787] GetFileType (hFile=0x2b8) returned 0x1 [0063.787] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x387e00 [0063.787] WriteFile (in: hFile=0x2b8, lpBuffer=0x267d1a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x267d1a0*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0063.787] CloseHandle (hObject=0x2b8) returned 1 [0063.787] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", lpFilePart=0x0) returned 0x4c [0063.788] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJLm1zaQ==", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJLm1zaQ==", lpFilePart=0x0) returned 0x53 [0063.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0063.788] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcdda7ec0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x387e0a)) returned 1 [0063.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0063.788] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJLm1zaQ==" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\t2zmawnltvvjlm1zaq==")) returned 1 [0063.788] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0063.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0063.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.789] GetFileType (hFile=0x2b8) returned 0x1 [0063.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0063.789] GetFileType (hFile=0x2b8) returned 0x1 [0063.789] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x15b5 [0063.789] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=5547, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x15ab [0063.789] ReadFile (in: hFile=0x2b8, lpBuffer=0x267e5d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267e5d8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0063.791] CloseHandle (hObject=0x2b8) returned 1 [0063.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x115d0) returned 0x0 [0063.800] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0063.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0063.801] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2713c78 | out: lpFileInformation=0x2713c78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5)) returned 1 [0063.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0063.801] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0063.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0063.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.801] GetFileType (hFile=0x2b8) returned 0x1 [0063.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0063.801] GetFileType (hFile=0x2b8) returned 0x1 [0063.801] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x15b5 [0063.801] ReadFile (in: hFile=0x2b8, lpBuffer=0x2713f50, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2713f50*, lpNumberOfBytesRead=0x1c9aeb38*=0x15b5, lpOverlapped=0x0) returned 1 [0063.820] CloseHandle (hObject=0x2b8) returned 1 [0063.848] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0063.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0063.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.850] GetFileType (hFile=0x2b8) returned 0x1 [0063.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0063.850] GetFileType (hFile=0x2b8) returned 0x1 [0063.850] WriteFile (in: hFile=0x2b8, lpBuffer=0x2794700*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2794700*, lpNumberOfBytesWritten=0x1c9aebc8*=0x15c0, lpOverlapped=0x0) returned 1 [0063.851] CloseHandle (hObject=0x2b8) returned 1 [0063.851] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0063.851] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0063.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0063.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.851] GetFileType (hFile=0x2b8) returned 0x1 [0063.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0063.852] GetFileType (hFile=0x2b8) returned 0x1 [0063.852] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x15c0 [0063.852] WriteFile (in: hFile=0x2b8, lpBuffer=0x2796c98*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2796c98*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0063.852] CloseHandle (hObject=0x2b8) returned 1 [0063.852] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0063.852] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJLnhtbA==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJLnhtbA==", lpFilePart=0x0) returned 0x53 [0063.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0063.852] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcde40440, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x15ca)) returned 1 [0063.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0063.852] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJLnhtbA==" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\t2zmawnltvvjlnhtba==")) returned 1 [0063.853] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpFilePart=0x0) returned 0x4f [0063.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0063.853] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.853] GetFileType (hFile=0x2b8) returned 0x1 [0063.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0063.853] GetFileType (hFile=0x2b8) returned 0x1 [0063.853] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xd4200 [0063.853] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=868854, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xd41f6 [0063.853] ReadFile (in: hFile=0x2b8, lpBuffer=0x27980d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27980d8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0063.857] CloseHandle (hObject=0x2b8) returned 1 [0063.867] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpFilePart=0x0) returned 0x4f [0063.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0063.867] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x26e0928 | out: lpFileInformation=0x26e0928*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0063.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0063.867] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpFilePart=0x0) returned 0x4f [0063.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0063.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0063.867] GetFileType (hFile=0x2b8) returned 0x1 [0063.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0063.867] GetFileType (hFile=0x2b8) returned 0x1 [0063.867] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xd4200 [0063.871] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb38*=0xd4200, lpOverlapped=0x0) returned 1 [0063.879] CloseHandle (hObject=0x2b8) returned 1 [0063.995] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpFilePart=0x0) returned 0x4f [0063.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0063.995] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.002] GetFileType (hFile=0x2b8) returned 0x1 [0064.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.002] GetFileType (hFile=0x2b8) returned 0x1 [0064.002] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a86448*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12a86448*, lpNumberOfBytesWritten=0x1c9aebc8*=0xd4210, lpOverlapped=0x0) returned 1 [0064.045] CloseHandle (hObject=0x2b8) returned 1 [0064.046] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.046] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.047] GetFileType (hFile=0x2b8) returned 0x1 [0064.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.047] GetFileType (hFile=0x2b8) returned 0x1 [0064.047] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xd4210 [0064.047] WriteFile (in: hFile=0x2b8, lpBuffer=0x26a98c8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26a98c8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.047] CloseHandle (hObject=0x2b8) returned 1 [0064.047] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.047] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJU2V0Lm1zaQ==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJU2V0Lm1zaQ==", lpFilePart=0x0) returned 0x57 [0064.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.047] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xce0094c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd421a)) returned 1 [0064.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.047] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJU2V0Lm1zaQ==" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\t2zmawnltvvju2v0lm1zaq==")) returned 1 [0064.048] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0064.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.048] GetFileType (hFile=0x2b8) returned 0x1 [0064.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0064.048] GetFileType (hFile=0x2b8) returned 0x1 [0064.048] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x333 [0064.048] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=809, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x329 [0064.048] ReadFile (in: hFile=0x2b8, lpBuffer=0x26aad18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26aad18*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0064.053] CloseHandle (hObject=0x2b8) returned 1 [0064.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11440) returned 0x0 [0064.061] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.061] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x27149f0 | out: lpFileInformation=0x27149f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0064.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0064.062] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0064.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.062] GetFileType (hFile=0x2b8) returned 0x1 [0064.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0064.062] GetFileType (hFile=0x2b8) returned 0x1 [0064.062] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x333 [0064.062] ReadFile (in: hFile=0x2b8, lpBuffer=0x2715028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2715028*, lpNumberOfBytesRead=0x1c9aeb38*=0x333, lpOverlapped=0x0) returned 1 [0064.062] CloseHandle (hObject=0x2b8) returned 1 [0064.103] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.104] GetFileType (hFile=0x2b8) returned 0x1 [0064.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.104] GetFileType (hFile=0x2b8) returned 0x1 [0064.104] WriteFile (in: hFile=0x2b8, lpBuffer=0x278e3a8*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x278e3a8*, lpNumberOfBytesWritten=0x1c9aea78*=0x340, lpOverlapped=0x0) returned 1 [0064.104] CloseHandle (hObject=0x2b8) returned 1 [0064.105] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.105] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.105] GetFileType (hFile=0x2b8) returned 0x1 [0064.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.105] GetFileType (hFile=0x2b8) returned 0x1 [0064.105] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x340 [0064.105] WriteFile (in: hFile=0x2b8, lpBuffer=0x2790220*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2790220*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.105] CloseHandle (hObject=0x2b8) returned 1 [0064.105] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.105] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJU2V0LnhtbA==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJU2V0LnhtbA==", lpFilePart=0x0) returned 0x57 [0064.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.106] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xce0a1a40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x34a)) returned 1 [0064.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.106] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\T2ZmaWNlTVVJU2V0LnhtbA==" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\t2zmawnltvvju2v0lnhtba==")) returned 1 [0064.106] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpFilePart=0x0) returned 0x4b [0064.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0064.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.107] GetFileType (hFile=0x2b8) returned 0x1 [0064.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0064.107] GetFileType (hFile=0x2b8) returned 0x1 [0064.107] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2ed80 [0064.107] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=191862, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2ed76 [0064.107] ReadFile (in: hFile=0x2b8, lpBuffer=0x2791660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2791660*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0064.108] CloseHandle (hObject=0x2b8) returned 1 [0064.118] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpFilePart=0x0) returned 0x4b [0064.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.119] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), fInfoLevelId=0x0, lpFileInformation=0x26c8988 | out: lpFileInformation=0x26c8988*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80)) returned 1 [0064.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0064.119] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpFilePart=0x0) returned 0x4b [0064.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0064.119] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.119] GetFileType (hFile=0x2b8) returned 0x1 [0064.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0064.119] GetFileType (hFile=0x2b8) returned 0x1 [0064.119] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x2ed80 [0064.120] ReadFile (in: hFile=0x2b8, lpBuffer=0x12735ba0, nNumberOfBytesToRead=0x2ed80, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12735ba0*, lpNumberOfBytesRead=0x1c9aeb38*=0x2ed80, lpOverlapped=0x0) returned 1 [0064.122] CloseHandle (hObject=0x2b8) returned 1 [0064.255] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpFilePart=0x0) returned 0x4b [0064.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.257] GetFileType (hFile=0x2b8) returned 0x1 [0064.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.257] GetFileType (hFile=0x2b8) returned 0x1 [0064.257] WriteFile (in: hFile=0x2b8, lpBuffer=0x126bf4a0*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x126bf4a0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2ed90, lpOverlapped=0x0) returned 1 [0064.260] CloseHandle (hObject=0x2b8) returned 1 [0064.261] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpFilePart=0x0) returned 0x4b [0064.261] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpFilePart=0x0) returned 0x4b [0064.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.261] GetFileType (hFile=0x2b8) returned 0x1 [0064.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.261] GetFileType (hFile=0x2b8) returned 0x1 [0064.261] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2ed90 [0064.261] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bef18*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26bef18*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.262] CloseHandle (hObject=0x2b8) returned 1 [0064.262] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", lpFilePart=0x0) returned 0x4b [0064.262] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\b3NldHVwdWkuZGxs", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\b3NldHVwdWkuZGxs", lpFilePart=0x0) returned 0x4f [0064.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.262] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xce21e800, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x2ed9a)) returned 1 [0064.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.262] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\b3NldHVwdWkuZGxs" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\b3nldhvwdwkuzgxs")) returned 1 [0064.262] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpFilePart=0x0) returned 0x49 [0064.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0064.263] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.263] GetFileType (hFile=0x2b8) returned 0x1 [0064.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0064.263] GetFileType (hFile=0x2b8) returned 0x1 [0064.263] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x6a3b [0064.263] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=27185, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x6a31 [0064.263] ReadFile (in: hFile=0x2b8, lpBuffer=0x26c0328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26c0328*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0064.265] CloseHandle (hObject=0x2b8) returned 1 [0064.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11300) returned 0x0 [0064.272] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpFilePart=0x0) returned 0x49 [0064.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.272] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), fInfoLevelId=0x0, lpFileInformation=0x2729e80 | out: lpFileInformation=0x2729e80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b)) returned 1 [0064.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0064.272] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpFilePart=0x0) returned 0x49 [0064.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0064.272] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.272] GetFileType (hFile=0x2b8) returned 0x1 [0064.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0064.272] GetFileType (hFile=0x2b8) returned 0x1 [0064.272] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x6a3b [0064.272] ReadFile (in: hFile=0x2b8, lpBuffer=0x272a138, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x272a138*, lpNumberOfBytesRead=0x1c9aeb38*=0x6a3b, lpOverlapped=0x0) returned 1 [0064.273] CloseHandle (hObject=0x2b8) returned 1 [0064.317] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpFilePart=0x0) returned 0x49 [0064.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.318] GetFileType (hFile=0x2b8) returned 0x1 [0064.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.318] GetFileType (hFile=0x2b8) returned 0x1 [0064.318] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c4e68*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27c4e68*, lpNumberOfBytesWritten=0x1c9aebc8*=0x6a40, lpOverlapped=0x0) returned 1 [0064.320] CloseHandle (hObject=0x2b8) returned 1 [0064.320] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpFilePart=0x0) returned 0x49 [0064.320] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpFilePart=0x0) returned 0x49 [0064.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.320] GetFileType (hFile=0x2b8) returned 0x1 [0064.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.320] GetFileType (hFile=0x2b8) returned 0x1 [0064.320] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x6a40 [0064.321] WriteFile (in: hFile=0x2b8, lpBuffer=0x27cc840*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27cc840*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.321] CloseHandle (hObject=0x2b8) returned 1 [0064.321] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpFilePart=0x0) returned 0x49 [0064.321] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\cHNzMTByLmNobQ==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\cHNzMTByLmNobQ==", lpFilePart=0x0) returned 0x4f [0064.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.321] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xce2b6d80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x6a4a)) returned 1 [0064.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.321] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\cHNzMTByLmNobQ==" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\chnzmtbylmnobq==")) returned 1 [0064.321] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpFilePart=0x0) returned 0x48 [0064.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0064.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.322] GetFileType (hFile=0x2b8) returned 0x1 [0064.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0064.322] GetFileType (hFile=0x2b8) returned 0x1 [0064.322] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x10676 [0064.322] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=67180, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1066c [0064.322] ReadFile (in: hFile=0x2b8, lpBuffer=0x27cdc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27cdc50*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0064.324] CloseHandle (hObject=0x2b8) returned 1 [0064.325] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpFilePart=0x0) returned 0x48 [0064.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.325] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), fInfoLevelId=0x0, lpFileInformation=0x2837528 | out: lpFileInformation=0x2837528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676)) returned 1 [0064.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0064.325] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpFilePart=0x0) returned 0x48 [0064.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0064.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.326] GetFileType (hFile=0x2b8) returned 0x1 [0064.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0064.326] GetFileType (hFile=0x2b8) returned 0x1 [0064.326] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x10676 [0064.326] ReadFile (in: hFile=0x2b8, lpBuffer=0x28377e0, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28377e0*, lpNumberOfBytesRead=0x1c9aeb38*=0x10676, lpOverlapped=0x0) returned 1 [0064.327] CloseHandle (hObject=0x2b8) returned 1 [0064.379] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpFilePart=0x0) returned 0x48 [0064.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.379] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.380] GetFileType (hFile=0x2b8) returned 0x1 [0064.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.380] GetFileType (hFile=0x2b8) returned 0x1 [0064.380] WriteFile (in: hFile=0x2b8, lpBuffer=0x274bad0*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x274bad0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x10680, lpOverlapped=0x0) returned 1 [0064.382] CloseHandle (hObject=0x2b8) returned 1 [0064.382] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpFilePart=0x0) returned 0x48 [0064.382] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpFilePart=0x0) returned 0x48 [0064.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.383] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.383] GetFileType (hFile=0x2b8) returned 0x1 [0064.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.383] GetFileType (hFile=0x2b8) returned 0x1 [0064.383] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x10680 [0064.383] WriteFile (in: hFile=0x2b8, lpBuffer=0x275d0e0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x275d0e0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.383] CloseHandle (hObject=0x2b8) returned 1 [0064.383] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpFilePart=0x0) returned 0x48 [0064.383] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\c2V0dXAuY2ht", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\c2V0dXAuY2ht", lpFilePart=0x0) returned 0x4b [0064.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.383] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xce34f300, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1068a)) returned 1 [0064.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.383] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\c2V0dXAuY2ht" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\c2v0dxauy2ht")) returned 1 [0064.384] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0064.384] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.384] GetFileType (hFile=0x2b8) returned 0x1 [0064.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0064.384] GetFileType (hFile=0x2b8) returned 0x1 [0064.384] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2488 [0064.384] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=9342, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x247e [0064.384] ReadFile (in: hFile=0x2b8, lpBuffer=0x275e4e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x275e4e0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0064.402] CloseHandle (hObject=0x2b8) returned 1 [0064.403] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.403] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x27c7d18 | out: lpFileInformation=0x27c7d18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488)) returned 1 [0064.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0064.404] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0064.404] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.404] GetFileType (hFile=0x2b8) returned 0x1 [0064.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0064.404] GetFileType (hFile=0x2b8) returned 0x1 [0064.404] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x2488 [0064.404] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c7fd0, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27c7fd0*, lpNumberOfBytesRead=0x1c9aeb38*=0x2488, lpOverlapped=0x0) returned 1 [0064.405] CloseHandle (hObject=0x2b8) returned 1 [0064.415] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.415] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.416] GetFileType (hFile=0x2b8) returned 0x1 [0064.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.416] GetFileType (hFile=0x2b8) returned 0x1 [0064.416] WriteFile (in: hFile=0x2b8, lpBuffer=0x284a288*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x284a288*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2490, lpOverlapped=0x0) returned 1 [0064.417] CloseHandle (hObject=0x2b8) returned 1 [0064.418] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.418] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.418] GetFileType (hFile=0x2b8) returned 0x1 [0064.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.418] GetFileType (hFile=0x2b8) returned 0x1 [0064.418] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2490 [0064.418] WriteFile (in: hFile=0x2b8, lpBuffer=0x284d6a8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x284d6a8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.418] CloseHandle (hObject=0x2b8) returned 1 [0064.418] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.418] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0064.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.418] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xce39b5c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x249a)) returned 1 [0064.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.419] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0064.419] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpFilePart=0x0) returned 0x4a [0064.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0064.419] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.419] GetFileType (hFile=0x2b8) returned 0x1 [0064.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0064.419] GetFileType (hFile=0x2b8) returned 0x1 [0064.419] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xe00 [0064.420] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=3574, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xdf6 [0064.420] ReadFile (in: hFile=0x2b8, lpBuffer=0x284eaa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x284eaa8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0064.428] CloseHandle (hObject=0x2b8) returned 1 [0064.440] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpFilePart=0x0) returned 0x4a [0064.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.440] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), fInfoLevelId=0x0, lpFileInformation=0x26e16d8 | out: lpFileInformation=0x26e16d8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1 [0064.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0064.440] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpFilePart=0x0) returned 0x4a [0064.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0064.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.441] GetFileType (hFile=0x2b8) returned 0x1 [0064.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0064.441] GetFileType (hFile=0x2b8) returned 0x1 [0064.441] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xe00 [0064.441] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e27a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26e27a8*, lpNumberOfBytesRead=0x1c9aeb38*=0xe00, lpOverlapped=0x0) returned 1 [0064.441] CloseHandle (hObject=0x2b8) returned 1 [0064.508] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpFilePart=0x0) returned 0x4a [0064.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.509] GetFileType (hFile=0x2b8) returned 0x1 [0064.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.510] GetFileType (hFile=0x2b8) returned 0x1 [0064.510] WriteFile (in: hFile=0x2b8, lpBuffer=0x2761608*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x2761608*, lpNumberOfBytesWritten=0x1c9aea78*=0xe10, lpOverlapped=0x0) returned 1 [0064.510] CloseHandle (hObject=0x2b8) returned 1 [0064.511] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpFilePart=0x0) returned 0x4a [0064.511] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpFilePart=0x0) returned 0x4a [0064.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.511] GetFileType (hFile=0x2b8) returned 0x1 [0064.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.511] GetFileType (hFile=0x2b8) returned 0x1 [0064.511] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xe10 [0064.511] WriteFile (in: hFile=0x2b8, lpBuffer=0x2763438*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2763438*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.511] CloseHandle (hObject=0x2b8) returned 1 [0064.512] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpFilePart=0x0) returned 0x4a [0064.512] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\U2hlbGxVSS5NU1Q=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\U2hlbGxVSS5NU1Q=", lpFilePart=0x0) returned 0x4f [0064.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.512] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xce47fe00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe1a)) returned 1 [0064.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.512] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\U2hlbGxVSS5NU1Q=" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\u2hlbgxvss5nu1q=")) returned 1 [0064.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.512] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0064.512] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0064.513] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0064.513] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.513] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0064.513] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.513] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0064.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0064.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0064.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.514] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0064.514] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0064.514] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0064.514] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.514] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0064.514] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0064.514] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0064.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0064.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0064.514] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpFilePart=0x0) returned 0x50 [0064.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0064.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.515] GetFileType (hFile=0x2b8) returned 0x1 [0064.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0064.515] GetFileType (hFile=0x2b8) returned 0x1 [0064.515] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x1a588 [0064.515] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=107902, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x1a57e [0064.515] ReadFile (in: hFile=0x2b8, lpBuffer=0x2767010, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2767010*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0064.517] CloseHandle (hObject=0x2b8) returned 1 [0064.518] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpFilePart=0x0) returned 0x50 [0064.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0064.518] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), fInfoLevelId=0x0, lpFileInformation=0x27d0968 | out: lpFileInformation=0x27d0968*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588)) returned 1 [0064.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0064.518] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpFilePart=0x0) returned 0x50 [0064.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0064.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.519] GetFileType (hFile=0x2b8) returned 0x1 [0064.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0064.519] GetFileType (hFile=0x2b8) returned 0x1 [0064.519] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x1a588 [0064.519] ReadFile (in: hFile=0x2b8, lpBuffer=0x126ee268, nNumberOfBytesToRead=0x1a588, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x126ee268*, lpNumberOfBytesRead=0x1c9aea98*=0x1a588, lpOverlapped=0x0) returned 1 [0064.528] CloseHandle (hObject=0x2b8) returned 1 [0064.549] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpFilePart=0x0) returned 0x50 [0064.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0064.549] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.551] GetFileType (hFile=0x2b8) returned 0x1 [0064.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0064.551] GetFileType (hFile=0x2b8) returned 0x1 [0064.551] WriteFile (in: hFile=0x2b8, lpBuffer=0x128115b8*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x128115b8*, lpNumberOfBytesWritten=0x1c9aeb28*=0x1a590, lpOverlapped=0x0) returned 1 [0064.553] CloseHandle (hObject=0x2b8) returned 1 [0064.554] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpFilePart=0x0) returned 0x50 [0064.554] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpFilePart=0x0) returned 0x50 [0064.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.554] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.554] GetFileType (hFile=0x2b8) returned 0x1 [0064.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.554] GetFileType (hFile=0x2b8) returned 0x1 [0064.554] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x1a590 [0064.554] WriteFile (in: hFile=0x2b8, lpBuffer=0x2848568*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2848568*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0064.554] CloseHandle (hObject=0x2b8) returned 1 [0064.554] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", lpFilePart=0x0) returned 0x50 [0064.554] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\ZHdpbnRsMjAuZGxs", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\ZHdpbnRsMjAuZGxs", lpFilePart=0x0) returned 0x54 [0064.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0064.554] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xce4f2220, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1a59a)) returned 1 [0064.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0064.555] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\ZHdpbnRsMjAuZGxs" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\zhdpbnrsmjauzgxs")) returned 1 [0064.555] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\README_3728769.txt", lpFilePart=0x0) returned 0x56 [0064.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0064.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0064.556] GetFileType (hFile=0x2b8) returned 0x1 [0064.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0064.556] GetFileType (hFile=0x2b8) returned 0x1 [0064.556] WriteFile (in: hFile=0x2b8, lpBuffer=0x284c8f0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x284c8f0*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0064.557] CloseHandle (hObject=0x2b8) returned 1 [0064.558] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0064.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0064.558] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0064.558] GetFileType (hFile=0x2b8) returned 0x1 [0064.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0064.558] GetFileType (hFile=0x2b8) returned 0x1 [0064.558] WriteFile (in: hFile=0x2b8, lpBuffer=0x28509f8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x28509f8*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0064.559] CloseHandle (hObject=0x2b8) returned 1 [0064.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0064.559] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0064.559] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0064.560] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0064.577] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.589] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0064.591] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0064.591] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0064.591] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0064.591] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.591] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0064.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0064.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0064.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0064.593] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0064.593] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0064.593] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0064.594] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.594] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0064.594] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0064.594] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0064.595] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0064.595] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0064.595] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0064.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0064.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0064.596] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0064.596] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.597] GetFileType (hFile=0x2b8) returned 0x1 [0064.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0064.597] GetFileType (hFile=0x2b8) returned 0x1 [0064.597] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xd4200 [0064.597] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=868854, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xd41f6 [0064.597] ReadFile (in: hFile=0x2b8, lpBuffer=0x2854fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2854fb8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0064.599] CloseHandle (hObject=0x2b8) returned 1 [0064.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11350) returned 0x0 [0064.606] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.606] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x28be898 | out: lpFileInformation=0x28be898*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200)) returned 1 [0064.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0064.606] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0064.606] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.606] GetFileType (hFile=0x2b8) returned 0x1 [0064.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0064.606] GetFileType (hFile=0x2b8) returned 0x1 [0064.606] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xd4200 [0064.608] ReadFile (in: hFile=0x2b8, lpBuffer=0x1282bb80, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x1282bb80*, lpNumberOfBytesRead=0x1c9aeb38*=0xd4200, lpOverlapped=0x0) returned 1 [0064.645] CloseHandle (hObject=0x2b8) returned 1 [0064.804] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.805] GetFileType (hFile=0x2b8) returned 0x1 [0064.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.805] GetFileType (hFile=0x2b8) returned 0x1 [0064.805] WriteFile (in: hFile=0x2b8, lpBuffer=0x12aa8228*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12aa8228*, lpNumberOfBytesWritten=0x1c9aebc8*=0xd4210, lpOverlapped=0x0) returned 1 [0064.819] CloseHandle (hObject=0x2b8) returned 1 [0064.820] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.821] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.821] GetFileType (hFile=0x2b8) returned 0x1 [0064.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.821] GetFileType (hFile=0x2b8) returned 0x1 [0064.821] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xd4210 [0064.821] WriteFile (in: hFile=0x2b8, lpBuffer=0x2709e80*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2709e80*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.821] CloseHandle (hObject=0x2b8) returned 1 [0064.821] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", lpFilePart=0x0) returned 0x4f [0064.821] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\QWNjZXNzTVVJU2V0Lm1zaQ==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\QWNjZXNzTVVJU2V0Lm1zaQ==", lpFilePart=0x0) returned 0x57 [0064.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.821] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xce779980, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd421a)) returned 1 [0064.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.822] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\QWNjZXNzTVVJU2V0Lm1zaQ==" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\qwnjzxnztvvju2v0lm1zaq==")) returned 1 [0064.822] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0064.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.822] GetFileType (hFile=0x2b8) returned 0x1 [0064.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0064.822] GetFileType (hFile=0x2b8) returned 0x1 [0064.822] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x333 [0064.822] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=809, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x329 [0064.823] ReadFile (in: hFile=0x2b8, lpBuffer=0x270b2d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x270b2d0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0064.829] CloseHandle (hObject=0x2b8) returned 1 [0064.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11350) returned 0x0 [0064.836] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.836] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x2775178 | out: lpFileInformation=0x2775178*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0064.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0064.836] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0064.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.836] GetFileType (hFile=0x2b8) returned 0x1 [0064.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0064.836] GetFileType (hFile=0x2b8) returned 0x1 [0064.836] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x333 [0064.836] ReadFile (in: hFile=0x2b8, lpBuffer=0x27757b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27757b0*, lpNumberOfBytesRead=0x1c9aeb38*=0x333, lpOverlapped=0x0) returned 1 [0064.836] CloseHandle (hObject=0x2b8) returned 1 [0064.884] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.885] GetFileType (hFile=0x2b8) returned 0x1 [0064.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.885] GetFileType (hFile=0x2b8) returned 0x1 [0064.885] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f0e28*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x27f0e28*, lpNumberOfBytesWritten=0x1c9aea78*=0x340, lpOverlapped=0x0) returned 1 [0064.886] CloseHandle (hObject=0x2b8) returned 1 [0064.886] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.886] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.886] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.886] GetFileType (hFile=0x2b8) returned 0x1 [0064.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.887] GetFileType (hFile=0x2b8) returned 0x1 [0064.887] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x340 [0064.887] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f2ca0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27f2ca0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.887] CloseHandle (hObject=0x2b8) returned 1 [0064.887] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0064.887] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\QWNjZXNzTVVJU2V0LnhtbA==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\QWNjZXNzTVVJU2V0LnhtbA==", lpFilePart=0x0) returned 0x57 [0064.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.887] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xce811f00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x34a)) returned 1 [0064.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.887] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\QWNjZXNzTVVJU2V0LnhtbA==" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\qwnjzxnztvvju2v0lnhtba==")) returned 1 [0064.888] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0064.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.888] GetFileType (hFile=0x2b8) returned 0x1 [0064.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0064.888] GetFileType (hFile=0x2b8) returned 0x1 [0064.888] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xa40 [0064.888] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2614, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xa36 [0064.888] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f40d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27f40d8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0064.890] CloseHandle (hObject=0x2b8) returned 1 [0064.891] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.891] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x285d9a0 | out: lpFileInformation=0x285d9a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0064.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0064.891] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0064.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.892] GetFileType (hFile=0x2b8) returned 0x1 [0064.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0064.892] GetFileType (hFile=0x2b8) returned 0x1 [0064.892] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xa40 [0064.892] ReadFile (in: hFile=0x2b8, lpBuffer=0x285e6b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x285e6b0*, lpNumberOfBytesRead=0x1c9aeb38*=0xa40, lpOverlapped=0x0) returned 1 [0064.892] CloseHandle (hObject=0x2b8) returned 1 [0064.961] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0064.961] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.962] GetFileType (hFile=0x2b8) returned 0x1 [0064.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0064.962] GetFileType (hFile=0x2b8) returned 0x1 [0064.962] WriteFile (in: hFile=0x2b8, lpBuffer=0x26cfe38*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x26cfe38*, lpNumberOfBytesWritten=0x1c9aea78*=0xa50, lpOverlapped=0x0) returned 1 [0064.963] CloseHandle (hObject=0x2b8) returned 1 [0064.964] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.964] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0064.964] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.964] GetFileType (hFile=0x2b8) returned 0x1 [0064.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0064.964] GetFileType (hFile=0x2b8) returned 0x1 [0064.964] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xa50 [0064.964] WriteFile (in: hFile=0x2b8, lpBuffer=0x26d1c60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26d1c60*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0064.964] CloseHandle (hObject=0x2b8) returned 1 [0064.964] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0064.964] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0064.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0064.964] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xce8d05e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xa5a)) returned 1 [0064.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0064.965] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0064.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.965] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0064.965] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0064.965] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0064.969] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.969] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0064.969] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0064.969] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0064.969] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0064.969] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.969] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0064.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0064.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0064.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0064.970] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0064.970] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0064.970] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0064.971] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.971] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0064.971] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0064.972] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0064.972] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0064.972] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0064.972] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0064.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0064.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0064.973] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpFilePart=0x0) returned 0x59 [0064.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0064.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.981] GetFileType (hFile=0x2b8) returned 0x1 [0064.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0064.984] GetFileType (hFile=0x2b8) returned 0x1 [0064.986] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x266a00 [0064.987] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2517494, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x2669f6 [0064.987] ReadFile (in: hFile=0x2b8, lpBuffer=0x26d67d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x26d67d0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0064.989] CloseHandle (hObject=0x2b8) returned 1 [0064.991] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpFilePart=0x0) returned 0x59 [0064.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0064.991] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x2740250 | out: lpFileInformation=0x2740250*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00)) returned 1 [0064.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0064.993] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpFilePart=0x0) returned 0x59 [0064.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0064.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0064.994] GetFileType (hFile=0x2b8) returned 0x1 [0064.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0064.994] GetFileType (hFile=0x2b8) returned 0x1 [0064.994] ReadFile (in: hFile=0x2b8, lpBuffer=0x12b7c470, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x12b7c470*, lpNumberOfBytesRead=0x1c9aea78*=0x100000, lpOverlapped=0x0) returned 1 [0065.021] CloseHandle (hObject=0x2b8) returned 1 [0065.021] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpFilePart=0x0) returned 0x59 [0065.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0065.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.021] GetFileType (hFile=0x2b8) returned 0x1 [0065.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0065.021] GetFileType (hFile=0x2b8) returned 0x1 [0065.146] WriteFile (in: hFile=0x2b8, lpBuffer=0x128619d8*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aead8, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesWritten=0x1c9aead8*=0x100000, lpOverlapped=0x0) returned 1 [0065.149] CloseHandle (hObject=0x2b8) returned 1 [0065.149] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpFilePart=0x0) returned 0x59 [0065.150] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae560, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpFilePart=0x0) returned 0x59 [0065.150] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpFilePart=0x0) returned 0x59 [0065.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0065.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.150] GetFileType (hFile=0x2b8) returned 0x1 [0065.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0065.150] GetFileType (hFile=0x2b8) returned 0x1 [0065.150] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9c8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9c8*=0) returned 0x266a00 [0065.150] WriteFile (in: hFile=0x2b8, lpBuffer=0x26a6a60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x26a6a60*, lpNumberOfBytesWritten=0x1c9aea88*=0xa, lpOverlapped=0x0) returned 1 [0065.150] CloseHandle (hObject=0x2b8) returned 1 [0065.150] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", lpFilePart=0x0) returned 0x59 [0065.150] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\QWNjZXNzTVVJLm1zaQ==", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\QWNjZXNzTVVJLm1zaQ==", lpFilePart=0x0) returned 0x60 [0065.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0065.151] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeaf0 | out: lpFileInformation=0x1c9aeaf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcea99660, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x266a0a)) returned 1 [0065.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0065.151] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\QWNjZXNzTVVJLm1zaQ==" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\qwnjzxnztvvjlm1zaq==")) returned 1 [0065.151] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0065.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0065.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.168] GetFileType (hFile=0x2b8) returned 0x1 [0065.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0065.168] GetFileType (hFile=0x2b8) returned 0x1 [0065.168] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x545 [0065.168] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1339, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x53b [0065.168] ReadFile (in: hFile=0x2b8, lpBuffer=0x26a7f08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x26a7f08*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0065.169] CloseHandle (hObject=0x2b8) returned 1 [0065.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x114e0) returned 0x0 [0065.177] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0065.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0065.177] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x272ea40 | out: lpFileInformation=0x272ea40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545)) returned 1 [0065.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0065.177] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0065.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0065.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.178] GetFileType (hFile=0x2b8) returned 0x1 [0065.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0065.178] GetFileType (hFile=0x2b8) returned 0x1 [0065.178] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x545 [0065.178] ReadFile (in: hFile=0x2b8, lpBuffer=0x272f2a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x272f2a8*, lpNumberOfBytesRead=0x1c9aea98*=0x545, lpOverlapped=0x0) returned 1 [0065.178] CloseHandle (hObject=0x2b8) returned 1 [0065.242] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0065.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0065.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.243] GetFileType (hFile=0x2b8) returned 0x1 [0065.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0065.243] GetFileType (hFile=0x2b8) returned 0x1 [0065.243] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bdb60*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x26bdb60*, lpNumberOfBytesWritten=0x1c9ae9d8*=0x550, lpOverlapped=0x0) returned 1 [0065.244] CloseHandle (hObject=0x2b8) returned 1 [0065.245] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0065.245] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0065.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0065.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.245] GetFileType (hFile=0x2b8) returned 0x1 [0065.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0065.245] GetFileType (hFile=0x2b8) returned 0x1 [0065.245] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x550 [0065.245] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bfa20*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x26bfa20*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0065.246] CloseHandle (hObject=0x2b8) returned 1 [0065.246] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0065.246] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\QWNjZXNzTVVJLnhtbA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\QWNjZXNzTVVJLnhtbA==", lpFilePart=0x0) returned 0x60 [0065.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0065.246] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xceb7dea0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x55a)) returned 1 [0065.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0065.246] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\QWNjZXNzTVVJLnhtbA==" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\qwnjzxnztvvjlnhtba==")) returned 1 [0065.246] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpFilePart=0x0) returned 0x55 [0065.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0065.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.317] GetFileType (hFile=0x2b8) returned 0x1 [0065.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0065.317] GetFileType (hFile=0x2b8) returned 0x1 [0065.317] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x1ab7e94 [0065.317] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=28016266, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x1ab7e8a [0065.317] ReadFile (in: hFile=0x2b8, lpBuffer=0x26bb940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x26bb940*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0065.319] CloseHandle (hObject=0x2b8) returned 1 [0065.320] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x115d0) returned 0x0 [0065.325] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpFilePart=0x0) returned 0x55 [0065.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0065.326] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), fInfoLevelId=0x0, lpFileInformation=0x2728d98 | out: lpFileInformation=0x2728d98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94)) returned 1 [0065.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0065.333] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpFilePart=0x0) returned 0x55 [0065.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0065.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.333] GetFileType (hFile=0x2b8) returned 0x1 [0065.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0065.333] GetFileType (hFile=0x2b8) returned 0x1 [0065.333] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aea78*=0x100000, lpOverlapped=0x0) returned 1 [0065.368] CloseHandle (hObject=0x2b8) returned 1 [0065.368] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpFilePart=0x0) returned 0x55 [0065.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0065.368] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.368] GetFileType (hFile=0x2b8) returned 0x1 [0065.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0065.368] GetFileType (hFile=0x2b8) returned 0x1 [0065.493] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aead8, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aead8*=0x100000, lpOverlapped=0x0) returned 1 [0065.496] CloseHandle (hObject=0x2b8) returned 1 [0065.496] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpFilePart=0x0) returned 0x55 [0065.497] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae560, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpFilePart=0x0) returned 0x55 [0065.497] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpFilePart=0x0) returned 0x55 [0065.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9e0) returned 1 [0065.497] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.497] GetFileType (hFile=0x2b8) returned 0x1 [0065.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0065.497] GetFileType (hFile=0x2b8) returned 0x1 [0065.497] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9c8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9c8*=0) returned 0x1ab7e94 [0065.497] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a31e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x27a31e8*, lpNumberOfBytesWritten=0x1c9aea88*=0xa, lpOverlapped=0x0) returned 1 [0065.497] CloseHandle (hObject=0x2b8) returned 1 [0065.497] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpFilePart=0x0) returned 0x55 [0065.497] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\QWNjTFIuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\QWNjTFIuY2Fi", lpFilePart=0x0) returned 0x58 [0065.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0065.498] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeaf0 | out: lpFileInformation=0x1c9aeaf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xceddf4a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e9e)) returned 1 [0065.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0065.498] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\QWNjTFIuY2Fi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\qwnjtfiuy2fi")) returned 1 [0065.498] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0065.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0065.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.504] GetFileType (hFile=0x2b8) returned 0x1 [0065.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0065.504] GetFileType (hFile=0x2b8) returned 0x1 [0065.504] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x91975 [0065.504] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=596331, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x9196b [0065.505] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a4668, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27a4668*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0065.506] CloseHandle (hObject=0x2b8) returned 1 [0065.512] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0065.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0065.512] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x280e4d8 | out: lpFileInformation=0x280e4d8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975)) returned 1 [0065.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0065.513] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0065.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0065.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.513] GetFileType (hFile=0x2b8) returned 0x1 [0065.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0065.513] GetFileType (hFile=0x2b8) returned 0x1 [0065.513] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x91975 [0065.549] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aea98*=0x91975, lpOverlapped=0x0) returned 1 [0065.561] CloseHandle (hObject=0x2b8) returned 1 [0065.663] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0065.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0065.663] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.669] GetFileType (hFile=0x2b8) returned 0x1 [0065.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0065.669] GetFileType (hFile=0x2b8) returned 0x1 [0065.669] WriteFile (in: hFile=0x2b8, lpBuffer=0x12939980*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x12939980*, lpNumberOfBytesWritten=0x1c9aeb28*=0x91980, lpOverlapped=0x0) returned 1 [0065.679] CloseHandle (hObject=0x2b8) returned 1 [0065.679] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0065.679] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0065.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0065.679] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.679] GetFileType (hFile=0x2b8) returned 0x1 [0065.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0065.679] GetFileType (hFile=0x2b8) returned 0x1 [0065.679] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x91980 [0065.680] WriteFile (in: hFile=0x2b8, lpBuffer=0x271f028*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x271f028*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0065.680] CloseHandle (hObject=0x2b8) returned 1 [0065.680] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0065.680] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\YnJhbmRpbmcueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\YnJhbmRpbmcueG1s", lpFilePart=0x0) returned 0x5c [0065.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0065.680] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xcefa8520, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x9198a)) returned 1 [0065.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0065.680] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\YnJhbmRpbmcueG1s" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\ynjhbmrpbmcueg1s")) returned 1 [0065.681] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\README_3728769.txt", lpFilePart=0x0) returned 0x5e [0065.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0065.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0065.681] GetFileType (hFile=0x2b8) returned 0x1 [0065.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0065.681] GetFileType (hFile=0x2b8) returned 0x1 [0065.681] WriteFile (in: hFile=0x2b8, lpBuffer=0x2723400*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x2723400*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0065.682] CloseHandle (hObject=0x2b8) returned 1 [0065.683] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0065.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0065.683] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0065.683] GetFileType (hFile=0x2b8) returned 0x1 [0065.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0065.683] GetFileType (hFile=0x2b8) returned 0x1 [0065.683] WriteFile (in: hFile=0x2b8, lpBuffer=0x2727508*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2727508*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0065.684] CloseHandle (hObject=0x2b8) returned 1 [0065.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0065.684] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0065.684] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0065.684] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0065.688] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.688] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0065.688] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0065.688] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0065.688] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0065.688] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0065.688] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0065.688] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0065.689] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0065.689] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0065.689] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0065.689] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0065.689] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0065.690] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0065.690] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0065.690] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0065.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0065.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0065.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0065.691] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0065.692] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0065.692] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0065.692] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.693] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0065.693] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0065.693] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0065.693] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0065.693] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0065.693] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0065.693] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0065.694] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0065.694] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0065.694] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0065.694] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0065.694] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0065.694] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0065.695] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0065.695] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0065.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0065.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0065.695] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0065.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0065.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.698] GetFileType (hFile=0x2b8) returned 0x1 [0065.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0065.698] GetFileType (hFile=0x2b8) returned 0x1 [0065.698] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1e6600 [0065.698] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1992182, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1e65f6 [0065.698] ReadFile (in: hFile=0x2b8, lpBuffer=0x272df20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x272df20*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0065.700] CloseHandle (hObject=0x2b8) returned 1 [0065.701] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0065.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0065.701] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x2797d00 | out: lpFileInformation=0x2797d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600)) returned 1 [0065.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0065.726] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0065.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0065.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.726] GetFileType (hFile=0x2b8) returned 0x1 [0065.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0065.726] GetFileType (hFile=0x2b8) returned 0x1 [0065.726] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0065.767] CloseHandle (hObject=0x2b8) returned 1 [0065.767] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0065.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0065.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.768] GetFileType (hFile=0x2b8) returned 0x1 [0065.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0065.768] GetFileType (hFile=0x2b8) returned 0x1 [0065.852] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0065.855] CloseHandle (hObject=0x2b8) returned 1 [0065.856] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0065.856] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0065.856] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0065.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0065.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.857] GetFileType (hFile=0x2b8) returned 0x1 [0065.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0065.857] GetFileType (hFile=0x2b8) returned 0x1 [0065.857] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x1e6600 [0065.857] WriteFile (in: hFile=0x2b8, lpBuffer=0x267ce50*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x267ce50*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0065.857] CloseHandle (hObject=0x2b8) returned 1 [0065.857] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0065.857] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy5tc2k=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy5tc2k=", lpFilePart=0x0) returned 0x53 [0065.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0065.857] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xcf14b440, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1e660a)) returned 1 [0065.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0065.857] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy5tc2k=" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\t2zmawnlmzjxvy5tc2k=")) returned 1 [0065.860] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0065.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0065.860] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.861] GetFileType (hFile=0x2b8) returned 0x1 [0065.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0065.861] GetFileType (hFile=0x2b8) returned 0x1 [0065.861] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x10b2 [0065.861] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=4264, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x10a8 [0065.861] ReadFile (in: hFile=0x2b8, lpBuffer=0x267e288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267e288*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0065.863] CloseHandle (hObject=0x2b8) returned 1 [0065.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x115d0) returned 0x0 [0065.869] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0065.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0065.869] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e8068 | out: lpFileInformation=0x26e8068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0065.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0065.869] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0065.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0065.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.870] GetFileType (hFile=0x2b8) returned 0x1 [0065.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0065.870] GetFileType (hFile=0x2b8) returned 0x1 [0065.870] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x10b2 [0065.870] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e8340, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26e8340*, lpNumberOfBytesRead=0x1c9aeb38*=0x10b2, lpOverlapped=0x0) returned 1 [0065.870] CloseHandle (hObject=0x2b8) returned 1 [0065.900] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0065.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0065.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.901] GetFileType (hFile=0x2b8) returned 0x1 [0065.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0065.901] GetFileType (hFile=0x2b8) returned 0x1 [0065.901] WriteFile (in: hFile=0x2b8, lpBuffer=0x27642f0*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27642f0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x10c0, lpOverlapped=0x0) returned 1 [0065.902] CloseHandle (hObject=0x2b8) returned 1 [0065.902] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0065.902] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0065.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0065.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.903] GetFileType (hFile=0x2b8) returned 0x1 [0065.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0065.903] GetFileType (hFile=0x2b8) returned 0x1 [0065.903] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x10c0 [0065.903] WriteFile (in: hFile=0x2b8, lpBuffer=0x2766388*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2766388*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0065.903] CloseHandle (hObject=0x2b8) returned 1 [0065.903] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0065.903] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy54bWw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy54bWw=", lpFilePart=0x0) returned 0x53 [0065.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0065.903] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xcf1bd860, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x10ca)) returned 1 [0065.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0065.903] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy54bWw=" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\t2zmawnlmzjxvy54bww=")) returned 1 [0065.904] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0065.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0065.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.905] GetFileType (hFile=0x2b8) returned 0x1 [0065.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0065.905] GetFileType (hFile=0x2b8) returned 0x1 [0065.905] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2a968 [0065.905] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=174430, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2a95e [0065.905] ReadFile (in: hFile=0x2b8, lpBuffer=0x27677a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27677a0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0065.908] CloseHandle (hObject=0x2b8) returned 1 [0065.910] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0065.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0065.910] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), fInfoLevelId=0x0, lpFileInformation=0x27d1620 | out: lpFileInformation=0x27d1620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968)) returned 1 [0065.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0065.910] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0065.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0065.910] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.910] GetFileType (hFile=0x2b8) returned 0x1 [0065.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0065.910] GetFileType (hFile=0x2b8) returned 0x1 [0065.910] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x2a968 [0065.911] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961a10, nNumberOfBytesToRead=0x2a968, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesRead=0x1c9aeb38*=0x2a968, lpOverlapped=0x0) returned 1 [0065.930] CloseHandle (hObject=0x2b8) returned 1 [0065.952] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0065.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0065.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.954] GetFileType (hFile=0x2b8) returned 0x1 [0065.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0065.954] GetFileType (hFile=0x2b8) returned 0x1 [0065.954] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a369d8*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12a369d8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2a970, lpOverlapped=0x0) returned 1 [0065.957] CloseHandle (hObject=0x2b8) returned 1 [0065.957] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0065.957] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0065.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0065.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.958] GetFileType (hFile=0x2b8) returned 0x1 [0065.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0065.958] GetFileType (hFile=0x2b8) returned 0x1 [0065.958] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2a970 [0065.958] WriteFile (in: hFile=0x2b8, lpBuffer=0x284b9d0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x284b9d0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0065.958] CloseHandle (hObject=0x2b8) returned 1 [0065.958] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0065.958] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\b3NlLmV4ZQ==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\b3NlLmV4ZQ==", lpFilePart=0x0) returned 0x4b [0065.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0065.958] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0xcf255de0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x2a97a)) returned 1 [0065.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0065.958] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\b3NlLmV4ZQ==" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\b3nllmv4zq==")) returned 1 [0065.967] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0065.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0065.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.972] GetFileType (hFile=0x2b8) returned 0x1 [0065.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0065.972] GetFileType (hFile=0x2b8) returned 0x1 [0065.972] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x709768 [0065.972] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=7378782, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x70975e [0065.972] ReadFile (in: hFile=0x2b8, lpBuffer=0x284cdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x284cdc8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0065.975] CloseHandle (hObject=0x2b8) returned 1 [0065.990] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0065.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0065.990] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), fInfoLevelId=0x0, lpFileInformation=0x26f5128 | out: lpFileInformation=0x26f5128*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768)) returned 1 [0065.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0065.992] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0065.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0065.992] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0065.992] GetFileType (hFile=0x2b8) returned 0x1 [0065.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0065.992] GetFileType (hFile=0x2b8) returned 0x1 [0065.992] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61380, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12a61380*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0066.025] CloseHandle (hObject=0x2b8) returned 1 [0066.025] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0066.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.025] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.026] GetFileType (hFile=0x2b8) returned 0x1 [0066.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.026] GetFileType (hFile=0x2b8) returned 0x1 [0066.179] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0066.183] CloseHandle (hObject=0x2b8) returned 1 [0066.183] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0066.184] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0066.184] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0066.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.184] GetFileType (hFile=0x2b8) returned 0x1 [0066.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.184] GetFileType (hFile=0x2b8) returned 0x1 [0066.184] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x709768 [0066.185] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bb418*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26bb418*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0066.185] CloseHandle (hObject=0x2b8) returned 1 [0066.185] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0066.185] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\b3NldHVwLmRsbA==", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\b3NldHVwLmRsbA==", lpFilePart=0x0) returned 0x4f [0066.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0066.185] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0xcf46b120, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x709772)) returned 1 [0066.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0066.185] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\b3NldHVwLmRsbA==" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\b3nldhvwlmrsba==")) returned 1 [0066.186] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0066.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0066.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.186] GetFileType (hFile=0x2b8) returned 0x1 [0066.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0066.187] GetFileType (hFile=0x2b8) returned 0x1 [0066.187] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x228df5c [0066.187] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=36233042, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x228df52 [0066.187] ReadFile (in: hFile=0x2b8, lpBuffer=0x26bc830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26bc830*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0066.189] CloseHandle (hObject=0x2b8) returned 1 [0066.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x115d0) returned 0x0 [0066.198] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0066.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0066.198] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x2726a60 | out: lpFileInformation=0x2726a60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c)) returned 1 [0066.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0066.204] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0066.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.205] GetFileType (hFile=0x2b8) returned 0x1 [0066.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.205] GetFileType (hFile=0x2b8) returned 0x1 [0066.205] ReadFile (in: hFile=0x2b8, lpBuffer=0x128619d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0066.221] CloseHandle (hObject=0x2b8) returned 1 [0066.221] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0066.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.222] GetFileType (hFile=0x2b8) returned 0x1 [0066.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.222] GetFileType (hFile=0x2b8) returned 0x1 [0066.327] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0066.347] CloseHandle (hObject=0x2b8) returned 1 [0066.347] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0066.348] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0066.348] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0066.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.348] GetFileType (hFile=0x2b8) returned 0x1 [0066.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.348] GetFileType (hFile=0x2b8) returned 0x1 [0066.348] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x228df5c [0066.349] WriteFile (in: hFile=0x2b8, lpBuffer=0x26db938*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26db938*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0066.349] CloseHandle (hObject=0x2b8) returned 1 [0066.349] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0066.349] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\T1dPVzMyV1cuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\T1dPVzMyV1cuY2Fi", lpFilePart=0x0) returned 0x4f [0066.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0066.349] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xcf60e040, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x228df66)) returned 1 [0066.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0066.349] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\T1dPVzMyV1cuY2Fi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\t1dpvzmyv1cuy2fi")) returned 1 [0066.350] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0066.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0066.350] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.351] GetFileType (hFile=0x2b8) returned 0x1 [0066.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0066.351] GetFileType (hFile=0x2b8) returned 0x1 [0066.351] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x165510 [0066.351] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1463558, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x165506 [0066.351] ReadFile (in: hFile=0x2b8, lpBuffer=0x26ebc30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26ebc30*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0066.353] CloseHandle (hObject=0x2b8) returned 1 [0066.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x115d0) returned 0x0 [0066.365] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0066.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0066.365] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), fInfoLevelId=0x0, lpFileInformation=0x26d86a0 | out: lpFileInformation=0x26d86a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510)) returned 1 [0066.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0066.402] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0066.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.403] GetFileType (hFile=0x2b8) returned 0x1 [0066.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.403] GetFileType (hFile=0x2b8) returned 0x1 [0066.403] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0066.433] CloseHandle (hObject=0x2b8) returned 1 [0066.433] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0066.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.433] GetFileType (hFile=0x2b8) returned 0x1 [0066.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.433] GetFileType (hFile=0x2b8) returned 0x1 [0066.594] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0066.597] CloseHandle (hObject=0x2b8) returned 1 [0066.598] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0066.598] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0066.598] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0066.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.598] GetFileType (hFile=0x2b8) returned 0x1 [0066.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.599] GetFileType (hFile=0x2b8) returned 0x1 [0066.599] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x165510 [0066.599] WriteFile (in: hFile=0x2b8, lpBuffer=0x26914d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26914d8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0066.599] CloseHandle (hObject=0x2b8) returned 1 [0066.599] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0066.599] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UGlkR2VuWC5kbGw=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UGlkR2VuWC5kbGw=", lpFilePart=0x0) returned 0x4f [0066.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0066.599] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0xcf86f640, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x16551a)) returned 1 [0066.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0066.599] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UGlkR2VuWC5kbGw=" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\uglkr2vuwc5kbgw=")) returned 1 [0066.600] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0066.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0066.600] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.600] GetFileType (hFile=0x2b8) returned 0x1 [0066.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0066.600] GetFileType (hFile=0x2b8) returned 0x1 [0066.600] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xaec3a [0066.600] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=715824, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xaec30 [0066.600] ReadFile (in: hFile=0x2b8, lpBuffer=0x2692920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2692920*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0066.602] CloseHandle (hObject=0x2b8) returned 1 [0066.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11788) returned 0x0 [0066.609] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0066.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0066.609] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x26fd4d0 | out: lpFileInformation=0x26fd4d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a)) returned 1 [0066.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0066.609] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0066.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0066.609] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.609] GetFileType (hFile=0x2b8) returned 0x1 [0066.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0066.609] GetFileType (hFile=0x2b8) returned 0x1 [0066.609] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xaec3a [0066.615] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961a10, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesRead=0x1c9aeb38*=0xaec3a, lpOverlapped=0x0) returned 1 [0066.628] CloseHandle (hObject=0x2b8) returned 1 [0066.800] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0066.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0066.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.801] GetFileType (hFile=0x2b8) returned 0x1 [0066.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0066.801] GetFileType (hFile=0x2b8) returned 0x1 [0066.801] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a10688*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12a10688*, lpNumberOfBytesWritten=0x1c9aebc8*=0xaec40, lpOverlapped=0x0) returned 1 [0066.812] CloseHandle (hObject=0x2b8) returned 1 [0066.813] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0066.813] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0066.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0066.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.813] GetFileType (hFile=0x2b8) returned 0x1 [0066.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0066.813] GetFileType (hFile=0x2b8) returned 0x1 [0066.813] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xaec40 [0066.814] WriteFile (in: hFile=0x2b8, lpBuffer=0x2691950*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2691950*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0066.814] CloseHandle (hObject=0x2b8) returned 1 [0066.814] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0066.814] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\cGtleWNvbmZpZy1vZmZpY2UueHJtLW1z", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\cGtleWNvbmZpZy1vZmZpY2UueHJtLW1z", lpFilePart=0x0) returned 0x5f [0066.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0066.814] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0xcfa84980, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xaec4a)) returned 1 [0066.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0066.814] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\cGtleWNvbmZpZy1vZmZpY2UueHJtLW1z" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\cgtlewnvbmzpzy1vzmzpy2uuehjtlw1z")) returned 1 [0066.815] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpFilePart=0x0) returned 0x4d [0066.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0066.815] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.837] GetFileType (hFile=0x2b8) returned 0x1 [0066.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0066.837] GetFileType (hFile=0x2b8) returned 0x1 [0066.837] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1a41c00 [0066.837] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=27532278, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1a41bf6 [0066.837] ReadFile (in: hFile=0x2b8, lpBuffer=0x26b1948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26b1948*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0066.839] CloseHandle (hObject=0x2b8) returned 1 [0066.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11878) returned 0x0 [0066.849] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpFilePart=0x0) returned 0x4d [0066.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0066.849] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), fInfoLevelId=0x0, lpFileInformation=0x272b3d0 | out: lpFileInformation=0x272b3d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00)) returned 1 [0066.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0066.853] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpFilePart=0x0) returned 0x4d [0066.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.854] GetFileType (hFile=0x2b8) returned 0x1 [0066.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.854] GetFileType (hFile=0x2b8) returned 0x1 [0066.854] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0066.870] CloseHandle (hObject=0x2b8) returned 1 [0066.870] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpFilePart=0x0) returned 0x4d [0066.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.871] GetFileType (hFile=0x2b8) returned 0x1 [0066.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.871] GetFileType (hFile=0x2b8) returned 0x1 [0066.967] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0066.971] CloseHandle (hObject=0x2b8) returned 1 [0066.971] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpFilePart=0x0) returned 0x4d [0066.972] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpFilePart=0x0) returned 0x4d [0066.972] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpFilePart=0x0) returned 0x4d [0066.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0066.972] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.972] GetFileType (hFile=0x2b8) returned 0x1 [0066.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0066.972] GetFileType (hFile=0x2b8) returned 0x1 [0066.972] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x1a41c00 [0066.972] WriteFile (in: hFile=0x2b8, lpBuffer=0x2691588*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2691588*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0066.972] CloseHandle (hObject=0x2b8) returned 1 [0066.972] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", lpFilePart=0x0) returned 0x4d [0066.972] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUGx1c3JXVy5tc2k=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUGx1c3JXVy5tc2k=", lpFilePart=0x0) returned 0x53 [0066.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0066.973] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcfc01740, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c0a)) returned 1 [0066.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0066.973] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUGx1c3JXVy5tc2k=" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\uhjvugx1c3jxvy5tc2k=")) returned 1 [0066.974] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0066.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0066.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.974] GetFileType (hFile=0x2b8) returned 0x1 [0066.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0066.974] GetFileType (hFile=0x2b8) returned 0x1 [0066.974] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x41d4 [0066.974] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=16842, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x41ca [0066.975] ReadFile (in: hFile=0x2b8, lpBuffer=0x2692f10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2692f10*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0066.976] CloseHandle (hObject=0x2b8) returned 1 [0066.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11878) returned 0x0 [0066.987] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0066.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0066.987] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), fInfoLevelId=0x0, lpFileInformation=0x26cc2b8 | out: lpFileInformation=0x26cc2b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4)) returned 1 [0066.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0066.988] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0066.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0066.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0066.988] GetFileType (hFile=0x2b8) returned 0x1 [0066.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0066.988] GetFileType (hFile=0x2b8) returned 0x1 [0066.988] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x41d4 [0066.988] ReadFile (in: hFile=0x2b8, lpBuffer=0x26cc590, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26cc590*, lpNumberOfBytesRead=0x1c9aeb38*=0x41d4, lpOverlapped=0x0) returned 1 [0066.989] CloseHandle (hObject=0x2b8) returned 1 [0067.037] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0067.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0067.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.038] GetFileType (hFile=0x2b8) returned 0x1 [0067.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0067.038] GetFileType (hFile=0x2b8) returned 0x1 [0067.038] WriteFile (in: hFile=0x2b8, lpBuffer=0x275a588*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x275a588*, lpNumberOfBytesWritten=0x1c9aebc8*=0x41e0, lpOverlapped=0x0) returned 1 [0067.039] CloseHandle (hObject=0x2b8) returned 1 [0067.040] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0067.040] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0067.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0067.040] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.040] GetFileType (hFile=0x2b8) returned 0x1 [0067.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0067.040] GetFileType (hFile=0x2b8) returned 0x1 [0067.040] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x41e0 [0067.041] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0067.041] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUGx1c3JXVy54bWw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUGx1c3JXVy54bWw=", lpFilePart=0x0) returned 0x53 [0067.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0067.041] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcfc99cc0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x41ea)) returned 1 [0067.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0067.042] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUGx1c3JXVy54bWw=" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\uhjvugx1c3jxvy54bww=")) returned 1 [0067.042] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpFilePart=0x0) returned 0x4a [0067.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0067.042] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.043] GetFileType (hFile=0x2b8) returned 0x1 [0067.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0067.043] GetFileType (hFile=0x2b8) returned 0x1 [0067.043] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xa97cbdb [0067.043] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=177720273, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xa97cbd1 [0067.043] ReadFile (in: hFile=0x2b8, lpBuffer=0x2760b68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2760b68*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0067.047] CloseHandle (hObject=0x2b8) returned 1 [0067.049] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpFilePart=0x0) returned 0x4a [0067.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0067.049] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), fInfoLevelId=0x0, lpFileInformation=0x27cba40 | out: lpFileInformation=0x27cba40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb)) returned 1 [0067.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0067.051] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpFilePart=0x0) returned 0x4a [0067.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.052] GetFileType (hFile=0x2b8) returned 0x1 [0067.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.052] GetFileType (hFile=0x2b8) returned 0x1 [0067.052] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0067.077] CloseHandle (hObject=0x2b8) returned 1 [0067.077] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpFilePart=0x0) returned 0x4a [0067.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.077] GetFileType (hFile=0x2b8) returned 0x1 [0067.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.077] GetFileType (hFile=0x2b8) returned 0x1 [0067.184] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0067.188] CloseHandle (hObject=0x2b8) returned 1 [0067.188] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpFilePart=0x0) returned 0x4a [0067.188] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpFilePart=0x0) returned 0x4a [0067.188] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpFilePart=0x0) returned 0x4a [0067.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.189] GetFileType (hFile=0x2b8) returned 0x1 [0067.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.189] GetFileType (hFile=0x2b8) returned 0x1 [0067.189] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0xa97cbdb [0067.189] WriteFile (in: hFile=0x2b8, lpBuffer=0x2690ef8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2690ef8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0067.189] CloseHandle (hObject=0x2b8) returned 1 [0067.189] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpFilePart=0x0) returned 0x4a [0067.189] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUHJXVy5jYWI=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUHJXVy5jYWI=", lpFilePart=0x0) returned 0x4f [0067.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0067.189] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xcfe16a80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbe5)) returned 1 [0067.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0067.190] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUHJXVy5jYWI=" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\uhjvuhjxvy5jywi=")) returned 1 [0067.190] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpFilePart=0x0) returned 0x4b [0067.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0067.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.208] GetFileType (hFile=0x2b8) returned 0x1 [0067.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0067.209] GetFileType (hFile=0x2b8) returned 0x1 [0067.209] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xd49ee31 [0067.209] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=222948903, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xd49ee27 [0067.209] ReadFile (in: hFile=0x2b8, lpBuffer=0x2694bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2694bb8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0067.214] CloseHandle (hObject=0x2b8) returned 1 [0067.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11878) returned 0x0 [0067.227] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpFilePart=0x0) returned 0x4b [0067.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0067.227] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), fInfoLevelId=0x0, lpFileInformation=0x26b58f8 | out: lpFileInformation=0x26b58f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31)) returned 1 [0067.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0067.231] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpFilePart=0x0) returned 0x4b [0067.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.232] GetFileType (hFile=0x2b8) returned 0x1 [0067.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.232] GetFileType (hFile=0x2b8) returned 0x1 [0067.232] ReadFile (in: hFile=0x2b8, lpBuffer=0x128619d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0067.248] CloseHandle (hObject=0x2b8) returned 1 [0067.248] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpFilePart=0x0) returned 0x4b [0067.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.249] GetFileType (hFile=0x2b8) returned 0x1 [0067.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.249] GetFileType (hFile=0x2b8) returned 0x1 [0067.487] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0067.492] CloseHandle (hObject=0x2b8) returned 1 [0067.492] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpFilePart=0x0) returned 0x4b [0067.493] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpFilePart=0x0) returned 0x4b [0067.493] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpFilePart=0x0) returned 0x4b [0067.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.493] GetFileType (hFile=0x2b8) returned 0x1 [0067.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.494] GetFileType (hFile=0x2b8) returned 0x1 [0067.494] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0xd49ee31 [0067.494] WriteFile (in: hFile=0x2b8, lpBuffer=0x26974c8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26974c8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0067.494] CloseHandle (hObject=0x2b8) returned 1 [0067.494] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpFilePart=0x0) returned 0x4b [0067.494] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUHJXVzIuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUHJXVzIuY2Fi", lpFilePart=0x0) returned 0x4f [0067.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0067.494] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xd00ea4a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee3b)) returned 1 [0067.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0067.494] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UHJvUHJXVzIuY2Fi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\uhjvuhjxvziuy2fi")) returned 1 [0067.495] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0067.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0067.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.495] GetFileType (hFile=0x2b8) returned 0x1 [0067.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0067.495] GetFileType (hFile=0x2b8) returned 0x1 [0067.495] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x150578 [0067.495] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1377646, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x15056e [0067.496] ReadFile (in: hFile=0x2b8, lpBuffer=0x26988d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26988d8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0067.497] CloseHandle (hObject=0x2b8) returned 1 [0067.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11878) returned 0x0 [0067.505] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0067.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0067.505] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), fInfoLevelId=0x0, lpFileInformation=0x2703bc8 | out: lpFileInformation=0x2703bc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578)) returned 1 [0067.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0067.596] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0067.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.596] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.596] GetFileType (hFile=0x2b8) returned 0x1 [0067.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.596] GetFileType (hFile=0x2b8) returned 0x1 [0067.596] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0067.640] CloseHandle (hObject=0x2b8) returned 1 [0067.640] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0067.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.640] GetFileType (hFile=0x2b8) returned 0x1 [0067.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.640] GetFileType (hFile=0x2b8) returned 0x1 [0067.753] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0067.756] CloseHandle (hObject=0x2b8) returned 1 [0067.756] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0067.756] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0067.756] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0067.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.757] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.757] GetFileType (hFile=0x2b8) returned 0x1 [0067.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.757] GetFileType (hFile=0x2b8) returned 0x1 [0067.757] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x150578 [0067.757] WriteFile (in: hFile=0x2b8, lpBuffer=0x2752288*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2752288*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0067.757] CloseHandle (hObject=0x2b8) returned 1 [0067.757] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0067.757] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\c2V0dXAuZXhl", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\c2V0dXAuZXhl", lpFilePart=0x0) returned 0x4b [0067.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0067.757] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0xd0371c00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x150582)) returned 1 [0067.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0067.758] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\c2V0dXAuZXhl" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\c2v0dxauzxhl")) returned 1 [0067.758] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0067.758] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.758] GetFileType (hFile=0x2b8) returned 0x1 [0067.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0067.758] GetFileType (hFile=0x2b8) returned 0x1 [0067.758] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x7976 [0067.758] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=31084, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x796c [0067.759] ReadFile (in: hFile=0x2b8, lpBuffer=0x2753688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2753688*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0067.761] CloseHandle (hObject=0x2b8) returned 1 [0067.764] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0067.764] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x27be440 | out: lpFileInformation=0x27be440*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976)) returned 1 [0067.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0067.764] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0067.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.765] GetFileType (hFile=0x2b8) returned 0x1 [0067.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0067.765] GetFileType (hFile=0x2b8) returned 0x1 [0067.765] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x7976 [0067.765] ReadFile (in: hFile=0x2b8, lpBuffer=0x27be6f8, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27be6f8*, lpNumberOfBytesRead=0x1c9aeb38*=0x7976, lpOverlapped=0x0) returned 1 [0067.766] CloseHandle (hObject=0x2b8) returned 1 [0067.847] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0067.847] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.848] GetFileType (hFile=0x2b8) returned 0x1 [0067.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0067.848] GetFileType (hFile=0x2b8) returned 0x1 [0067.848] WriteFile (in: hFile=0x2b8, lpBuffer=0x272e8d8*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x272e8d8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x7980, lpOverlapped=0x0) returned 1 [0067.850] CloseHandle (hObject=0x2b8) returned 1 [0067.850] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.850] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0067.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.850] GetFileType (hFile=0x2b8) returned 0x1 [0067.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0067.850] GetFileType (hFile=0x2b8) returned 0x1 [0067.850] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x7980 [0067.851] WriteFile (in: hFile=0x2b8, lpBuffer=0x27371e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27371e8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0067.851] CloseHandle (hObject=0x2b8) returned 1 [0067.851] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.851] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0067.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0067.851] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xd0456440, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x798a)) returned 1 [0067.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0067.851] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0067.852] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0067.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0067.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0067.852] GetFileType (hFile=0x2b8) returned 0x1 [0067.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0067.852] GetFileType (hFile=0x2b8) returned 0x1 [0067.852] WriteFile (in: hFile=0x2b8, lpBuffer=0x273b520*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x273b520*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0067.853] CloseHandle (hObject=0x2b8) returned 1 [0067.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0067.854] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.854] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.854] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0067.856] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.856] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0067.856] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0067.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0067.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0067.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0067.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0067.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0067.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0067.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0067.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0067.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0067.858] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0067.858] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0067.858] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0067.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0067.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0067.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0067.859] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.859] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.859] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0067.860] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.860] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0067.860] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0067.860] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0067.860] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0067.860] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0067.860] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0067.861] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0067.861] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0067.861] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0067.861] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0067.861] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0067.861] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0067.861] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0067.861] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0067.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0067.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0067.862] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0067.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0067.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.864] GetFileType (hFile=0x2b8) returned 0x1 [0067.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0067.864] GetFileType (hFile=0x2b8) returned 0x1 [0067.864] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1e6600 [0067.864] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1992182, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1e65f6 [0067.864] ReadFile (in: hFile=0x2b8, lpBuffer=0x2741b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2741b70*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0067.866] CloseHandle (hObject=0x2b8) returned 1 [0067.867] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0067.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0067.867] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x27ac928 | out: lpFileInformation=0x27ac928*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600)) returned 1 [0067.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0067.870] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0067.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.870] GetFileType (hFile=0x2b8) returned 0x1 [0067.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.870] GetFileType (hFile=0x2b8) returned 0x1 [0067.870] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0067.899] CloseHandle (hObject=0x2b8) returned 1 [0067.899] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0067.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.899] GetFileType (hFile=0x2b8) returned 0x1 [0067.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.899] GetFileType (hFile=0x2b8) returned 0x1 [0067.979] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0067.982] CloseHandle (hObject=0x2b8) returned 1 [0067.982] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0067.983] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0067.983] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0067.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0067.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.983] GetFileType (hFile=0x2b8) returned 0x1 [0067.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0067.983] GetFileType (hFile=0x2b8) returned 0x1 [0067.983] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x1e6600 [0067.983] WriteFile (in: hFile=0x2b8, lpBuffer=0x26917e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26917e8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0067.984] CloseHandle (hObject=0x2b8) returned 1 [0067.984] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0067.984] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy5tc2k=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy5tc2k=", lpFilePart=0x0) returned 0x53 [0067.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0067.984] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xd05ad0a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1e660a)) returned 1 [0067.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0067.984] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy5tc2k=" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\t2zmawnlmzjxvy5tc2k=")) returned 1 [0067.985] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0067.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0067.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.985] GetFileType (hFile=0x2b8) returned 0x1 [0067.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0067.985] GetFileType (hFile=0x2b8) returned 0x1 [0067.985] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x10b2 [0067.985] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=4264, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x10a8 [0067.985] ReadFile (in: hFile=0x2b8, lpBuffer=0x2692c20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2692c20*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0067.987] CloseHandle (hObject=0x2b8) returned 1 [0067.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11878) returned 0x0 [0067.993] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0067.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0067.993] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x26fda70 | out: lpFileInformation=0x26fda70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0067.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0067.993] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0067.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0067.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0067.994] GetFileType (hFile=0x2b8) returned 0x1 [0067.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0067.994] GetFileType (hFile=0x2b8) returned 0x1 [0067.994] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x10b2 [0067.994] ReadFile (in: hFile=0x2b8, lpBuffer=0x26fdd48, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26fdd48*, lpNumberOfBytesRead=0x1c9aeb38*=0x10b2, lpOverlapped=0x0) returned 1 [0068.012] CloseHandle (hObject=0x2b8) returned 1 [0068.042] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0068.042] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.043] GetFileType (hFile=0x2b8) returned 0x1 [0068.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0068.043] GetFileType (hFile=0x2b8) returned 0x1 [0068.043] WriteFile (in: hFile=0x2b8, lpBuffer=0x277c710*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x277c710*, lpNumberOfBytesWritten=0x1c9aebc8*=0x10c0, lpOverlapped=0x0) returned 1 [0068.044] CloseHandle (hObject=0x2b8) returned 1 [0068.045] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.045] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0068.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.045] GetFileType (hFile=0x2b8) returned 0x1 [0068.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0068.045] GetFileType (hFile=0x2b8) returned 0x1 [0068.045] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x10c0 [0068.045] WriteFile (in: hFile=0x2b8, lpBuffer=0x277e7a8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x277e7a8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0068.045] CloseHandle (hObject=0x2b8) returned 1 [0068.046] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.046] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy54bWw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy54bWw=", lpFilePart=0x0) returned 0x53 [0068.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0068.046] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xd0645620, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x10ca)) returned 1 [0068.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0068.046] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy54bWw=" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\t2zmawnlmzjxvy54bww=")) returned 1 [0068.047] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0068.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0068.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.047] GetFileType (hFile=0x2b8) returned 0x1 [0068.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0068.047] GetFileType (hFile=0x2b8) returned 0x1 [0068.047] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2a968 [0068.047] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=174430, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2a95e [0068.047] ReadFile (in: hFile=0x2b8, lpBuffer=0x277fbc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x277fbc0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0068.049] CloseHandle (hObject=0x2b8) returned 1 [0068.051] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0068.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0068.051] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), fInfoLevelId=0x0, lpFileInformation=0x27eaa18 | out: lpFileInformation=0x27eaa18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968)) returned 1 [0068.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0068.051] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0068.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0068.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.051] GetFileType (hFile=0x2b8) returned 0x1 [0068.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0068.051] GetFileType (hFile=0x2b8) returned 0x1 [0068.051] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x2a968 [0068.052] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961a10, nNumberOfBytesToRead=0x2a968, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesRead=0x1c9aeb38*=0x2a968, lpOverlapped=0x0) returned 1 [0068.056] CloseHandle (hObject=0x2b8) returned 1 [0068.089] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0068.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0068.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.091] GetFileType (hFile=0x2b8) returned 0x1 [0068.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0068.091] GetFileType (hFile=0x2b8) returned 0x1 [0068.091] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a369d8*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12a369d8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2a970, lpOverlapped=0x0) returned 1 [0068.095] CloseHandle (hObject=0x2b8) returned 1 [0068.095] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0068.095] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0068.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0068.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.095] GetFileType (hFile=0x2b8) returned 0x1 [0068.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0068.095] GetFileType (hFile=0x2b8) returned 0x1 [0068.095] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2a970 [0068.095] WriteFile (in: hFile=0x2b8, lpBuffer=0x2862520*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2862520*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0068.096] CloseHandle (hObject=0x2b8) returned 1 [0068.096] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0068.096] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\b3NlLmV4ZQ==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\b3NlLmV4ZQ==", lpFilePart=0x0) returned 0x4b [0068.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0068.096] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xd06b7a40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x2a97a)) returned 1 [0068.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0068.096] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\b3NlLmV4ZQ==" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\b3nllmv4zq==")) returned 1 [0068.096] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0068.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0068.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.097] GetFileType (hFile=0x2b8) returned 0x1 [0068.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0068.097] GetFileType (hFile=0x2b8) returned 0x1 [0068.098] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x709768 [0068.098] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=7378782, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x70975e [0068.098] ReadFile (in: hFile=0x2b8, lpBuffer=0x2863918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2863918*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0068.130] CloseHandle (hObject=0x2b8) returned 1 [0068.147] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0068.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0068.147] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), fInfoLevelId=0x0, lpFileInformation=0x270b1c0 | out: lpFileInformation=0x270b1c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768)) returned 1 [0068.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0068.149] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0068.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0068.149] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.150] GetFileType (hFile=0x2b8) returned 0x1 [0068.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0068.150] GetFileType (hFile=0x2b8) returned 0x1 [0068.150] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61380, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12a61380*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0068.178] CloseHandle (hObject=0x2b8) returned 1 [0068.178] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0068.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0068.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.178] GetFileType (hFile=0x2b8) returned 0x1 [0068.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0068.178] GetFileType (hFile=0x2b8) returned 0x1 [0068.345] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0068.348] CloseHandle (hObject=0x2b8) returned 1 [0068.348] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0068.349] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0068.349] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0068.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0068.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.349] GetFileType (hFile=0x2b8) returned 0x1 [0068.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0068.349] GetFileType (hFile=0x2b8) returned 0x1 [0068.349] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x709768 [0068.349] WriteFile (in: hFile=0x2b8, lpBuffer=0x26d0ac8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26d0ac8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0068.349] CloseHandle (hObject=0x2b8) returned 1 [0068.350] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0068.350] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\b3NldHVwLmRsbA==", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\b3NldHVwLmRsbA==", lpFilePart=0x0) returned 0x4f [0068.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0068.350] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xd0919040, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x709772)) returned 1 [0068.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0068.350] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\b3NldHVwLmRsbA==" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\b3nldhvwlmrsba==")) returned 1 [0068.350] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0068.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0068.351] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.371] GetFileType (hFile=0x2b8) returned 0x1 [0068.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0068.371] GetFileType (hFile=0x2b8) returned 0x1 [0068.371] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x228df5c [0068.371] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=36233042, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x228df52 [0068.371] ReadFile (in: hFile=0x2b8, lpBuffer=0x26d4980, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26d4980*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0068.374] CloseHandle (hObject=0x2b8) returned 1 [0068.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x117d8) returned 0x0 [0068.383] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0068.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0068.383] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x2740408 | out: lpFileInformation=0x2740408*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c)) returned 1 [0068.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0068.388] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0068.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0068.388] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.388] GetFileType (hFile=0x2b8) returned 0x1 [0068.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0068.388] GetFileType (hFile=0x2b8) returned 0x1 [0068.388] ReadFile (in: hFile=0x2b8, lpBuffer=0x128619d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0068.399] CloseHandle (hObject=0x2b8) returned 1 [0068.405] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0068.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0068.406] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.406] GetFileType (hFile=0x2b8) returned 0x1 [0068.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0068.406] GetFileType (hFile=0x2b8) returned 0x1 [0068.522] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0068.525] CloseHandle (hObject=0x2b8) returned 1 [0068.525] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0068.526] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0068.526] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0068.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0068.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.526] GetFileType (hFile=0x2b8) returned 0x1 [0068.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0068.526] GetFileType (hFile=0x2b8) returned 0x1 [0068.526] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x228df5c [0068.526] WriteFile (in: hFile=0x2b8, lpBuffer=0x26ce380*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26ce380*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0068.526] CloseHandle (hObject=0x2b8) returned 1 [0068.526] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0068.526] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\T1dPVzMyV1cuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\T1dPVzMyV1cuY2Fi", lpFilePart=0x0) returned 0x4f [0068.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0068.527] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xd0abbf60, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x228df66)) returned 1 [0068.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0068.527] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\T1dPVzMyV1cuY2Fi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\t1dpvzmyv1cuy2fi")) returned 1 [0068.527] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0068.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0068.527] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.528] GetFileType (hFile=0x2b8) returned 0x1 [0068.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0068.528] GetFileType (hFile=0x2b8) returned 0x1 [0068.528] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x165510 [0068.528] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1463558, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x165506 [0068.528] ReadFile (in: hFile=0x2b8, lpBuffer=0x26cff90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26cff90*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0068.530] CloseHandle (hObject=0x2b8) returned 1 [0068.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x117d8) returned 0x0 [0068.538] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0068.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0068.538] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), fInfoLevelId=0x0, lpFileInformation=0x269e908 | out: lpFileInformation=0x269e908*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510)) returned 1 [0068.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0068.540] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0068.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0068.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.540] GetFileType (hFile=0x2b8) returned 0x1 [0068.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0068.540] GetFileType (hFile=0x2b8) returned 0x1 [0068.540] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61a48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0068.581] CloseHandle (hObject=0x2b8) returned 1 [0068.585] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0068.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0068.585] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.585] GetFileType (hFile=0x2b8) returned 0x1 [0068.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0068.585] GetFileType (hFile=0x2b8) returned 0x1 [0068.682] WriteFile (in: hFile=0x2b8, lpBuffer=0x128619d8*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0068.728] CloseHandle (hObject=0x2b8) returned 1 [0068.728] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0068.729] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0068.729] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0068.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0068.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.729] GetFileType (hFile=0x2b8) returned 0x1 [0068.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0068.729] GetFileType (hFile=0x2b8) returned 0x1 [0068.729] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x165510 [0068.730] WriteFile (in: hFile=0x2b8, lpBuffer=0x2690d78*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2690d78*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0068.730] CloseHandle (hObject=0x2b8) returned 1 [0068.730] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0068.730] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UGlkR2VuWC5kbGw=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UGlkR2VuWC5kbGw=", lpFilePart=0x0) returned 0x4f [0068.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0068.730] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xd0cab140, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x16551a)) returned 1 [0068.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0068.730] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UGlkR2VuWC5kbGw=" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\uglkr2vuwc5kbgw=")) returned 1 [0068.731] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0068.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0068.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.743] GetFileType (hFile=0x2b8) returned 0x1 [0068.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0068.743] GetFileType (hFile=0x2b8) returned 0x1 [0068.743] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xaec3a [0068.743] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=715824, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xaec30 [0068.743] ReadFile (in: hFile=0x2b8, lpBuffer=0x26921c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26921c0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0068.745] CloseHandle (hObject=0x2b8) returned 1 [0068.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x117d8) returned 0x0 [0068.754] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0068.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0068.754] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x26fe0b8 | out: lpFileInformation=0x26fe0b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a)) returned 1 [0068.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0068.755] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0068.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0068.755] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.755] GetFileType (hFile=0x2b8) returned 0x1 [0068.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0068.755] GetFileType (hFile=0x2b8) returned 0x1 [0068.755] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xaec3a [0068.830] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb38*=0xaec3a, lpOverlapped=0x0) returned 1 [0068.842] CloseHandle (hObject=0x2b8) returned 1 [0068.948] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0068.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0068.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.955] GetFileType (hFile=0x2b8) returned 0x1 [0068.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0068.955] GetFileType (hFile=0x2b8) returned 0x1 [0068.955] WriteFile (in: hFile=0x2b8, lpBuffer=0x129cb748*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x129cb748*, lpNumberOfBytesWritten=0x1c9aebc8*=0xaec40, lpOverlapped=0x0) returned 1 [0068.966] CloseHandle (hObject=0x2b8) returned 1 [0068.966] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0068.967] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0068.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0068.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.967] GetFileType (hFile=0x2b8) returned 0x1 [0068.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0068.967] GetFileType (hFile=0x2b8) returned 0x1 [0068.967] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xaec40 [0068.967] WriteFile (in: hFile=0x2b8, lpBuffer=0x272d418*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x272d418*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0068.967] CloseHandle (hObject=0x2b8) returned 1 [0068.967] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0068.967] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\cGtleWNvbmZpZy1vZmZpY2UueHJtLW1z", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\cGtleWNvbmZpZy1vZmZpY2UueHJtLW1z", lpFilePart=0x0) returned 0x5f [0068.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0068.967] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xd0f0c740, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xaec4a)) returned 1 [0068.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0068.968] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\cGtleWNvbmZpZy1vZmZpY2UueHJtLW1z" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\cgtlewnvbmzpzy1vzmzpy2uuehjtlw1z")) returned 1 [0068.968] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpFilePart=0x0) returned 0x4c [0068.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0068.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0068.969] GetFileType (hFile=0x2b8) returned 0x1 [0068.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0068.969] GetFileType (hFile=0x2b8) returned 0x1 [0068.969] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xa4c400 [0068.970] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=10798070, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xa4c3f6 [0068.970] ReadFile (in: hFile=0x2b8, lpBuffer=0x272e890, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x272e890*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0068.971] CloseHandle (hObject=0x2b8) returned 1 [0068.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x117d8) returned 0x0 [0068.978] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpFilePart=0x0) returned 0x4c [0068.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0068.978] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), fInfoLevelId=0x0, lpFileInformation=0x2799528 | out: lpFileInformation=0x2799528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400)) returned 1 [0068.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0069.007] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpFilePart=0x0) returned 0x4c [0069.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.007] GetFileType (hFile=0x2b8) returned 0x1 [0069.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.008] GetFileType (hFile=0x2b8) returned 0x1 [0069.008] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0069.026] CloseHandle (hObject=0x2b8) returned 1 [0069.032] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpFilePart=0x0) returned 0x4c [0069.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.032] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.032] GetFileType (hFile=0x2b8) returned 0x1 [0069.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.032] GetFileType (hFile=0x2b8) returned 0x1 [0069.148] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0069.150] CloseHandle (hObject=0x2b8) returned 1 [0069.151] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpFilePart=0x0) returned 0x4c [0069.151] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpFilePart=0x0) returned 0x4c [0069.151] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpFilePart=0x0) returned 0x4c [0069.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.151] GetFileType (hFile=0x2b8) returned 0x1 [0069.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.151] GetFileType (hFile=0x2b8) returned 0x1 [0069.152] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0xa4c400 [0069.152] WriteFile (in: hFile=0x2b8, lpBuffer=0x267cdb0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x267cdb0*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0069.152] CloseHandle (hObject=0x2b8) returned 1 [0069.152] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", lpFilePart=0x0) returned 0x4c [0069.152] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UHJqUHJvcldXLm1zaQ==", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UHJqUHJvcldXLm1zaQ==", lpFilePart=0x0) returned 0x53 [0069.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0069.152] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xd10af660, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xa4c40a)) returned 1 [0069.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0069.152] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UHJqUHJvcldXLm1zaQ==" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\uhjquhjvcldxlm1zaq==")) returned 1 [0069.153] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0069.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0069.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.154] GetFileType (hFile=0x2b8) returned 0x1 [0069.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0069.154] GetFileType (hFile=0x2b8) returned 0x1 [0069.154] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1915 [0069.154] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=6411, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x190b [0069.154] ReadFile (in: hFile=0x2b8, lpBuffer=0x267e1e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267e1e8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0069.156] CloseHandle (hObject=0x2b8) returned 1 [0069.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x117d8) returned 0x0 [0069.162] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0069.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0069.162] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x26e8e80 | out: lpFileInformation=0x26e8e80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915)) returned 1 [0069.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0069.162] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0069.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0069.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.162] GetFileType (hFile=0x2b8) returned 0x1 [0069.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0069.163] GetFileType (hFile=0x2b8) returned 0x1 [0069.163] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x1915 [0069.163] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e9158, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26e9158*, lpNumberOfBytesRead=0x1c9aeb38*=0x1915, lpOverlapped=0x0) returned 1 [0069.171] CloseHandle (hObject=0x2b8) returned 1 [0069.203] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0069.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0069.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.205] GetFileType (hFile=0x2b8) returned 0x1 [0069.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0069.205] GetFileType (hFile=0x2b8) returned 0x1 [0069.205] WriteFile (in: hFile=0x2b8, lpBuffer=0x2767ae8*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2767ae8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x1920, lpOverlapped=0x0) returned 1 [0069.206] CloseHandle (hObject=0x2b8) returned 1 [0069.206] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0069.206] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0069.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0069.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.206] GetFileType (hFile=0x2b8) returned 0x1 [0069.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0069.207] GetFileType (hFile=0x2b8) returned 0x1 [0069.207] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x1920 [0069.207] WriteFile (in: hFile=0x2b8, lpBuffer=0x276a3e0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x276a3e0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0069.207] CloseHandle (hObject=0x2b8) returned 1 [0069.207] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0069.207] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UHJqUHJvcldXLnhtbA==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UHJqUHJvcldXLnhtbA==", lpFilePart=0x0) returned 0x53 [0069.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0069.207] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xd1147be0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x192a)) returned 1 [0069.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0069.207] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UHJqUHJvcldXLnhtbA==" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\uhjquhjvcldxlnhtba==")) returned 1 [0069.208] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpFilePart=0x0) returned 0x4b [0069.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0069.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.208] GetFileType (hFile=0x2b8) returned 0x1 [0069.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0069.208] GetFileType (hFile=0x2b8) returned 0x1 [0069.208] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x9b6ba9f [0069.208] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=162970261, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x9b6ba95 [0069.208] ReadFile (in: hFile=0x2b8, lpBuffer=0x276b810, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x276b810*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0069.213] CloseHandle (hObject=0x2b8) returned 1 [0069.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11788) returned 0x0 [0069.216] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpFilePart=0x0) returned 0x4b [0069.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0069.216] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), fInfoLevelId=0x0, lpFileInformation=0x27d65b8 | out: lpFileInformation=0x27d65b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f)) returned 1 [0069.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0069.218] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpFilePart=0x0) returned 0x4b [0069.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.218] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.218] GetFileType (hFile=0x2b8) returned 0x1 [0069.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.218] GetFileType (hFile=0x2b8) returned 0x1 [0069.218] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0069.245] CloseHandle (hObject=0x2b8) returned 1 [0069.245] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpFilePart=0x0) returned 0x4b [0069.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.246] GetFileType (hFile=0x2b8) returned 0x1 [0069.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.246] GetFileType (hFile=0x2b8) returned 0x1 [0069.380] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a61a48*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0069.382] CloseHandle (hObject=0x2b8) returned 1 [0069.383] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpFilePart=0x0) returned 0x4b [0069.383] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpFilePart=0x0) returned 0x4b [0069.383] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpFilePart=0x0) returned 0x4b [0069.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.383] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.384] GetFileType (hFile=0x2b8) returned 0x1 [0069.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.384] GetFileType (hFile=0x2b8) returned 0x1 [0069.384] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x9b6ba9f [0069.384] WriteFile (in: hFile=0x2b8, lpBuffer=0x267cd88*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x267cd88*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0069.384] CloseHandle (hObject=0x2b8) returned 1 [0069.384] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpFilePart=0x0) returned 0x4b [0069.384] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UHJqUHJyV1cuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UHJqUHJyV1cuY2Fi", lpFilePart=0x0) returned 0x4f [0069.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0069.384] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xd12eab00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x9b6baa9)) returned 1 [0069.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0069.384] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UHJqUHJyV1cuY2Fi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\uhjquhjyv1cuy2fi")) returned 1 [0069.385] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0069.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0069.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.385] GetFileType (hFile=0x2b8) returned 0x1 [0069.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0069.385] GetFileType (hFile=0x2b8) returned 0x1 [0069.385] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x150578 [0069.385] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1377646, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x15056e [0069.385] ReadFile (in: hFile=0x2b8, lpBuffer=0x267e198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267e198*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0069.389] CloseHandle (hObject=0x2b8) returned 1 [0069.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11788) returned 0x0 [0069.400] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0069.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0069.400] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), fInfoLevelId=0x0, lpFileInformation=0x26ce158 | out: lpFileInformation=0x26ce158*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578)) returned 1 [0069.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0069.404] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0069.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.405] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.405] GetFileType (hFile=0x2b8) returned 0x1 [0069.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.405] GetFileType (hFile=0x2b8) returned 0x1 [0069.405] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0069.415] CloseHandle (hObject=0x2b8) returned 1 [0069.418] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0069.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.418] GetFileType (hFile=0x2b8) returned 0x1 [0069.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.418] GetFileType (hFile=0x2b8) returned 0x1 [0069.545] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0069.547] CloseHandle (hObject=0x2b8) returned 1 [0069.548] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0069.548] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0069.548] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0069.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.548] GetFileType (hFile=0x2b8) returned 0x1 [0069.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.548] GetFileType (hFile=0x2b8) returned 0x1 [0069.548] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x150578 [0069.549] WriteFile (in: hFile=0x2b8, lpBuffer=0x2693428*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2693428*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0069.549] CloseHandle (hObject=0x2b8) returned 1 [0069.549] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0069.549] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\c2V0dXAuZXhl", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\c2V0dXAuZXhl", lpFilePart=0x0) returned 0x4b [0069.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0069.549] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xd148da20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x150582)) returned 1 [0069.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0069.549] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\c2V0dXAuZXhl" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\c2v0dxauzxhl")) returned 1 [0069.550] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0069.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0069.550] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.550] GetFileType (hFile=0x2b8) returned 0x1 [0069.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0069.550] GetFileType (hFile=0x2b8) returned 0x1 [0069.550] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x412b [0069.550] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=16673, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x4121 [0069.550] ReadFile (in: hFile=0x2b8, lpBuffer=0x2694828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2694828*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0069.552] CloseHandle (hObject=0x2b8) returned 1 [0069.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11788) returned 0x0 [0069.561] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0069.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0069.561] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x26ff7f8 | out: lpFileInformation=0x26ff7f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b)) returned 1 [0069.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0069.561] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0069.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0069.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.561] GetFileType (hFile=0x2b8) returned 0x1 [0069.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0069.561] GetFileType (hFile=0x2b8) returned 0x1 [0069.561] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x412b [0069.562] ReadFile (in: hFile=0x2b8, lpBuffer=0x26ffab0, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26ffab0*, lpNumberOfBytesRead=0x1c9aeb38*=0x412b, lpOverlapped=0x0) returned 1 [0069.562] CloseHandle (hObject=0x2b8) returned 1 [0069.606] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0069.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0069.607] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.608] GetFileType (hFile=0x2b8) returned 0x1 [0069.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0069.608] GetFileType (hFile=0x2b8) returned 0x1 [0069.608] WriteFile (in: hFile=0x2b8, lpBuffer=0x278da80*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x278da80*, lpNumberOfBytesWritten=0x1c9aebc8*=0x4130, lpOverlapped=0x0) returned 1 [0069.609] CloseHandle (hObject=0x2b8) returned 1 [0069.609] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0069.609] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0069.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0069.609] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.609] GetFileType (hFile=0x2b8) returned 0x1 [0069.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0069.610] GetFileType (hFile=0x2b8) returned 0x1 [0069.610] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4130 [0069.610] WriteFile (in: hFile=0x2b8, lpBuffer=0x2792b40*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2792b40*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0069.610] CloseHandle (hObject=0x2b8) returned 1 [0069.610] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0069.610] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0069.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0069.610] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xd1525fa0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x413a)) returned 1 [0069.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0069.610] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0069.611] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0069.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0069.611] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0069.611] GetFileType (hFile=0x2b8) returned 0x1 [0069.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0069.612] GetFileType (hFile=0x2b8) returned 0x1 [0069.612] WriteFile (in: hFile=0x2b8, lpBuffer=0x2796e78*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2796e78*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0069.613] CloseHandle (hObject=0x2b8) returned 1 [0069.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0069.613] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0069.613] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0069.613] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0069.615] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.616] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0069.616] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0069.616] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0069.616] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0069.616] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0069.616] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0069.616] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0069.616] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0069.617] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0069.617] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0069.617] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0069.617] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0069.617] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0069.617] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0069.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0069.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0069.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0069.618] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0069.618] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0069.619] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0069.619] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0069.625] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0069.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0069.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0069.626] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0069.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0069.626] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.627] GetFileType (hFile=0x2b8) returned 0x1 [0069.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0069.627] GetFileType (hFile=0x2b8) returned 0x1 [0069.627] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1e6600 [0069.627] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1992182, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1e65f6 [0069.627] ReadFile (in: hFile=0x2b8, lpBuffer=0x279d3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x279d3b0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0069.629] CloseHandle (hObject=0x2b8) returned 1 [0069.630] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11788) returned 0x0 [0069.646] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0069.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0069.646] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x26e4430 | out: lpFileInformation=0x26e4430*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600)) returned 1 [0069.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0069.648] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0069.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.649] GetFileType (hFile=0x2b8) returned 0x1 [0069.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.649] GetFileType (hFile=0x2b8) returned 0x1 [0069.649] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61a48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0069.670] CloseHandle (hObject=0x2b8) returned 1 [0069.674] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0069.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.674] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.675] GetFileType (hFile=0x2b8) returned 0x1 [0069.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.675] GetFileType (hFile=0x2b8) returned 0x1 [0069.798] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0069.800] CloseHandle (hObject=0x2b8) returned 1 [0069.801] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0069.801] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0069.801] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0069.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.801] GetFileType (hFile=0x2b8) returned 0x1 [0069.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.801] GetFileType (hFile=0x2b8) returned 0x1 [0069.802] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x1e6600 [0069.802] WriteFile (in: hFile=0x2b8, lpBuffer=0x26b5f78*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26b5f78*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0069.802] CloseHandle (hObject=0x2b8) returned 1 [0069.802] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", lpFilePart=0x0) returned 0x4d [0069.802] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy5tc2k=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy5tc2k=", lpFilePart=0x0) returned 0x53 [0069.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0069.802] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0xd16ef020, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1e660a)) returned 1 [0069.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0069.802] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy5tc2k=" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\t2zmawnlmzjxvy5tc2k=")) returned 1 [0069.803] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0069.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0069.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.803] GetFileType (hFile=0x2b8) returned 0x1 [0069.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0069.803] GetFileType (hFile=0x2b8) returned 0x1 [0069.803] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x10b2 [0069.803] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=4264, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x10a8 [0069.803] ReadFile (in: hFile=0x2b8, lpBuffer=0x26b73b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26b73b0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0069.805] CloseHandle (hObject=0x2b8) returned 1 [0069.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11788) returned 0x0 [0069.814] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0069.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0069.814] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x27225f0 | out: lpFileInformation=0x27225f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2)) returned 1 [0069.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0069.814] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0069.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0069.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.814] GetFileType (hFile=0x2b8) returned 0x1 [0069.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0069.814] GetFileType (hFile=0x2b8) returned 0x1 [0069.814] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x10b2 [0069.814] ReadFile (in: hFile=0x2b8, lpBuffer=0x27228c8, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27228c8*, lpNumberOfBytesRead=0x1c9aeb38*=0x10b2, lpOverlapped=0x0) returned 1 [0069.815] CloseHandle (hObject=0x2b8) returned 1 [0069.840] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0069.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0069.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.841] GetFileType (hFile=0x2b8) returned 0x1 [0069.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0069.841] GetFileType (hFile=0x2b8) returned 0x1 [0069.841] WriteFile (in: hFile=0x2b8, lpBuffer=0x279f7b8*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x279f7b8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x10c0, lpOverlapped=0x0) returned 1 [0069.842] CloseHandle (hObject=0x2b8) returned 1 [0069.842] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0069.842] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0069.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0069.842] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.842] GetFileType (hFile=0x2b8) returned 0x1 [0069.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0069.842] GetFileType (hFile=0x2b8) returned 0x1 [0069.842] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x10c0 [0069.843] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0069.843] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy54bWw=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy54bWw=", lpFilePart=0x0) returned 0x53 [0069.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0069.843] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0xd1761440, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x10ca)) returned 1 [0069.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0069.843] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\T2ZmaWNlMzJXVy54bWw=" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\t2zmawnlmzjxvy54bww=")) returned 1 [0069.844] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0069.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0069.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.844] GetFileType (hFile=0x2b8) returned 0x1 [0069.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0069.845] GetFileType (hFile=0x2b8) returned 0x1 [0069.845] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2a968 [0069.845] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=174430, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2a95e [0069.845] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a2c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27a2c68*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0069.857] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0069.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0069.857] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), fInfoLevelId=0x0, lpFileInformation=0x26bd398 | out: lpFileInformation=0x26bd398*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968)) returned 1 [0069.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0069.857] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0069.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0069.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.857] GetFileType (hFile=0x2b8) returned 0x1 [0069.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0069.857] GetFileType (hFile=0x2b8) returned 0x1 [0069.857] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x2a968 [0069.858] ReadFile (in: hFile=0x2b8, lpBuffer=0x128619d8, nNumberOfBytesToRead=0x2a968, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesRead=0x1c9aeb38*=0x2a968, lpOverlapped=0x0) returned 1 [0069.860] CloseHandle (hObject=0x2b8) returned 1 [0069.918] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0069.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0069.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.920] GetFileType (hFile=0x2b8) returned 0x1 [0069.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0069.920] GetFileType (hFile=0x2b8) returned 0x1 [0069.920] WriteFile (in: hFile=0x2b8, lpBuffer=0x129369a0*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x129369a0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2a970, lpOverlapped=0x0) returned 1 [0069.923] CloseHandle (hObject=0x2b8) returned 1 [0069.924] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0069.924] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0069.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0069.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.924] GetFileType (hFile=0x2b8) returned 0x1 [0069.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0069.924] GetFileType (hFile=0x2b8) returned 0x1 [0069.924] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2a970 [0069.924] WriteFile (in: hFile=0x2b8, lpBuffer=0x27379e0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27379e0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0069.924] CloseHandle (hObject=0x2b8) returned 1 [0069.924] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", lpFilePart=0x0) returned 0x46 [0069.924] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\b3NlLmV4ZQ==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\b3NlLmV4ZQ==", lpFilePart=0x0) returned 0x4b [0069.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0069.925] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0xd181fb20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x2a97a)) returned 1 [0069.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0069.925] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\b3NlLmV4ZQ==" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\b3nllmv4zq==")) returned 1 [0069.925] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0069.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0069.925] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.925] GetFileType (hFile=0x2b8) returned 0x1 [0069.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0069.925] GetFileType (hFile=0x2b8) returned 0x1 [0069.926] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x709768 [0069.926] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=7378782, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x70975e [0069.926] ReadFile (in: hFile=0x2b8, lpBuffer=0x2738dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2738dd8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0069.928] CloseHandle (hObject=0x2b8) returned 1 [0069.929] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0069.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0069.929] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), fInfoLevelId=0x0, lpFileInformation=0x27a3a80 | out: lpFileInformation=0x27a3a80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768)) returned 1 [0069.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0069.934] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0069.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.934] GetFileType (hFile=0x2b8) returned 0x1 [0069.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.934] GetFileType (hFile=0x2b8) returned 0x1 [0069.934] ReadFile (in: hFile=0x2b8, lpBuffer=0x12961348, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12961348*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0069.944] CloseHandle (hObject=0x2b8) returned 1 [0069.950] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0069.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0069.950] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0069.951] GetFileType (hFile=0x2b8) returned 0x1 [0069.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0069.951] GetFileType (hFile=0x2b8) returned 0x1 [0070.047] WriteFile (in: hFile=0x2b8, lpBuffer=0x12a61380*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12a61380*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0070.049] CloseHandle (hObject=0x2b8) returned 1 [0070.049] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0070.050] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0070.050] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0070.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0070.050] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0070.050] GetFileType (hFile=0x2b8) returned 0x1 [0070.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0070.050] GetFileType (hFile=0x2b8) returned 0x1 [0070.050] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x709768 [0070.050] WriteFile (in: hFile=0x2b8, lpBuffer=0x26bca88*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26bca88*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0070.050] CloseHandle (hObject=0x2b8) returned 1 [0070.051] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", lpFilePart=0x0) returned 0x49 [0070.051] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\b3NldHVwLmRsbA==", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\b3NldHVwLmRsbA==", lpFilePart=0x0) returned 0x4f [0070.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0070.051] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0xd1950620, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x709772)) returned 1 [0070.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0070.051] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\b3NldHVwLmRsbA==" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\b3nldhvwlmrsba==")) returned 1 [0070.058] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0070.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0070.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0070.058] GetFileType (hFile=0x2b8) returned 0x1 [0070.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0070.058] GetFileType (hFile=0x2b8) returned 0x1 [0070.058] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x228df5c [0070.058] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=36233042, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x228df52 [0070.058] ReadFile (in: hFile=0x2b8, lpBuffer=0x26bdea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26bdea0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0070.091] CloseHandle (hObject=0x2b8) returned 1 [0070.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11788) returned 0x0 [0070.097] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0070.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0070.097] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x272c1d0 | out: lpFileInformation=0x272c1d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c)) returned 1 [0070.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0070.100] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0070.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0070.100] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0070.100] GetFileType (hFile=0x2b8) returned 0x1 [0070.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0070.100] GetFileType (hFile=0x2b8) returned 0x1 [0070.100] ReadFile (in: hFile=0x2b8, lpBuffer=0x12b613b8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12b613b8*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0070.882] CloseHandle (hObject=0x2b8) returned 1 [0070.883] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0070.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0070.883] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0070.883] GetFileType (hFile=0x2b8) returned 0x1 [0070.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0070.883] GetFileType (hFile=0x2b8) returned 0x1 [0071.058] WriteFile (in: hFile=0x2b8, lpBuffer=0x128619d8*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x128619d8*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0071.060] CloseHandle (hObject=0x2b8) returned 1 [0071.061] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0071.061] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0071.061] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0071.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0071.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.061] GetFileType (hFile=0x2b8) returned 0x1 [0071.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0071.061] GetFileType (hFile=0x2b8) returned 0x1 [0071.061] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x228df5c [0071.061] WriteFile (in: hFile=0x2b8, lpBuffer=0x26945c0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26945c0*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0071.062] CloseHandle (hObject=0x2b8) returned 1 [0071.062] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpFilePart=0x0) returned 0x4b [0071.062] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\T1dPVzMyV1cuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\T1dPVzMyV1cuY2Fi", lpFilePart=0x0) returned 0x4f [0071.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0071.062] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0xd22fbf80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x228df66)) returned 1 [0071.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0071.062] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\T1dPVzMyV1cuY2Fi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\t1dpvzmyv1cuy2fi")) returned 1 [0071.063] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0071.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0071.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.063] GetFileType (hFile=0x2b8) returned 0x1 [0071.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0071.063] GetFileType (hFile=0x2b8) returned 0x1 [0071.063] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x165510 [0071.063] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1463558, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x165506 [0071.063] ReadFile (in: hFile=0x2b8, lpBuffer=0x26959d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26959d0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0071.089] CloseHandle (hObject=0x2b8) returned 1 [0071.091] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0071.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0071.091] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), fInfoLevelId=0x0, lpFileInformation=0x2703fb0 | out: lpFileInformation=0x2703fb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510)) returned 1 [0071.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0071.152] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0071.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0071.152] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.152] GetFileType (hFile=0x2b8) returned 0x1 [0071.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0071.152] GetFileType (hFile=0x2b8) returned 0x1 [0071.152] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0071.168] CloseHandle (hObject=0x2b8) returned 1 [0071.170] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0071.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0071.170] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.171] GetFileType (hFile=0x2b8) returned 0x1 [0071.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0071.171] GetFileType (hFile=0x2b8) returned 0x1 [0071.264] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0071.266] CloseHandle (hObject=0x2b8) returned 1 [0071.267] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0071.267] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0071.267] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0071.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0071.267] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.267] GetFileType (hFile=0x2b8) returned 0x1 [0071.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0071.267] GetFileType (hFile=0x2b8) returned 0x1 [0071.267] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x165510 [0071.267] WriteFile (in: hFile=0x2b8, lpBuffer=0x27106d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x27106d8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0071.268] CloseHandle (hObject=0x2b8) returned 1 [0071.268] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", lpFilePart=0x0) returned 0x4a [0071.268] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\UGlkR2VuWC5kbGw=", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\UGlkR2VuWC5kbGw=", lpFilePart=0x0) returned 0x4f [0071.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0071.268] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0xd24eb160, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x16551a)) returned 1 [0071.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0071.268] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\UGlkR2VuWC5kbGw=" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\uglkr2vuwc5kbgw=")) returned 1 [0071.269] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0071.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0071.269] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.269] GetFileType (hFile=0x2b8) returned 0x1 [0071.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0071.269] GetFileType (hFile=0x2b8) returned 0x1 [0071.269] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xaec3a [0071.269] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=715824, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xaec30 [0071.269] ReadFile (in: hFile=0x2b8, lpBuffer=0x2711b20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2711b20*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0071.271] CloseHandle (hObject=0x2b8) returned 1 [0071.273] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0071.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0071.273] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x277c7b8 | out: lpFileInformation=0x277c7b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a)) returned 1 [0071.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0071.273] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0071.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0071.273] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.274] GetFileType (hFile=0x2b8) returned 0x1 [0071.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0071.274] GetFileType (hFile=0x2b8) returned 0x1 [0071.274] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xaec3a [0071.304] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb38*=0xaec3a, lpOverlapped=0x0) returned 1 [0071.316] CloseHandle (hObject=0x2b8) returned 1 [0071.421] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0071.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0071.421] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.427] GetFileType (hFile=0x2b8) returned 0x1 [0071.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0071.427] GetFileType (hFile=0x2b8) returned 0x1 [0071.427] WriteFile (in: hFile=0x2b8, lpBuffer=0x127105e0*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x127105e0*, lpNumberOfBytesWritten=0x1c9aebc8*=0xaec40, lpOverlapped=0x0) returned 1 [0071.438] CloseHandle (hObject=0x2b8) returned 1 [0071.439] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0071.439] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0071.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0071.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.439] GetFileType (hFile=0x2b8) returned 0x1 [0071.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0071.439] GetFileType (hFile=0x2b8) returned 0x1 [0071.439] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xaec40 [0071.440] WriteFile (in: hFile=0x2b8, lpBuffer=0x267d088*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x267d088*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0071.440] CloseHandle (hObject=0x2b8) returned 1 [0071.440] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpFilePart=0x0) returned 0x57 [0071.440] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\cGtleWNvbmZpZy1vZmZpY2UueHJtLW1z", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\cGtleWNvbmZpZy1vZmZpY2UueHJtLW1z", lpFilePart=0x0) returned 0x5f [0071.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0071.440] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0xd268e080, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xaec4a)) returned 1 [0071.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0071.440] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\cGtleWNvbmZpZy1vZmZpY2UueHJtLW1z" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\cgtlewnvbmzpzy1vzmzpy2uuehjtlw1z")) returned 1 [0071.441] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0071.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0071.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.464] GetFileType (hFile=0x2b8) returned 0x1 [0071.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0071.464] GetFileType (hFile=0x2b8) returned 0x1 [0071.464] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x150578 [0071.464] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1377646, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x15056e [0071.464] ReadFile (in: hFile=0x2b8, lpBuffer=0x267e4f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267e4f0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0071.466] CloseHandle (hObject=0x2b8) returned 1 [0071.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x117d8) returned 0x0 [0071.472] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0071.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0071.472] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), fInfoLevelId=0x0, lpFileInformation=0x26e9268 | out: lpFileInformation=0x26e9268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578)) returned 1 [0071.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0071.475] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0071.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0071.475] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.475] GetFileType (hFile=0x2b8) returned 0x1 [0071.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0071.475] GetFileType (hFile=0x2b8) returned 0x1 [0071.475] ReadFile (in: hFile=0x2b8, lpBuffer=0x129cb748, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x129cb748*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0071.502] CloseHandle (hObject=0x2b8) returned 1 [0071.505] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0071.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0071.505] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0071.505] GetFileType (hFile=0x2b8) returned 0x1 [0071.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0071.505] GetFileType (hFile=0x2b8) returned 0x1 [0072.219] WriteFile (in: hFile=0x2b8, lpBuffer=0x12acb780*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12acb780*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0072.221] CloseHandle (hObject=0x2b8) returned 1 [0072.222] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0072.223] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0072.224] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0072.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0072.224] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.224] GetFileType (hFile=0x2b8) returned 0x1 [0072.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0072.224] GetFileType (hFile=0x2b8) returned 0x1 [0072.224] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0x150578 [0072.224] WriteFile (in: hFile=0x2b8, lpBuffer=0x267cd30*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x267cd30*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0072.225] CloseHandle (hObject=0x2b8) returned 1 [0072.225] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", lpFilePart=0x0) returned 0x48 [0072.225] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\c2V0dXAuZXhl", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\c2V0dXAuZXhl", lpFilePart=0x0) returned 0x4b [0072.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0072.225] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0xd2dfe540, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x150582)) returned 1 [0072.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0072.225] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\c2V0dXAuZXhl" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\c2v0dxauzxhl")) returned 1 [0072.226] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0072.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0072.226] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.226] GetFileType (hFile=0x2b8) returned 0x1 [0072.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0072.226] GetFileType (hFile=0x2b8) returned 0x1 [0072.226] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x5061 [0072.226] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=20567, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x5057 [0072.226] ReadFile (in: hFile=0x2b8, lpBuffer=0x267e130, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x267e130*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0072.228] CloseHandle (hObject=0x2b8) returned 1 [0072.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11ad0) returned 0x0 [0072.239] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0072.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0072.239] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2714658 | out: lpFileInformation=0x2714658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061)) returned 1 [0072.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0072.239] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0072.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0072.240] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.240] GetFileType (hFile=0x2b8) returned 0x1 [0072.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0072.240] GetFileType (hFile=0x2b8) returned 0x1 [0072.240] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x5061 [0072.240] ReadFile (in: hFile=0x2b8, lpBuffer=0x2714910, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2714910*, lpNumberOfBytesRead=0x1c9aeb38*=0x5061, lpOverlapped=0x0) returned 1 [0072.244] CloseHandle (hObject=0x2b8) returned 1 [0072.306] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0072.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0072.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.307] GetFileType (hFile=0x2b8) returned 0x1 [0072.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0072.307] GetFileType (hFile=0x2b8) returned 0x1 [0072.307] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a7268*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27a7268*, lpNumberOfBytesWritten=0x1c9aebc8*=0x5070, lpOverlapped=0x0) returned 1 [0072.309] CloseHandle (hObject=0x2b8) returned 1 [0072.309] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0072.309] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0072.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0072.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.309] GetFileType (hFile=0x2b8) returned 0x1 [0072.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0072.309] GetFileType (hFile=0x2b8) returned 0x1 [0072.309] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x5070 [0072.309] WriteFile (in: hFile=0x2b8, lpBuffer=0x27ad268*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27ad268*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0072.310] CloseHandle (hObject=0x2b8) returned 1 [0072.310] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0072.310] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\U2V0dXAueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\U2V0dXAueG1s", lpFilePart=0x0) returned 0x4b [0072.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0072.310] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0xd2ee2d80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x507a)) returned 1 [0072.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0072.310] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\U2V0dXAueG1s" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\u2v0dxaueg1s")) returned 1 [0072.310] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpFilePart=0x0) returned 0x4b [0072.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0072.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.311] GetFileType (hFile=0x2b8) returned 0x1 [0072.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0072.311] GetFileType (hFile=0x2b8) returned 0x1 [0072.311] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xb9fa2f7 [0072.312] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=195011309, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xb9fa2ed [0072.312] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ae670, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27ae670*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0072.316] CloseHandle (hObject=0x2b8) returned 1 [0072.335] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpFilePart=0x0) returned 0x4b [0072.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0072.335] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), fInfoLevelId=0x0, lpFileInformation=0x26f0cb0 | out: lpFileInformation=0x26f0cb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7)) returned 1 [0072.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0072.339] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpFilePart=0x0) returned 0x4b [0072.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0072.339] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.339] GetFileType (hFile=0x2b8) returned 0x1 [0072.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0072.339] GetFileType (hFile=0x2b8) returned 0x1 [0072.340] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0072.350] CloseHandle (hObject=0x2b8) returned 1 [0072.356] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpFilePart=0x0) returned 0x4b [0072.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0072.356] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.356] GetFileType (hFile=0x2b8) returned 0x1 [0072.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0072.356] GetFileType (hFile=0x2b8) returned 0x1 [0072.867] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0072.872] CloseHandle (hObject=0x2b8) returned 1 [0072.873] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpFilePart=0x0) returned 0x4b [0072.874] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpFilePart=0x0) returned 0x4b [0072.874] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpFilePart=0x0) returned 0x4b [0072.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0072.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.874] GetFileType (hFile=0x2b8) returned 0x1 [0072.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0072.874] GetFileType (hFile=0x2b8) returned 0x1 [0072.874] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0xb9fa2f7 [0072.875] WriteFile (in: hFile=0x2b8, lpBuffer=0x26a41e0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x26a41e0*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0072.875] CloseHandle (hObject=0x2b8) returned 1 [0072.875] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpFilePart=0x0) returned 0x4b [0072.875] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VmlzaW9yV1cuY2Fi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VmlzaW9yV1cuY2Fi", lpFilePart=0x0) returned 0x4f [0072.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0072.876] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0xd343df00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa301)) returned 1 [0072.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0072.876] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VmlzaW9yV1cuY2Fi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\vmlzaw9yv1cuy2fi")) returned 1 [0072.876] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpFilePart=0x0) returned 0x4b [0072.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0072.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.877] GetFileType (hFile=0x2b8) returned 0x1 [0072.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0072.877] GetFileType (hFile=0x2b8) returned 0x1 [0072.877] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xb80800 [0072.877] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=12060662, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xb807f6 [0072.877] ReadFile (in: hFile=0x2b8, lpBuffer=0x26b4ff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26b4ff0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0072.879] CloseHandle (hObject=0x2b8) returned 1 [0072.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0072.886] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpFilePart=0x0) returned 0x4b [0072.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0072.886] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), fInfoLevelId=0x0, lpFileInformation=0x2721690 | out: lpFileInformation=0x2721690*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800)) returned 1 [0072.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0072.889] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpFilePart=0x0) returned 0x4b [0072.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0072.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0072.889] GetFileType (hFile=0x2b8) returned 0x1 [0072.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0072.889] GetFileType (hFile=0x2b8) returned 0x1 [0072.889] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61a48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aeb18, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesRead=0x1c9aeb18*=0x100000, lpOverlapped=0x0) returned 1 [0073.246] CloseHandle (hObject=0x2b8) returned 1 [0073.252] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpFilePart=0x0) returned 0x4b [0073.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0073.252] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.252] GetFileType (hFile=0x2b8) returned 0x1 [0073.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0073.253] GetFileType (hFile=0x2b8) returned 0x1 [0073.408] WriteFile (in: hFile=0x2b8, lpBuffer=0x12661968*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aeb78, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesWritten=0x1c9aeb78*=0x100000, lpOverlapped=0x0) returned 1 [0073.411] CloseHandle (hObject=0x2b8) returned 1 [0073.411] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpFilePart=0x0) returned 0x4b [0073.412] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpFilePart=0x0) returned 0x4b [0073.412] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpFilePart=0x0) returned 0x4b [0073.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea80) returned 1 [0073.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.412] GetFileType (hFile=0x2b8) returned 0x1 [0073.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0073.412] GetFileType (hFile=0x2b8) returned 0x1 [0073.412] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea68*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea68*=0) returned 0xb80800 [0073.413] WriteFile (in: hFile=0x2b8, lpBuffer=0x2699270*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2699270*, lpNumberOfBytesWritten=0x1c9aeb28*=0xa, lpOverlapped=0x0) returned 1 [0073.413] CloseHandle (hObject=0x2b8) returned 1 [0073.413] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", lpFilePart=0x0) returned 0x4b [0073.413] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VmlzaW9yV1cubXNp", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VmlzaW9yV1cubXNp", lpFilePart=0x0) returned 0x4f [0073.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0073.413] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb90 | out: lpFileInformation=0x1c9aeb90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0xd37a9ea0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xb8080a)) returned 1 [0073.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0073.413] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VmlzaW9yV1cubXNp" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\vmlzaw9yv1cubxnp")) returned 1 [0073.414] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0073.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0073.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.414] GetFileType (hFile=0x2b8) returned 0x1 [0073.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0073.414] GetFileType (hFile=0x2b8) returned 0x1 [0073.414] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2213 [0073.414] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=8713, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2209 [0073.414] ReadFile (in: hFile=0x2b8, lpBuffer=0x269a688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x269a688*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0073.416] CloseHandle (hObject=0x2b8) returned 1 [0073.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d50) returned 0x0 [0073.429] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0073.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0073.429] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x26b8618 | out: lpFileInformation=0x26b8618*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213)) returned 1 [0073.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0073.430] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0073.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0073.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.430] GetFileType (hFile=0x2b8) returned 0x1 [0073.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0073.430] GetFileType (hFile=0x2b8) returned 0x1 [0073.430] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x2213 [0073.430] ReadFile (in: hFile=0x2b8, lpBuffer=0x26b88e0, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26b88e0*, lpNumberOfBytesRead=0x1c9aeb38*=0x2213, lpOverlapped=0x0) returned 1 [0073.431] CloseHandle (hObject=0x2b8) returned 1 [0073.469] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0073.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0073.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.470] GetFileType (hFile=0x2b8) returned 0x1 [0073.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0073.470] GetFileType (hFile=0x2b8) returned 0x1 [0073.470] WriteFile (in: hFile=0x2b8, lpBuffer=0x273a180*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x273a180*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2220, lpOverlapped=0x0) returned 1 [0073.471] CloseHandle (hObject=0x2b8) returned 1 [0073.472] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0073.472] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0073.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0073.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.472] GetFileType (hFile=0x2b8) returned 0x1 [0073.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0073.472] GetFileType (hFile=0x2b8) returned 0x1 [0073.472] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2220 [0073.472] WriteFile (in: hFile=0x2b8, lpBuffer=0x273d350*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x273d350*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0073.472] CloseHandle (hObject=0x2b8) returned 1 [0073.473] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0073.473] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VmlzaW9yV1cueG1s", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VmlzaW9yV1cueG1s", lpFilePart=0x0) returned 0x4f [0073.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0073.473] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0xd381c2c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x222a)) returned 1 [0073.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0073.473] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VmlzaW9yV1cueG1s" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\vmlzaw9yv1cueg1s")) returned 1 [0073.474] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\README_3728769.txt", lpFilePart=0x0) returned 0x51 [0073.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0073.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.474] GetFileType (hFile=0x2b8) returned 0x1 [0073.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0073.474] GetFileType (hFile=0x2b8) returned 0x1 [0073.474] WriteFile (in: hFile=0x2b8, lpBuffer=0x2741698*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2741698*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0073.475] CloseHandle (hObject=0x2b8) returned 1 [0073.476] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\README_3728769.txt", lpFilePart=0x0) returned 0x28 [0073.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0073.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\README_3728769.txt" (normalized: "c:\\msocache\\all users\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.476] GetFileType (hFile=0x2b8) returned 0x1 [0073.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0073.476] GetFileType (hFile=0x2b8) returned 0x1 [0073.476] WriteFile (in: hFile=0x2b8, lpBuffer=0x2745700*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x2745700*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0073.477] CloseHandle (hObject=0x2b8) returned 1 [0073.477] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\README_3728769.txt", lpFilePart=0x0) returned 0x1e [0073.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebf0) returned 1 [0073.477] CreateFileW (lpFileName="C:\\MSOCache\\README_3728769.txt" (normalized: "c:\\msocache\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.478] GetFileType (hFile=0x2b8) returned 0x1 [0073.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.478] GetFileType (hFile=0x2b8) returned 0x1 [0073.478] WriteFile (in: hFile=0x2b8, lpBuffer=0x2749738*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aec38, lpOverlapped=0x0 | out: lpBuffer=0x2749738*, lpNumberOfBytesWritten=0x1c9aec38*=0x5b3, lpOverlapped=0x0) returned 1 [0073.479] CloseHandle (hObject=0x2b8) returned 1 [0073.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.479] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0073.479] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0073.479] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.480] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.480] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0073.480] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0073.480] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.480] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0073.480] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0073.480] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.481] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.481] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0073.481] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.481] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0073.481] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0073.481] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0073.481] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.481] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.482] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.482] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0073.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0073.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0073.482] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0073.482] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0073.482] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.482] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.482] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.483] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0073.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0073.483] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\README_3728769.txt", lpFilePart=0x0) returned 0x24 [0073.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0073.483] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\README_3728769.txt" (normalized: "c:\\perflogs\\admin\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.484] GetFileType (hFile=0x2b8) returned 0x1 [0073.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0073.484] GetFileType (hFile=0x2b8) returned 0x1 [0073.484] WriteFile (in: hFile=0x2b8, lpBuffer=0x2750ac8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x2750ac8*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0073.485] CloseHandle (hObject=0x2b8) returned 1 [0073.485] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\README_3728769.txt", lpFilePart=0x0) returned 0x1e [0073.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebf0) returned 1 [0073.485] CreateFileW (lpFileName="C:\\PerfLogs\\README_3728769.txt" (normalized: "c:\\perflogs\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.486] GetFileType (hFile=0x2b8) returned 0x1 [0073.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.486] GetFileType (hFile=0x2b8) returned 0x1 [0073.486] WriteFile (in: hFile=0x2b8, lpBuffer=0x2754b00*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aec38, lpOverlapped=0x0 | out: lpBuffer=0x2754b00*, lpNumberOfBytesWritten=0x1c9aec38*=0x5b3, lpOverlapped=0x0) returned 1 [0073.487] CloseHandle (hObject=0x2b8) returned 1 [0073.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.487] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0073.487] GetFullPathNameW (in: lpFileName="C:\\Program Files\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\", lpFilePart=0x0) returned 0x11 [0073.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.487] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.487] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0073.488] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.488] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0073.488] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdaab0080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaab0080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0073.488] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0073.488] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0073.488] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdaa17b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa17b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0073.488] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd93ece20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd93ece20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0073.489] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9e30d00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9e30d00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0073.489] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda319a60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda319a60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0073.489] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbc18160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbc18160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0073.489] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0073.490] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd93c6cc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd93c6cc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0073.490] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd964e420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd964e420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0073.490] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdaa17b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa17b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0073.490] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0073.490] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda319a60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda319a60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0073.490] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda9cb840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda9cb840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0073.490] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaa3dc60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa3dc60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0073.491] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda959420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda959420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0073.491] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda959420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda959420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0073.491] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.491] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0073.491] GetFullPathNameW (in: lpFileName="C:\\Program Files\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\", lpFilePart=0x0) returned 0x11 [0073.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.491] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.492] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0073.492] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.492] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0073.492] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdaab0080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaab0080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0073.492] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0073.492] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0073.492] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdaa17b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa17b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0073.493] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd93ece20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd93ece20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0073.493] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9e30d00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9e30d00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0073.493] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda319a60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda319a60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0073.493] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbc18160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbc18160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0073.493] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0073.493] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd93c6cc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd93c6cc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0073.493] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd964e420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd964e420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0073.493] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdaa17b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa17b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0073.494] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0073.494] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda319a60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda319a60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0073.494] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda9cb840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda9cb840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0073.494] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaa3dc60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa3dc60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0073.494] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda959420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda959420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0073.494] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.494] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.495] GetFullPathNameW (in: lpFileName="C:\\Program Files\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\README_3728769.txt", lpFilePart=0x0) returned 0x23 [0073.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebf0) returned 1 [0073.495] CreateFileW (lpFileName="C:\\Program Files\\README_3728769.txt" (normalized: "c:\\program files\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.495] GetFileType (hFile=0x2b8) returned 0x1 [0073.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.495] GetFileType (hFile=0x2b8) returned 0x1 [0073.495] WriteFile (in: hFile=0x2b8, lpBuffer=0x275e310*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aec38, lpOverlapped=0x0 | out: lpBuffer=0x275e310*, lpNumberOfBytesWritten=0x1c9aec38*=0x5b3, lpOverlapped=0x0) returned 1 [0073.496] CloseHandle (hObject=0x2b8) returned 1 [0073.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.496] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0073.496] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\", lpFilePart=0x0) returned 0x17 [0073.496] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.496] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.497] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda9f19a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda9f19a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0073.497] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd93a0b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd93a0b60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0073.497] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.497] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdab48600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdab48600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0073.497] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda8027c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda8027c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0073.497] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdac52fa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdac52fa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0073.498] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbc18160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbc18160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0073.498] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdaab0080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaab0080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0073.498] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd94390e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd94390e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visual Studio 8", cAlternateFileName="MICROS~3")) returned 1 [0073.498] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd96282c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd96282c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0073.498] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdacc53c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdacc53c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0073.498] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdaa63dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa63dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~2")) returned 1 [0073.498] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553ced90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0073.499] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0073.499] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xdaa89f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa89f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0073.499] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd964e420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd964e420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0073.499] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0073.499] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaa63dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa63dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0073.499] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0073.500] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda8027c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda8027c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0073.500] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaa17b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa17b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0073.500] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaa89f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa89f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0073.500] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaa89f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa89f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0073.500] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.500] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0073.500] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\", lpFilePart=0x0) returned 0x17 [0073.501] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.501] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.501] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda9f19a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda9f19a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0073.501] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd93a0b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd93a0b60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0073.501] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.501] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdab48600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdab48600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0073.501] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xda8027c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda8027c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0073.501] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdac52fa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdac52fa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0073.502] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbc18160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbc18160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0073.502] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdaab0080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaab0080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0073.502] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd94390e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd94390e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visual Studio 8", cAlternateFileName="MICROS~3")) returned 1 [0073.502] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd96282c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd96282c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0073.502] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdacc53c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdacc53c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0073.502] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdaa63dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa63dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~2")) returned 1 [0073.502] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553ced90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0073.502] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0073.503] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xdaa89f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa89f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0073.503] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd964e420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd964e420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0073.503] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0073.503] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaa63dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa63dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0073.503] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0073.503] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xda8027c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda8027c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0073.503] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaa17b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa17b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0073.504] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdaa89f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa89f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0073.504] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.504] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.504] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\README_3728769.txt", lpFilePart=0x0) returned 0x29 [0073.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebf0) returned 1 [0073.504] CreateFileW (lpFileName="C:\\Program Files (x86)\\README_3728769.txt" (normalized: "c:\\program files (x86)\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.504] GetFileType (hFile=0x2b8) returned 0x1 [0073.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.505] GetFileType (hFile=0x2b8) returned 0x1 [0073.505] WriteFile (in: hFile=0x2b8, lpBuffer=0x2768290*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aec38, lpOverlapped=0x0 | out: lpBuffer=0x2768290*, lpNumberOfBytesWritten=0x1c9aec38*=0x5b3, lpOverlapped=0x0) returned 1 [0073.506] CloseHandle (hObject=0x2b8) returned 1 [0073.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0073.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf [0073.506] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.507] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.507] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0073.507] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0073.507] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0073.507] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0073.507] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0073.508] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0073.508] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0073.508] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0073.508] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0073.508] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0073.508] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0073.508] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0073.509] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0073.509] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0073.509] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.509] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0073.509] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf [0073.509] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.509] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.509] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0073.509] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0073.509] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0073.509] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0073.509] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0073.510] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0073.510] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0073.510] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0073.510] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0073.510] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0073.510] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0073.510] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0073.510] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0073.510] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.510] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.510] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\README_3728769.txt", lpFilePart=0x0) returned 0x21 [0073.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebf0) returned 1 [0073.510] CreateFileW (lpFileName="C:\\ProgramData\\README_3728769.txt" (normalized: "c:\\programdata\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.527] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0073.527] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc [0073.527] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.528] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.528] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1 [0073.528] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 0 [0073.528] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.528] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0073.528] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc [0073.528] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.528] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.528] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1 [0073.528] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.528] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0073.529] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpFilePart=0x0) returned 0x30 [0073.529] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpFilePart=0x0) returned 0x31 [0073.529] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.529] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.529] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0073.529] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0073.529] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.529] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0073.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0073.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0073.529] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpFilePart=0x0) returned 0x30 [0073.529] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpFilePart=0x0) returned 0x31 [0073.529] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.530] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.530] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0073.530] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0073.530] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 0 [0073.530] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0073.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0073.530] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", lpFilePart=0x0) returned 0x39 [0073.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0073.530] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0073.530] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x306000 [0073.530] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=3170294, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0x305ff6 [0073.530] ReadFile (in: hFile=0x2b8, lpBuffer=0x2774f80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2774f80*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0073.534] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", lpFilePart=0x0) returned 0x39 [0073.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0073.534] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), fInfoLevelId=0x0, lpFileInformation=0x27e1230 | out: lpFileInformation=0x27e1230*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000)) returned 1 [0073.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0073.539] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", lpFilePart=0x0) returned 0x39 [0073.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0073.539] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0073.539] ReadFile (in: hFile=0x2b8, lpBuffer=0x127619a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aebb8, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesRead=0x1c9aebb8*=0x100000, lpOverlapped=0x0) returned 1 [0073.555] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", lpFilePart=0x0) returned 0x39 [0073.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0073.555] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0073.671] WriteFile (in: hFile=0x2b8, lpBuffer=0x12961a10*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aec18, lpOverlapped=0x0 | out: lpBuffer=0x12961a10*, lpNumberOfBytesWritten=0x1c9aec18*=0x100000, lpOverlapped=0x0) returned 1 [0073.674] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", lpFilePart=0x0) returned 0x39 [0073.675] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", lpFilePart=0x0) returned 0x39 [0073.676] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", lpFilePart=0x0) returned 0x39 [0073.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0073.677] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.677] GetFileType (hFile=0x2b8) returned 0x1 [0073.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0073.677] GetFileType (hFile=0x2b8) returned 0x1 [0073.677] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb08*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb08*=0) returned 0x306000 [0073.677] WriteFile (in: hFile=0x2b8, lpBuffer=0x2691388*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2691388*, lpNumberOfBytesWritten=0x1c9aebc8*=0xa, lpOverlapped=0x0) returned 1 [0073.677] CloseHandle (hObject=0x2b8) returned 1 [0073.677] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", lpFilePart=0x0) returned 0x39 [0073.677] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Ym9vdC5zZGk=", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Ym9vdC5zZGk=", lpFilePart=0x0) returned 0x3d [0073.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0073.678] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec30 | out: lpFileInformation=0x1c9aec30*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd3a31600, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x30600a)) returned 1 [0073.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0073.678] MoveFileW (lpExistingFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Ym9vdC5zZGk=" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\ym9vdc5zzgk=")) returned 1 [0073.678] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", lpFilePart=0x0) returned 0x3a [0073.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0073.678] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.680] GetFileType (hFile=0x2b8) returned 0x1 [0073.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0073.680] GetFileType (hFile=0x2b8) returned 0x1 [0073.680] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0xa160012 [0073.680] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=169213960, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0xa160008 [0073.681] ReadFile (in: hFile=0x2b8, lpBuffer=0x2692718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x2692718*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0073.685] CloseHandle (hObject=0x2b8) returned 1 [0073.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11d50) returned 0x0 [0073.696] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", lpFilePart=0x0) returned 0x3a [0073.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0073.696] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), fInfoLevelId=0x0, lpFileInformation=0x26c63e8 | out: lpFileInformation=0x26c63e8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012)) returned 1 [0073.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0073.698] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", lpFilePart=0x0) returned 0x3a [0073.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0073.699] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.699] GetFileType (hFile=0x2b8) returned 0x1 [0073.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0073.699] GetFileType (hFile=0x2b8) returned 0x1 [0073.699] ReadFile (in: hFile=0x2b8, lpBuffer=0x12a61a48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x1c9aebb8, lpOverlapped=0x0 | out: lpBuffer=0x12a61a48*, lpNumberOfBytesRead=0x1c9aebb8*=0x100000, lpOverlapped=0x0) returned 1 [0073.719] CloseHandle (hObject=0x2b8) returned 1 [0073.725] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", lpFilePart=0x0) returned 0x3a [0073.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0073.725] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.725] GetFileType (hFile=0x2b8) returned 0x1 [0073.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0073.725] GetFileType (hFile=0x2b8) returned 0x1 [0073.837] WriteFile (in: hFile=0x2b8, lpBuffer=0x127619a0*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x1c9aec18, lpOverlapped=0x0 | out: lpBuffer=0x127619a0*, lpNumberOfBytesWritten=0x1c9aec18*=0x100000, lpOverlapped=0x0) returned 1 [0073.840] CloseHandle (hObject=0x2b8) returned 1 [0073.840] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", lpFilePart=0x0) returned 0x3a [0073.841] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", lpFilePart=0x0) returned 0x3a [0073.841] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", lpFilePart=0x0) returned 0x3a [0073.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb20) returned 1 [0073.841] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.841] GetFileType (hFile=0x2b8) returned 0x1 [0073.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0073.841] GetFileType (hFile=0x2b8) returned 0x1 [0073.841] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb08*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb08*=0) returned 0xa160012 [0073.841] WriteFile (in: hFile=0x2b8, lpBuffer=0x2691fe8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2691fe8*, lpNumberOfBytesWritten=0x1c9aebc8*=0xa, lpOverlapped=0x0) returned 1 [0073.841] CloseHandle (hObject=0x2b8) returned 1 [0073.842] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", lpFilePart=0x0) returned 0x3a [0073.842] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\V2lucmUud2lt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\V2lucmUud2lt", lpFilePart=0x0) returned 0x3d [0073.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0073.842] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec30 | out: lpFileInformation=0x1c9aec30*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3bae3c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xa16001c)) returned 1 [0073.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0073.842] MoveFileW (lpExistingFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\V2lucmUud2lt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\v2lucmuud2lt")) returned 1 [0073.844] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae670, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\README_3728769.txt", lpFilePart=0x0) returned 0x43 [0073.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb50) returned 1 [0073.844] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\README_3728769.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.847] GetFileType (hFile=0x2b8) returned 0x1 [0073.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0073.847] GetFileType (hFile=0x2b8) returned 0x1 [0073.847] WriteFile (in: hFile=0x2b8, lpBuffer=0x2696290*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeb98, lpOverlapped=0x0 | out: lpBuffer=0x2696290*, lpNumberOfBytesWritten=0x1c9aeb98*=0x5b3, lpOverlapped=0x0) returned 1 [0073.849] CloseHandle (hObject=0x2b8) returned 1 [0073.850] GetFullPathNameW (in: lpFileName="C:\\Recovery\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae710, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\README_3728769.txt", lpFilePart=0x0) returned 0x1e [0073.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebf0) returned 1 [0073.850] CreateFileW (lpFileName="C:\\Recovery\\README_3728769.txt" (normalized: "c:\\recovery\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.851] GetFileType (hFile=0x2b8) returned 0x1 [0073.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.851] GetFileType (hFile=0x2b8) returned 0x1 [0073.851] WriteFile (in: hFile=0x2b8, lpBuffer=0x269a2c8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aec38, lpOverlapped=0x0 | out: lpBuffer=0x269a2c8*, lpNumberOfBytesWritten=0x1c9aec38*=0x5b3, lpOverlapped=0x0) returned 1 [0073.852] CloseHandle (hObject=0x2b8) returned 1 [0073.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.852] GetFullPathNameW (in: lpFileName="C:\\System Volume Information", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information", lpFilePart=0x0) returned 0x1c [0073.852] GetFullPathNameW (in: lpFileName="C:\\System Volume Information\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information\\", lpFilePart=0x0) returned 0x1d [0073.852] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0073.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aecc0) returned 1 [0073.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.856] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0073.856] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0073.856] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.856] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.856] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0073.856] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0073.856] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0073.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0073.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0073.857] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0073.857] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aed90) returned 1 [0073.858] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x1c9ae880, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0073.858] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x1c9ae820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0073.858] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x1c9aea30 | out: lpFindFileData=0x1c9aea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.858] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.858] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0073.859] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0073.859] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0073.859] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0073.859] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.859] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0073.859] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9aea80 | out: lpFindFileData=0x1c9aea80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.859] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aece0) returned 1 [0073.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeca0) returned 1 [0073.859] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14 [0073.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aece0) returned 1 [0073.860] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.860] GetFileType (hFile=0x2b8) returned 0x1 [0073.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec50) returned 1 [0073.860] GetFileType (hFile=0x2b8) returned 0x1 [0073.860] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeea8 | out: lpFileSizeHigh=0x1c9aeea8*=0x0) returned 0xae [0073.860] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=164, lpDistanceToMoveHigh=0x1c9aee08*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aee08*=0) returned 0xa4 [0073.860] ReadFile (in: hFile=0x2b8, lpBuffer=0x269e7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aedd8, lpOverlapped=0x0 | out: lpBuffer=0x269e7a0*, lpNumberOfBytesRead=0x1c9aedd8*=0xa, lpOverlapped=0x0) returned 1 [0073.861] CloseHandle (hObject=0x2b8) returned 1 [0073.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aed00 | out: SystemInformation=0x12641930, ResultLength=0x1c9aed00*=0x11d00) returned 0x0 [0073.870] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14 [0073.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0073.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x270aee8 | out: lpFileInformation=0x270aee8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae)) returned 1 [0073.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aecb0) returned 1 [0073.870] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14 [0073.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0073.870] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.871] GetFileType (hFile=0x2b8) returned 0x1 [0073.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb20) returned 1 [0073.871] GetFileType (hFile=0x2b8) returned 0x1 [0073.871] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed48 | out: lpFileSizeHigh=0x1c9aed48*=0x0) returned 0xae [0073.871] ReadFile (in: hFile=0x2b8, lpBuffer=0x270b198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec78, lpOverlapped=0x0 | out: lpBuffer=0x270b198*, lpNumberOfBytesRead=0x1c9aec78*=0xae, lpOverlapped=0x0) returned 1 [0073.871] CloseHandle (hObject=0x2b8) returned 1 [0073.902] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14 [0073.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebe0) returned 1 [0073.902] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0073.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab520) returned 1 [0073.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0073.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0073.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x1e [0073.904] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.905] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.905] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0073.905] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0073.905] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0073.905] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0073.905] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb43ea5e0, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xb43ea5e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0073.906] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8fe8900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd8fe8900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0073.906] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0073.906] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0073.906] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0073.906] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0073.906] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9034bc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9034bc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0073.907] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0073.907] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0073.907] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3afd80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3afd80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0073.907] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f389c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0073.907] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0073.907] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0073.907] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0073.907] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0073.908] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0073.908] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd91d7ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd91d7ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0073.908] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0073.908] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0073.908] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0073.908] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0073.908] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0073.909] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0073.909] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0073.909] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd91656c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd91656c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0073.909] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd91656c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd91656c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0073.909] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0073.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0073.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aecf0) returned 1 [0073.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x1c9ae7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0073.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x1c9ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x1e [0073.910] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x1c9ae990 | out: lpFindFileData=0x1c9ae990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.910] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.910] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0073.912] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0073.912] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0073.912] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0073.912] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb43ea5e0, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xb43ea5e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8fe8900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd8fe8900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9034bc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9034bc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3afd80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3afd80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f389c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0073.915] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd91d7ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd91d7ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0073.915] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0073.915] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0073.915] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0073.915] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0073.915] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0073.915] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0073.915] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0073.916] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd91656c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd91656c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0073.916] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae9e0 | out: lpFindFileData=0x1c9ae9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.916] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec40) returned 1 [0073.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec00) returned 1 [0073.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", lpFilePart=0x0) returned 0x28 [0073.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0073.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0073.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab580) returned 1 [0073.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", lpFilePart=0x0) returned 0x2d [0073.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0073.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0073.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab580) returned 1 [0073.920] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", lpFilePart=0x0) returned 0x2d [0073.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0073.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0073.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab580) returned 1 [0073.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpFilePart=0x0) returned 0x55 [0073.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0073.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0073.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab580) returned 1 [0073.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpFilePart=0x0) returned 0x7a [0073.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0073.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0073.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab580) returned 1 [0073.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpFilePart=0x0) returned 0x7a [0073.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0073.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0073.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab580) returned 1 [0073.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", lpFilePart=0x0) returned 0x28 [0073.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec40) returned 1 [0073.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.929] GetFileType (hFile=0x2b8) returned 0x1 [0073.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aebb0) returned 1 [0073.929] GetFileType (hFile=0x2b8) returned 0x1 [0073.929] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aee08 | out: lpFileSizeHigh=0x1c9aee08*=0x0) returned 0x14 [0073.929] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=10, lpDistanceToMoveHigh=0x1c9aed68*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aed68*=0) returned 0xa [0073.929] ReadFile (in: hFile=0x2b8, lpBuffer=0x278ff68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aed38, lpOverlapped=0x0 | out: lpBuffer=0x278ff68*, lpNumberOfBytesRead=0x1c9aed38*=0xa, lpOverlapped=0x0) returned 1 [0073.930] CloseHandle (hObject=0x2b8) returned 1 [0073.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aec60 | out: SystemInformation=0x12641930, ResultLength=0x1c9aec60*=0x11d00) returned 0x0 [0073.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", nBufferLength=0x105, lpBuffer=0x1c9ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", lpFilePart=0x0) returned 0x28 [0073.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0073.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), fInfoLevelId=0x0, lpFileInformation=0x26d3160 | out: lpFileInformation=0x26d3160*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14)) returned 1 [0073.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aec10) returned 1 [0073.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", nBufferLength=0x105, lpBuffer=0x1c9ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", lpFilePart=0x0) returned 0x28 [0073.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0073.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0073.946] GetFileType (hFile=0x2b8) returned 0x1 [0073.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea80) returned 1 [0073.946] GetFileType (hFile=0x2b8) returned 0x1 [0073.946] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeca8 | out: lpFileSizeHigh=0x1c9aeca8*=0x0) returned 0x14 [0073.946] ReadFile (in: hFile=0x2b8, lpBuffer=0x26d33c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebd8, lpOverlapped=0x0 | out: lpBuffer=0x26d33c8*, lpNumberOfBytesRead=0x1c9aebd8*=0x14, lpOverlapped=0x0) returned 1 [0073.947] CloseHandle (hObject=0x2b8) returned 1 [0073.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", lpFilePart=0x0) returned 0x28 [0073.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0073.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0073.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab480) returned 1 [0073.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0073.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x25 [0073.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x26 [0073.985] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.985] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.985] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0073.985] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0073.985] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9270060, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9270060, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0073.985] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9270060, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9270060, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0073.986] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0073.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0073.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x25 [0073.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x26 [0073.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.987] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.987] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0073.987] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0073.987] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9270060, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9270060, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0073.987] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.987] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0073.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\README_3728769.txt", lpFilePart=0x0) returned 0x38 [0073.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0073.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0073.990] GetFileType (hFile=0x2b8) returned 0x1 [0073.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0073.990] GetFileType (hFile=0x2b8) returned 0x1 [0073.990] WriteFile (in: hFile=0x2b8, lpBuffer=0x2751058*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2751058*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0073.991] CloseHandle (hObject=0x2b8) returned 1 [0073.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0073.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data", lpFilePart=0x0) returned 0x2e [0073.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\", lpFilePart=0x0) returned 0x2f [0073.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0073.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb80) returned 1 [0073.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0073.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26 [0073.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27 [0073.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.994] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.994] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0073.994] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0073.995] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0073.995] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0073.995] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.995] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0073.995] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0073.995] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.995] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0073.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0073.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26 [0073.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27 [0073.996] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0073.996] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.997] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0073.997] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0073.997] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0073.997] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0073.997] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.997] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0073.997] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0073.998] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0073.998] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0073.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0073.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0073.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0073.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0073.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.009] GetFileType (hFile=0x2b8) returned 0x1 [0074.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.009] GetFileType (hFile=0x2b8) returned 0x1 [0074.009] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x49a [0074.009] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1168, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x490 [0074.009] ReadFile (in: hFile=0x2b8, lpBuffer=0x2756b58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2756b58*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.011] CloseHandle (hObject=0x2b8) returned 1 [0074.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0074.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.017] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), fInfoLevelId=0x0, lpFileInformation=0x27c2d78 | out: lpFileInformation=0x27c2d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a)) returned 1 [0074.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0074.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.017] GetFileType (hFile=0x2b8) returned 0x1 [0074.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.017] GetFileType (hFile=0x2b8) returned 0x1 [0074.017] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x49a [0074.017] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c34f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27c34f0*, lpNumberOfBytesRead=0x1c9aeb38*=0x49a, lpOverlapped=0x0) returned 1 [0074.018] CloseHandle (hObject=0x2b8) returned 1 [0074.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0074.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.049] GetFileType (hFile=0x2b8) returned 0x1 [0074.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.049] GetFileType (hFile=0x2b8) returned 0x1 [0074.049] WriteFile (in: hFile=0x2b8, lpBuffer=0x283c6e8*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x283c6e8*, lpNumberOfBytesWritten=0x1c9aea78*=0x4a0, lpOverlapped=0x0) returned 1 [0074.050] CloseHandle (hObject=0x2b8) returned 1 [0074.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0074.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0074.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.050] GetFileType (hFile=0x2b8) returned 0x1 [0074.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.050] GetFileType (hFile=0x2b8) returned 0x1 [0074.050] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4a0 [0074.050] WriteFile (in: hFile=0x2b8, lpBuffer=0x283e4f8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x283e4f8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.051] CloseHandle (hObject=0x2b8) returned 1 [0074.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0074.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\QWNsdmlobyBBU2xkamZsLmNvbnRhY3Q=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\QWNsdmlobyBBU2xkamZsLmNvbnRhY3Q=", lpFilePart=0x0) returned 0x47 [0074.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.051] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xd3d9d5a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4aa)) returned 1 [0074.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.051] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\QWNsdmlobyBBU2xkamZsLmNvbnRhY3Q=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\qwnsdmlobybbu2xkamzslmnvbnrhy3q=")) returned 1 [0074.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0074.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.052] GetFileType (hFile=0x2b8) returned 0x1 [0074.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.052] GetFileType (hFile=0x2b8) returned 0x1 [0074.052] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x10b1e [0074.052] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=68372, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x10b14 [0074.052] ReadFile (in: hFile=0x2b8, lpBuffer=0x283f8d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x283f8d8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.054] CloseHandle (hObject=0x2b8) returned 1 [0074.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0074.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.058] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), fInfoLevelId=0x0, lpFileInformation=0x28abaf8 | out: lpFileInformation=0x28abaf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e)) returned 1 [0074.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0074.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.058] GetFileType (hFile=0x2b8) returned 0x1 [0074.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.059] GetFileType (hFile=0x2b8) returned 0x1 [0074.059] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x10b1e [0074.059] ReadFile (in: hFile=0x2b8, lpBuffer=0x28abdb8, nNumberOfBytesToRead=0x10b1e, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28abdb8*, lpNumberOfBytesRead=0x1c9aeb38*=0x10b1e, lpOverlapped=0x0) returned 1 [0074.061] CloseHandle (hObject=0x2b8) returned 1 [0074.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0074.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.111] GetFileType (hFile=0x2b8) returned 0x1 [0074.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.111] GetFileType (hFile=0x2b8) returned 0x1 [0074.111] WriteFile (in: hFile=0x2b8, lpBuffer=0x278f1b0*, nNumberOfBytesToWrite=0x10b20, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x278f1b0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x10b20, lpOverlapped=0x0) returned 1 [0074.114] CloseHandle (hObject=0x2b8) returned 1 [0074.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0074.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0074.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.114] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.114] GetFileType (hFile=0x2b8) returned 0x1 [0074.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.114] GetFileType (hFile=0x2b8) returned 0x1 [0074.114] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x10b20 [0074.114] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a0c40*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27a0c40*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.115] CloseHandle (hObject=0x2b8) returned 1 [0074.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0074.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\QWRtaW5pc3RyYXRvci5jb250YWN0", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\QWRtaW5pc3RyYXRvci5jb250YWN0", lpFilePart=0x0) returned 0x43 [0074.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.115] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd3e5bc80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x10b2a)) returned 1 [0074.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.115] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\QWRtaW5pc3RyYXRvci5jb250YWN0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\qwrtaw5pc3ryyxrvci5jb250ywn0")) returned 1 [0074.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0074.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.116] GetFileType (hFile=0x2b8) returned 0x1 [0074.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.116] GetFileType (hFile=0x2b8) returned 0x1 [0074.116] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x493 [0074.116] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1161, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x489 [0074.116] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a2010, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27a2010*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.134] CloseHandle (hObject=0x2b8) returned 1 [0074.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0074.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), fInfoLevelId=0x0, lpFileInformation=0x280e230 | out: lpFileInformation=0x280e230*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493)) returned 1 [0074.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0074.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.140] GetFileType (hFile=0x2b8) returned 0x1 [0074.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.140] GetFileType (hFile=0x2b8) returned 0x1 [0074.140] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x493 [0074.140] ReadFile (in: hFile=0x2b8, lpBuffer=0x280e9a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x280e9a0*, lpNumberOfBytesRead=0x1c9aeb38*=0x493, lpOverlapped=0x0) returned 1 [0074.140] CloseHandle (hObject=0x2b8) returned 1 [0074.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0074.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.151] GetFileType (hFile=0x2b8) returned 0x1 [0074.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.151] GetFileType (hFile=0x2b8) returned 0x1 [0074.151] WriteFile (in: hFile=0x2b8, lpBuffer=0x2887e38*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x2887e38*, lpNumberOfBytesWritten=0x1c9aea78*=0x4a0, lpOverlapped=0x0) returned 1 [0074.152] CloseHandle (hObject=0x2b8) returned 1 [0074.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0074.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0074.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.153] GetFileType (hFile=0x2b8) returned 0x1 [0074.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.153] GetFileType (hFile=0x2b8) returned 0x1 [0074.153] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4a0 [0074.153] WriteFile (in: hFile=0x2b8, lpBuffer=0x2889c40*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2889c40*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.153] CloseHandle (hObject=0x2b8) returned 1 [0074.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0074.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\YXNkbGZrIHBvb3B2eS5jb250YWN0", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\YXNkbGZrIHBvb3B2eS5jb250YWN0", lpFilePart=0x0) returned 0x43 [0074.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.153] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xd3ea7f40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4aa)) returned 1 [0074.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.153] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\YXNkbGZrIHBvb3B2eS5jb250YWN0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\yxnkbgzrihbvb3b2es5jb250ywn0")) returned 1 [0074.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0074.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.155] GetFileType (hFile=0x2b8) returned 0x1 [0074.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.155] GetFileType (hFile=0x2b8) returned 0x1 [0074.155] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x499 [0074.155] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1167, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x48f [0074.155] ReadFile (in: hFile=0x2b8, lpBuffer=0x288b008, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x288b008*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.157] CloseHandle (hObject=0x2b8) returned 1 [0074.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0074.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.162] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), fInfoLevelId=0x0, lpFileInformation=0x28f7228 | out: lpFileInformation=0x28f7228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499)) returned 1 [0074.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0074.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.162] GetFileType (hFile=0x2b8) returned 0x1 [0074.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.162] GetFileType (hFile=0x2b8) returned 0x1 [0074.162] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x499 [0074.163] ReadFile (in: hFile=0x2b8, lpBuffer=0x28f7990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28f7990*, lpNumberOfBytesRead=0x1c9aeb38*=0x499, lpOverlapped=0x0) returned 1 [0074.163] CloseHandle (hObject=0x2b8) returned 1 [0074.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0074.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.214] GetFileType (hFile=0x2b8) returned 0x1 [0074.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.214] GetFileType (hFile=0x2b8) returned 0x1 [0074.215] WriteFile (in: hFile=0x2b8, lpBuffer=0x2732e40*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x2732e40*, lpNumberOfBytesWritten=0x1c9aea78*=0x4a0, lpOverlapped=0x0) returned 1 [0074.216] CloseHandle (hObject=0x2b8) returned 1 [0074.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0074.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0074.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.216] GetFileType (hFile=0x2b8) returned 0x1 [0074.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.216] GetFileType (hFile=0x2b8) returned 0x1 [0074.216] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4a0 [0074.216] WriteFile (in: hFile=0x2b8, lpBuffer=0x2734c30*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2734c30*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.217] CloseHandle (hObject=0x2b8) returned 1 [0074.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0074.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Y2h1Y3UgamFkbnZrLmNvbnRhY3Q=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Y2h1Y3UgamFkbnZrLmNvbnRhY3Q=", lpFilePart=0x0) returned 0x43 [0074.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xd3f404c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4aa)) returned 1 [0074.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.217] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Y2h1Y3UgamFkbnZrLmNvbnRhY3Q=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\y2h1y3ugamfkbnzrlmnvbnrhy3q=")) returned 1 [0074.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", lpFilePart=0x0) returned 0x32 [0074.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.218] GetFileType (hFile=0x2b8) returned 0x1 [0074.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.218] GetFileType (hFile=0x2b8) returned 0x1 [0074.218] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x19c [0074.218] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=402, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x192 [0074.218] ReadFile (in: hFile=0x2b8, lpBuffer=0x2735fc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2735fc0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.219] CloseHandle (hObject=0x2b8) returned 1 [0074.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", lpFilePart=0x0) returned 0x32 [0074.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.224] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x27a21e0 | out: lpFileInformation=0x27a21e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c)) returned 1 [0074.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", lpFilePart=0x0) returned 0x32 [0074.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.225] GetFileType (hFile=0x2b8) returned 0x1 [0074.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.225] GetFileType (hFile=0x2b8) returned 0x1 [0074.225] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x19c [0074.225] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a25f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27a25f0*, lpNumberOfBytesRead=0x1c9aeb38*=0x19c, lpOverlapped=0x0) returned 1 [0074.225] CloseHandle (hObject=0x2b8) returned 1 [0074.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", lpFilePart=0x0) returned 0x32 [0074.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0074.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab3e0) returned 1 [0074.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0074.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.238] GetFileType (hFile=0x2b8) returned 0x1 [0074.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.238] GetFileType (hFile=0x2b8) returned 0x1 [0074.238] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x496 [0074.238] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1164, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x48c [0074.238] ReadFile (in: hFile=0x2b8, lpBuffer=0x281b5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x281b5f0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.239] CloseHandle (hObject=0x2b8) returned 1 [0074.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0074.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.245] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), fInfoLevelId=0x0, lpFileInformation=0x2887810 | out: lpFileInformation=0x2887810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496)) returned 1 [0074.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0074.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.246] GetFileType (hFile=0x2b8) returned 0x1 [0074.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.246] GetFileType (hFile=0x2b8) returned 0x1 [0074.246] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x496 [0074.246] ReadFile (in: hFile=0x2b8, lpBuffer=0x2887f80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2887f80*, lpNumberOfBytesRead=0x1c9aeb38*=0x496, lpOverlapped=0x0) returned 1 [0074.246] CloseHandle (hObject=0x2b8) returned 1 [0074.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0074.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.307] GetFileType (hFile=0x2b8) returned 0x1 [0074.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.307] GetFileType (hFile=0x2b8) returned 0x1 [0074.309] CloseHandle (hObject=0x2b8) returned 1 [0074.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0074.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0074.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.310] GetFileType (hFile=0x2b8) returned 0x1 [0074.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.310] GetFileType (hFile=0x2b8) returned 0x1 [0074.310] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4a0 [0074.310] WriteFile (in: hFile=0x2b8, lpBuffer=0x272d920*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x272d920*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.310] CloseHandle (hObject=0x2b8) returned 1 [0074.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0074.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\bHVsY2l0IGFta2RmZS5jb250YWN0", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\bHVsY2l0IGFta2RmZS5jb250YWN0", lpFilePart=0x0) returned 0x43 [0074.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.310] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xd4024d00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4aa)) returned 1 [0074.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.311] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\bHVsY2l0IGFta2RmZS5jb250YWN0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\bhvsy2l0igfta2rmzs5jb250ywn0")) returned 1 [0074.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0074.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.313] GetFileType (hFile=0x2b8) returned 0x1 [0074.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.313] GetFileType (hFile=0x2b8) returned 0x1 [0074.313] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x494 [0074.313] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1162, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x48a [0074.313] ReadFile (in: hFile=0x2b8, lpBuffer=0x272eee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x272eee8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.315] CloseHandle (hObject=0x2b8) returned 1 [0074.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0074.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.317] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), fInfoLevelId=0x0, lpFileInformation=0x279b108 | out: lpFileInformation=0x279b108*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494)) returned 1 [0074.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0074.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.317] GetFileType (hFile=0x2b8) returned 0x1 [0074.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.317] GetFileType (hFile=0x2b8) returned 0x1 [0074.317] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x494 [0074.317] ReadFile (in: hFile=0x2b8, lpBuffer=0x279b878, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x279b878*, lpNumberOfBytesRead=0x1c9aeb38*=0x494, lpOverlapped=0x0) returned 1 [0074.318] CloseHandle (hObject=0x2b8) returned 1 [0074.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0074.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.352] GetFileType (hFile=0x2b8) returned 0x1 [0074.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.352] GetFileType (hFile=0x2b8) returned 0x1 [0074.352] WriteFile (in: hFile=0x2b8, lpBuffer=0x2814d10*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x2814d10*, lpNumberOfBytesWritten=0x1c9aea78*=0x4a0, lpOverlapped=0x0) returned 1 [0074.353] CloseHandle (hObject=0x2b8) returned 1 [0074.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0074.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0074.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.354] GetFileType (hFile=0x2b8) returned 0x1 [0074.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.354] GetFileType (hFile=0x2b8) returned 0x1 [0074.354] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4a0 [0074.354] WriteFile (in: hFile=0x2b8, lpBuffer=0x2816b18*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2816b18*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.354] CloseHandle (hObject=0x2b8) returned 1 [0074.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0074.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\c2lrdm5iIGh1dnVpYi5jb250YWN0", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\c2lrdm5iIGh1dnVpYi5jb250YWN0", lpFilePart=0x0) returned 0x43 [0074.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xd4097120, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4aa)) returned 1 [0074.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.354] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\c2lrdm5iIGh1dnVpYi5jb250YWN0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\c2lrdm5iigh1dnvpyi5jb250ywn0")) returned 1 [0074.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\README_3728769.txt", lpFilePart=0x0) returned 0x39 [0074.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0074.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0074.356] GetFileType (hFile=0x2b8) returned 0x1 [0074.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0074.356] GetFileType (hFile=0x2b8) returned 0x1 [0074.356] WriteFile (in: hFile=0x2b8, lpBuffer=0x281adb8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x281adb8*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0074.357] CloseHandle (hObject=0x2b8) returned 1 [0074.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0074.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies", lpFilePart=0x0) returned 0x25 [0074.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\", lpFilePart=0x0) returned 0x26 [0074.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0074.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb80) returned 1 [0074.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0074.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0074.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0074.360] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb43ea5e0, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xb43ea5e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0074.361] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb43ea5e0, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xb43ea5e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.361] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed0c490, ftCreationTime.dwHighDateTime=0x1d5de15, ftLastAccessTime.dwLowDateTime=0xfad1e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xfad1e4c0, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0SN5.png", cAlternateFileName="")) returned 1 [0074.361] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633b54d0, ftCreationTime.dwHighDateTime=0x1d5e435, ftLastAccessTime.dwLowDateTime=0xb020d800, ftLastAccessTime.dwHighDateTime=0x1d5e1cf, ftLastWriteTime.dwLowDateTime=0xb020d800, ftLastWriteTime.dwHighDateTime=0x1d5e1cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="95g6Z 0Je", cAlternateFileName="95G6Z0~1")) returned 1 [0074.361] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d29bf0, ftCreationTime.dwHighDateTime=0x1d5e651, ftLastAccessTime.dwLowDateTime=0xee3b0bd0, ftLastAccessTime.dwHighDateTime=0x1d5df5c, ftLastWriteTime.dwLowDateTime=0xee3b0bd0, ftLastWriteTime.dwHighDateTime=0x1d5df5c, nFileSizeHigh=0x0, nFileSizeLow=0x915a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9jZLlI.pps", cAlternateFileName="")) returned 1 [0074.361] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc357a290, ftCreationTime.dwHighDateTime=0x1d5e202, ftLastAccessTime.dwLowDateTime=0x71b0df60, ftLastAccessTime.dwHighDateTime=0x1d5e09a, ftLastWriteTime.dwLowDateTime=0x71b0df60, ftLastWriteTime.dwHighDateTime=0x1d5e09a, nFileSizeHigh=0x0, nFileSizeLow=0x6ecd, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Zb7N8B_MfpRvgkOLP.flv", cAlternateFileName="9ZB7N8~1.FLV")) returned 1 [0074.361] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3203f0, ftCreationTime.dwHighDateTime=0x1d5daee, ftLastAccessTime.dwLowDateTime=0xe5c324a0, ftLastAccessTime.dwHighDateTime=0x1d5e35e, ftLastWriteTime.dwLowDateTime=0xe5c324a0, ftLastWriteTime.dwHighDateTime=0x1d5e35e, nFileSizeHigh=0x0, nFileSizeLow=0xefba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CpFkAg3.mp4", cAlternateFileName="")) returned 1 [0074.361] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.361] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa39212c0, ftCreationTime.dwHighDateTime=0x1d5d9cd, ftLastAccessTime.dwLowDateTime=0xed814b10, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0xed814b10, ftLastWriteTime.dwHighDateTime=0x1d5e104, nFileSizeHigh=0x0, nFileSizeLow=0x91b, dwReserved0=0x0, dwReserved1=0x0, cFileName="fK8VCT0-QN2O01_3oL.mp3", cAlternateFileName="FK8VCT~1.MP3")) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2251890, ftCreationTime.dwHighDateTime=0x1d5d8be, ftLastAccessTime.dwLowDateTime=0xa8b6b160, ftLastAccessTime.dwHighDateTime=0x1d5e06d, ftLastWriteTime.dwLowDateTime=0xa8b6b160, ftLastWriteTime.dwHighDateTime=0x1d5e06d, nFileSizeHigh=0x0, nFileSizeLow=0x4306, dwReserved0=0x0, dwReserved1=0x0, cFileName="FuFK.mp3", cAlternateFileName="")) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d01a7e0, ftCreationTime.dwHighDateTime=0x1d5df64, ftLastAccessTime.dwLowDateTime=0x78f57d60, ftLastAccessTime.dwHighDateTime=0x1d5e501, ftLastWriteTime.dwLowDateTime=0x78f57d60, ftLastWriteTime.dwHighDateTime=0x1d5e501, nFileSizeHigh=0x0, nFileSizeLow=0x7b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="F_aV2TrLXu.mp4", cAlternateFileName="F_AV2T~1.MP4")) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d48be90, ftCreationTime.dwHighDateTime=0x1d5d97a, ftLastAccessTime.dwLowDateTime=0x6bf86610, ftLastAccessTime.dwHighDateTime=0x1d5db77, ftLastWriteTime.dwLowDateTime=0x6bf86610, ftLastWriteTime.dwHighDateTime=0x1d5db77, nFileSizeHigh=0x0, nFileSizeLow=0x15bd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GmsVop6ogktr2T3.m4a", cAlternateFileName="GMSVOP~1.M4A")) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4387a0d0, ftCreationTime.dwHighDateTime=0x1d5d846, ftLastAccessTime.dwLowDateTime=0xc3dfb770, ftLastAccessTime.dwHighDateTime=0x1d5e5a9, ftLastWriteTime.dwLowDateTime=0xc3dfb770, ftLastWriteTime.dwHighDateTime=0x1d5e5a9, nFileSizeHigh=0x0, nFileSizeLow=0x1ff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="hf6j0Mu7RhNM 4tK0V5A.m4a", cAlternateFileName="HF6J0M~1.M4A")) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc1d050, ftCreationTime.dwHighDateTime=0x1d5df03, ftLastAccessTime.dwLowDateTime=0xfc917240, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xfc917240, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="imLmklNnxH P4K.avi", cAlternateFileName="IMLMKL~1.AVI")) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9464cfa0, ftCreationTime.dwHighDateTime=0x1d5e147, ftLastAccessTime.dwLowDateTime=0xfe5044a0, ftLastAccessTime.dwHighDateTime=0x1d5e52d, ftLastWriteTime.dwLowDateTime=0xfe5044a0, ftLastWriteTime.dwHighDateTime=0x1d5e52d, nFileSizeHigh=0x0, nFileSizeLow=0xed5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="JTs.gif", cAlternateFileName="")) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be0c410, ftCreationTime.dwHighDateTime=0x1d5de9f, ftLastAccessTime.dwLowDateTime=0x671934f0, ftLastAccessTime.dwHighDateTime=0x1d5db66, ftLastWriteTime.dwLowDateTime=0x671934f0, ftLastWriteTime.dwHighDateTime=0x1d5db66, nFileSizeHigh=0x0, nFileSizeLow=0x12d03, dwReserved0=0x0, dwReserved1=0x0, cFileName="l6HsS0A5rLeCPXJyNY.mp3", cAlternateFileName="L6HSS0~1.MP3")) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83f3eec0, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xcfd28790, ftLastAccessTime.dwHighDateTime=0x1d5e4a7, ftLastWriteTime.dwLowDateTime=0xcfd28790, ftLastWriteTime.dwHighDateTime=0x1d5e4a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lb1w", cAlternateFileName="")) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ba9a80, ftCreationTime.dwHighDateTime=0x1d5dff9, ftLastAccessTime.dwLowDateTime=0x2850cde0, ftLastAccessTime.dwHighDateTime=0x1d5e30a, ftLastWriteTime.dwLowDateTime=0x2850cde0, ftLastWriteTime.dwHighDateTime=0x1d5e30a, nFileSizeHigh=0x0, nFileSizeLow=0x14a43, dwReserved0=0x0, dwReserved1=0x0, cFileName="mS2hdXjixdHiDRk.swf", cAlternateFileName="MS2HDX~1.SWF")) returned 1 [0074.363] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2b6f0, ftCreationTime.dwHighDateTime=0x1d5e23f, ftLastAccessTime.dwLowDateTime=0xc9cf8bb0, ftLastAccessTime.dwHighDateTime=0x1d5d979, ftLastWriteTime.dwLowDateTime=0xc9cf8bb0, ftLastWriteTime.dwHighDateTime=0x1d5d979, nFileSizeHigh=0x0, nFileSizeLow=0x10fe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="myhRvADrxGz3KtM.ots", cAlternateFileName="MYHRVA~1.OTS")) returned 1 [0074.363] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b026a0, ftCreationTime.dwHighDateTime=0x1d5db02, ftLastAccessTime.dwLowDateTime=0xd9781320, ftLastAccessTime.dwHighDateTime=0x1d5e815, ftLastWriteTime.dwLowDateTime=0xd9781320, ftLastWriteTime.dwHighDateTime=0x1d5e815, nFileSizeHigh=0x0, nFileSizeLow=0x632a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJ4hiYaNdjONjXzEUd.png", cAlternateFileName="NJ4HIY~1.PNG")) returned 1 [0074.363] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50a04d00, ftCreationTime.dwHighDateTime=0x1d5e2ad, ftLastAccessTime.dwLowDateTime=0xddad8820, ftLastAccessTime.dwHighDateTime=0x1d5e6a4, ftLastWriteTime.dwLowDateTime=0xddad8820, ftLastWriteTime.dwHighDateTime=0x1d5e6a4, nFileSizeHigh=0x0, nFileSizeLow=0xe2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PXQi pA d.bmp", cAlternateFileName="PXQIPA~1.BMP")) returned 1 [0074.363] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfed5600, ftCreationTime.dwHighDateTime=0x1d5d887, ftLastAccessTime.dwLowDateTime=0x4cd9a240, ftLastAccessTime.dwHighDateTime=0x1d5e0a3, ftLastWriteTime.dwLowDateTime=0x4cd9a240, ftLastWriteTime.dwHighDateTime=0x1d5e0a3, nFileSizeHigh=0x0, nFileSizeLow=0x11d62, dwReserved0=0x0, dwReserved1=0x0, cFileName="rOud.mkv", cAlternateFileName="")) returned 1 [0074.363] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e86750, ftCreationTime.dwHighDateTime=0x1d5e1db, ftLastAccessTime.dwLowDateTime=0xe85d46d0, ftLastAccessTime.dwHighDateTime=0x1d5e527, ftLastWriteTime.dwLowDateTime=0xe85d46d0, ftLastWriteTime.dwHighDateTime=0x1d5e527, nFileSizeHigh=0x0, nFileSizeLow=0x173d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rRMHnR0.flv", cAlternateFileName="")) returned 1 [0074.363] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3233f690, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0xc2d67f0, ftLastAccessTime.dwHighDateTime=0x1d5e160, ftLastWriteTime.dwLowDateTime=0xc2d67f0, ftLastWriteTime.dwHighDateTime=0x1d5e160, nFileSizeHigh=0x0, nFileSizeLow=0xb7be, dwReserved0=0x0, dwReserved1=0x0, cFileName="s Jus7Ap0QvVtv.mp4", cAlternateFileName="SJUS7A~1.MP4")) returned 1 [0074.364] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2b8a60, ftCreationTime.dwHighDateTime=0x1d5dfc7, ftLastAccessTime.dwLowDateTime=0x89e4c6b0, ftLastAccessTime.dwHighDateTime=0x1d5de96, ftLastWriteTime.dwLowDateTime=0x89e4c6b0, ftLastWriteTime.dwHighDateTime=0x1d5de96, nFileSizeHigh=0x0, nFileSizeLow=0x14d9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="s_pY.avi", cAlternateFileName="")) returned 1 [0074.364] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fed32d0, ftCreationTime.dwHighDateTime=0x1d5daf5, ftLastAccessTime.dwLowDateTime=0x17fce3a0, ftLastAccessTime.dwHighDateTime=0x1d5d9f2, ftLastWriteTime.dwLowDateTime=0x17fce3a0, ftLastWriteTime.dwHighDateTime=0x1d5d9f2, nFileSizeHigh=0x0, nFileSizeLow=0x4a6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="tt6m-h27p.swf", cAlternateFileName="TT6M-H~1.SWF")) returned 1 [0074.364] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e2ea80, ftCreationTime.dwHighDateTime=0x1d5dd88, ftLastAccessTime.dwLowDateTime=0x81e05f70, ftLastAccessTime.dwHighDateTime=0x1d5d8a0, ftLastWriteTime.dwLowDateTime=0x81e05f70, ftLastWriteTime.dwHighDateTime=0x1d5d8a0, nFileSizeHigh=0x0, nFileSizeLow=0x2bc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="u Uz.swf", cAlternateFileName="UUZ~1.SWF")) returned 1 [0074.364] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaa95700, ftCreationTime.dwHighDateTime=0x1d5f1ef, ftLastAccessTime.dwLowDateTime=0xaaa95700, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xa846fd00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x27200, dwReserved0=0x0, dwReserved1=0x0, cFileName="US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", cAlternateFileName="US-202~1.EXE")) returned 1 [0074.364] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b098460, ftCreationTime.dwHighDateTime=0x1d5e229, ftLastAccessTime.dwLowDateTime=0x9a590070, ftLastAccessTime.dwHighDateTime=0x1d5ddb9, ftLastWriteTime.dwLowDateTime=0x9a590070, ftLastWriteTime.dwHighDateTime=0x1d5ddb9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="V qilK", cAlternateFileName="VQILK~1")) returned 1 [0074.364] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e03980, ftCreationTime.dwHighDateTime=0x1d5e591, ftLastAccessTime.dwLowDateTime=0xb2afa20, ftLastAccessTime.dwHighDateTime=0x1d5e002, ftLastWriteTime.dwLowDateTime=0xb2afa20, ftLastWriteTime.dwHighDateTime=0x1d5e002, nFileSizeHigh=0x0, nFileSizeLow=0x13bc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="wlRi46cHD-3fbYRuWkM.xlsx", cAlternateFileName="WLRI46~1.XLS")) returned 1 [0074.364] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7c90230, ftCreationTime.dwHighDateTime=0x1d5d97e, ftLastAccessTime.dwLowDateTime=0xb679bfb0, ftLastAccessTime.dwHighDateTime=0x1d5db70, ftLastWriteTime.dwLowDateTime=0xb679bfb0, ftLastWriteTime.dwHighDateTime=0x1d5db70, nFileSizeHigh=0x0, nFileSizeLow=0x34ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="x5KdMJR7AZ9KCd083.ods", cAlternateFileName="X5KDMJ~1.ODS")) returned 1 [0074.364] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18189c20, ftCreationTime.dwHighDateTime=0x1d5dddb, ftLastAccessTime.dwLowDateTime=0xcbde0510, ftLastAccessTime.dwHighDateTime=0x1d5dc05, ftLastWriteTime.dwLowDateTime=0xcbde0510, ftLastWriteTime.dwHighDateTime=0x1d5dc05, nFileSizeHigh=0x0, nFileSizeLow=0x4a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZhYnQm1kvV.doc", cAlternateFileName="ZHYNQM~1.DOC")) returned 1 [0074.365] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28538040, ftCreationTime.dwHighDateTime=0x1d5dba7, ftLastAccessTime.dwLowDateTime=0x14e039f0, ftLastAccessTime.dwHighDateTime=0x1d5dc19, ftLastWriteTime.dwLowDateTime=0x14e039f0, ftLastWriteTime.dwHighDateTime=0x1d5dc19, nFileSizeHigh=0x0, nFileSizeLow=0x5854, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZvALEAbv8YapxH.m4a", cAlternateFileName="ZVALEA~1.M4A")) returned 1 [0074.365] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.365] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0074.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0074.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0074.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0074.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0074.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0074.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb43ea5e0, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xb43ea5e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0074.366] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb43ea5e0, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xb43ea5e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.366] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed0c490, ftCreationTime.dwHighDateTime=0x1d5de15, ftLastAccessTime.dwLowDateTime=0xfad1e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xfad1e4c0, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0SN5.png", cAlternateFileName="")) returned 1 [0074.366] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633b54d0, ftCreationTime.dwHighDateTime=0x1d5e435, ftLastAccessTime.dwLowDateTime=0xb020d800, ftLastAccessTime.dwHighDateTime=0x1d5e1cf, ftLastWriteTime.dwLowDateTime=0xb020d800, ftLastWriteTime.dwHighDateTime=0x1d5e1cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="95g6Z 0Je", cAlternateFileName="95G6Z0~1")) returned 1 [0074.366] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d29bf0, ftCreationTime.dwHighDateTime=0x1d5e651, ftLastAccessTime.dwLowDateTime=0xee3b0bd0, ftLastAccessTime.dwHighDateTime=0x1d5df5c, ftLastWriteTime.dwLowDateTime=0xee3b0bd0, ftLastWriteTime.dwHighDateTime=0x1d5df5c, nFileSizeHigh=0x0, nFileSizeLow=0x915a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9jZLlI.pps", cAlternateFileName="")) returned 1 [0074.366] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc357a290, ftCreationTime.dwHighDateTime=0x1d5e202, ftLastAccessTime.dwLowDateTime=0x71b0df60, ftLastAccessTime.dwHighDateTime=0x1d5e09a, ftLastWriteTime.dwLowDateTime=0x71b0df60, ftLastWriteTime.dwHighDateTime=0x1d5e09a, nFileSizeHigh=0x0, nFileSizeLow=0x6ecd, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Zb7N8B_MfpRvgkOLP.flv", cAlternateFileName="9ZB7N8~1.FLV")) returned 1 [0074.366] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3203f0, ftCreationTime.dwHighDateTime=0x1d5daee, ftLastAccessTime.dwLowDateTime=0xe5c324a0, ftLastAccessTime.dwHighDateTime=0x1d5e35e, ftLastWriteTime.dwLowDateTime=0xe5c324a0, ftLastWriteTime.dwHighDateTime=0x1d5e35e, nFileSizeHigh=0x0, nFileSizeLow=0xefba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CpFkAg3.mp4", cAlternateFileName="")) returned 1 [0074.367] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.367] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa39212c0, ftCreationTime.dwHighDateTime=0x1d5d9cd, ftLastAccessTime.dwLowDateTime=0xed814b10, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0xed814b10, ftLastWriteTime.dwHighDateTime=0x1d5e104, nFileSizeHigh=0x0, nFileSizeLow=0x91b, dwReserved0=0x0, dwReserved1=0x0, cFileName="fK8VCT0-QN2O01_3oL.mp3", cAlternateFileName="FK8VCT~1.MP3")) returned 1 [0074.367] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2251890, ftCreationTime.dwHighDateTime=0x1d5d8be, ftLastAccessTime.dwLowDateTime=0xa8b6b160, ftLastAccessTime.dwHighDateTime=0x1d5e06d, ftLastWriteTime.dwLowDateTime=0xa8b6b160, ftLastWriteTime.dwHighDateTime=0x1d5e06d, nFileSizeHigh=0x0, nFileSizeLow=0x4306, dwReserved0=0x0, dwReserved1=0x0, cFileName="FuFK.mp3", cAlternateFileName="")) returned 1 [0074.367] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d01a7e0, ftCreationTime.dwHighDateTime=0x1d5df64, ftLastAccessTime.dwLowDateTime=0x78f57d60, ftLastAccessTime.dwHighDateTime=0x1d5e501, ftLastWriteTime.dwLowDateTime=0x78f57d60, ftLastWriteTime.dwHighDateTime=0x1d5e501, nFileSizeHigh=0x0, nFileSizeLow=0x7b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="F_aV2TrLXu.mp4", cAlternateFileName="F_AV2T~1.MP4")) returned 1 [0074.367] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d48be90, ftCreationTime.dwHighDateTime=0x1d5d97a, ftLastAccessTime.dwLowDateTime=0x6bf86610, ftLastAccessTime.dwHighDateTime=0x1d5db77, ftLastWriteTime.dwLowDateTime=0x6bf86610, ftLastWriteTime.dwHighDateTime=0x1d5db77, nFileSizeHigh=0x0, nFileSizeLow=0x15bd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GmsVop6ogktr2T3.m4a", cAlternateFileName="GMSVOP~1.M4A")) returned 1 [0074.367] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4387a0d0, ftCreationTime.dwHighDateTime=0x1d5d846, ftLastAccessTime.dwLowDateTime=0xc3dfb770, ftLastAccessTime.dwHighDateTime=0x1d5e5a9, ftLastWriteTime.dwLowDateTime=0xc3dfb770, ftLastWriteTime.dwHighDateTime=0x1d5e5a9, nFileSizeHigh=0x0, nFileSizeLow=0x1ff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="hf6j0Mu7RhNM 4tK0V5A.m4a", cAlternateFileName="HF6J0M~1.M4A")) returned 1 [0074.368] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc1d050, ftCreationTime.dwHighDateTime=0x1d5df03, ftLastAccessTime.dwLowDateTime=0xfc917240, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xfc917240, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="imLmklNnxH P4K.avi", cAlternateFileName="IMLMKL~1.AVI")) returned 1 [0074.368] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9464cfa0, ftCreationTime.dwHighDateTime=0x1d5e147, ftLastAccessTime.dwLowDateTime=0xfe5044a0, ftLastAccessTime.dwHighDateTime=0x1d5e52d, ftLastWriteTime.dwLowDateTime=0xfe5044a0, ftLastWriteTime.dwHighDateTime=0x1d5e52d, nFileSizeHigh=0x0, nFileSizeLow=0xed5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="JTs.gif", cAlternateFileName="")) returned 1 [0074.368] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be0c410, ftCreationTime.dwHighDateTime=0x1d5de9f, ftLastAccessTime.dwLowDateTime=0x671934f0, ftLastAccessTime.dwHighDateTime=0x1d5db66, ftLastWriteTime.dwLowDateTime=0x671934f0, ftLastWriteTime.dwHighDateTime=0x1d5db66, nFileSizeHigh=0x0, nFileSizeLow=0x12d03, dwReserved0=0x0, dwReserved1=0x0, cFileName="l6HsS0A5rLeCPXJyNY.mp3", cAlternateFileName="L6HSS0~1.MP3")) returned 1 [0074.368] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83f3eec0, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xcfd28790, ftLastAccessTime.dwHighDateTime=0x1d5e4a7, ftLastWriteTime.dwLowDateTime=0xcfd28790, ftLastWriteTime.dwHighDateTime=0x1d5e4a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lb1w", cAlternateFileName="")) returned 1 [0074.368] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ba9a80, ftCreationTime.dwHighDateTime=0x1d5dff9, ftLastAccessTime.dwLowDateTime=0x2850cde0, ftLastAccessTime.dwHighDateTime=0x1d5e30a, ftLastWriteTime.dwLowDateTime=0x2850cde0, ftLastWriteTime.dwHighDateTime=0x1d5e30a, nFileSizeHigh=0x0, nFileSizeLow=0x14a43, dwReserved0=0x0, dwReserved1=0x0, cFileName="mS2hdXjixdHiDRk.swf", cAlternateFileName="MS2HDX~1.SWF")) returned 1 [0074.368] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2b6f0, ftCreationTime.dwHighDateTime=0x1d5e23f, ftLastAccessTime.dwLowDateTime=0xc9cf8bb0, ftLastAccessTime.dwHighDateTime=0x1d5d979, ftLastWriteTime.dwLowDateTime=0xc9cf8bb0, ftLastWriteTime.dwHighDateTime=0x1d5d979, nFileSizeHigh=0x0, nFileSizeLow=0x10fe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="myhRvADrxGz3KtM.ots", cAlternateFileName="MYHRVA~1.OTS")) returned 1 [0074.368] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b026a0, ftCreationTime.dwHighDateTime=0x1d5db02, ftLastAccessTime.dwLowDateTime=0xd9781320, ftLastAccessTime.dwHighDateTime=0x1d5e815, ftLastWriteTime.dwLowDateTime=0xd9781320, ftLastWriteTime.dwHighDateTime=0x1d5e815, nFileSizeHigh=0x0, nFileSizeLow=0x632a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJ4hiYaNdjONjXzEUd.png", cAlternateFileName="NJ4HIY~1.PNG")) returned 1 [0074.369] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50a04d00, ftCreationTime.dwHighDateTime=0x1d5e2ad, ftLastAccessTime.dwLowDateTime=0xddad8820, ftLastAccessTime.dwHighDateTime=0x1d5e6a4, ftLastWriteTime.dwLowDateTime=0xddad8820, ftLastWriteTime.dwHighDateTime=0x1d5e6a4, nFileSizeHigh=0x0, nFileSizeLow=0xe2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PXQi pA d.bmp", cAlternateFileName="PXQIPA~1.BMP")) returned 1 [0074.369] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfed5600, ftCreationTime.dwHighDateTime=0x1d5d887, ftLastAccessTime.dwLowDateTime=0x4cd9a240, ftLastAccessTime.dwHighDateTime=0x1d5e0a3, ftLastWriteTime.dwLowDateTime=0x4cd9a240, ftLastWriteTime.dwHighDateTime=0x1d5e0a3, nFileSizeHigh=0x0, nFileSizeLow=0x11d62, dwReserved0=0x0, dwReserved1=0x0, cFileName="rOud.mkv", cAlternateFileName="")) returned 1 [0074.369] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e86750, ftCreationTime.dwHighDateTime=0x1d5e1db, ftLastAccessTime.dwLowDateTime=0xe85d46d0, ftLastAccessTime.dwHighDateTime=0x1d5e527, ftLastWriteTime.dwLowDateTime=0xe85d46d0, ftLastWriteTime.dwHighDateTime=0x1d5e527, nFileSizeHigh=0x0, nFileSizeLow=0x173d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rRMHnR0.flv", cAlternateFileName="")) returned 1 [0074.369] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3233f690, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0xc2d67f0, ftLastAccessTime.dwHighDateTime=0x1d5e160, ftLastWriteTime.dwLowDateTime=0xc2d67f0, ftLastWriteTime.dwHighDateTime=0x1d5e160, nFileSizeHigh=0x0, nFileSizeLow=0xb7be, dwReserved0=0x0, dwReserved1=0x0, cFileName="s Jus7Ap0QvVtv.mp4", cAlternateFileName="SJUS7A~1.MP4")) returned 1 [0074.369] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2b8a60, ftCreationTime.dwHighDateTime=0x1d5dfc7, ftLastAccessTime.dwLowDateTime=0x89e4c6b0, ftLastAccessTime.dwHighDateTime=0x1d5de96, ftLastWriteTime.dwLowDateTime=0x89e4c6b0, ftLastWriteTime.dwHighDateTime=0x1d5de96, nFileSizeHigh=0x0, nFileSizeLow=0x14d9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="s_pY.avi", cAlternateFileName="")) returned 1 [0074.369] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fed32d0, ftCreationTime.dwHighDateTime=0x1d5daf5, ftLastAccessTime.dwLowDateTime=0x17fce3a0, ftLastAccessTime.dwHighDateTime=0x1d5d9f2, ftLastWriteTime.dwLowDateTime=0x17fce3a0, ftLastWriteTime.dwHighDateTime=0x1d5d9f2, nFileSizeHigh=0x0, nFileSizeLow=0x4a6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="tt6m-h27p.swf", cAlternateFileName="TT6M-H~1.SWF")) returned 1 [0074.369] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e2ea80, ftCreationTime.dwHighDateTime=0x1d5dd88, ftLastAccessTime.dwLowDateTime=0x81e05f70, ftLastAccessTime.dwHighDateTime=0x1d5d8a0, ftLastWriteTime.dwLowDateTime=0x81e05f70, ftLastWriteTime.dwHighDateTime=0x1d5d8a0, nFileSizeHigh=0x0, nFileSizeLow=0x2bc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="u Uz.swf", cAlternateFileName="UUZ~1.SWF")) returned 1 [0074.370] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaa95700, ftCreationTime.dwHighDateTime=0x1d5f1ef, ftLastAccessTime.dwLowDateTime=0xaaa95700, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xa846fd00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x27200, dwReserved0=0x0, dwReserved1=0x0, cFileName="US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", cAlternateFileName="US-202~1.EXE")) returned 1 [0074.370] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b098460, ftCreationTime.dwHighDateTime=0x1d5e229, ftLastAccessTime.dwLowDateTime=0x9a590070, ftLastAccessTime.dwHighDateTime=0x1d5ddb9, ftLastWriteTime.dwLowDateTime=0x9a590070, ftLastWriteTime.dwHighDateTime=0x1d5ddb9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="V qilK", cAlternateFileName="VQILK~1")) returned 1 [0074.370] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e03980, ftCreationTime.dwHighDateTime=0x1d5e591, ftLastAccessTime.dwLowDateTime=0xb2afa20, ftLastAccessTime.dwHighDateTime=0x1d5e002, ftLastWriteTime.dwLowDateTime=0xb2afa20, ftLastWriteTime.dwHighDateTime=0x1d5e002, nFileSizeHigh=0x0, nFileSizeLow=0x13bc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="wlRi46cHD-3fbYRuWkM.xlsx", cAlternateFileName="WLRI46~1.XLS")) returned 1 [0074.370] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7c90230, ftCreationTime.dwHighDateTime=0x1d5d97e, ftLastAccessTime.dwLowDateTime=0xb679bfb0, ftLastAccessTime.dwHighDateTime=0x1d5db70, ftLastWriteTime.dwLowDateTime=0xb679bfb0, ftLastWriteTime.dwHighDateTime=0x1d5db70, nFileSizeHigh=0x0, nFileSizeLow=0x34ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="x5KdMJR7AZ9KCd083.ods", cAlternateFileName="X5KDMJ~1.ODS")) returned 1 [0074.370] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18189c20, ftCreationTime.dwHighDateTime=0x1d5dddb, ftLastAccessTime.dwLowDateTime=0xcbde0510, ftLastAccessTime.dwHighDateTime=0x1d5dc05, ftLastWriteTime.dwLowDateTime=0xcbde0510, ftLastWriteTime.dwHighDateTime=0x1d5dc05, nFileSizeHigh=0x0, nFileSizeLow=0x4a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZhYnQm1kvV.doc", cAlternateFileName="ZHYNQM~1.DOC")) returned 1 [0074.370] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28538040, ftCreationTime.dwHighDateTime=0x1d5dba7, ftLastAccessTime.dwLowDateTime=0x14e039f0, ftLastAccessTime.dwHighDateTime=0x1d5dc19, ftLastWriteTime.dwLowDateTime=0x14e039f0, ftLastWriteTime.dwHighDateTime=0x1d5dc19, nFileSizeHigh=0x0, nFileSizeLow=0x5854, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZvALEAbv8YapxH.m4a", cAlternateFileName="ZVALEA~1.M4A")) returned 1 [0074.371] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28538040, ftCreationTime.dwHighDateTime=0x1d5dba7, ftLastAccessTime.dwLowDateTime=0x14e039f0, ftLastAccessTime.dwHighDateTime=0x1d5dc19, ftLastWriteTime.dwLowDateTime=0x14e039f0, ftLastWriteTime.dwHighDateTime=0x1d5dc19, nFileSizeHigh=0x0, nFileSizeLow=0x5854, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZvALEAbv8YapxH.m4a", cAlternateFileName="ZVALEA~1.M4A")) returned 0 [0074.371] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0074.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0074.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0074.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", lpFilePart=0x0) returned 0x2e [0074.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0sn5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.371] GetFileType (hFile=0x2b8) returned 0x1 [0074.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.371] GetFileType (hFile=0x2b8) returned 0x1 [0074.371] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x7c6 [0074.371] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1980, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x7bc [0074.371] ReadFile (in: hFile=0x2b8, lpBuffer=0x2825c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2825c68*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.372] CloseHandle (hObject=0x2b8) returned 1 [0074.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", lpFilePart=0x0) returned 0x2e [0074.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.378] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0sn5.png"), fInfoLevelId=0x0, lpFileInformation=0x2891fa8 | out: lpFileInformation=0x2891fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed0c490, ftCreationTime.dwHighDateTime=0x1d5de15, ftLastAccessTime.dwLowDateTime=0xfad1e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xfad1e4c0, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x7c6)) returned 1 [0074.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", lpFilePart=0x0) returned 0x2e [0074.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0sn5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.378] GetFileType (hFile=0x2b8) returned 0x1 [0074.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.379] GetFileType (hFile=0x2b8) returned 0x1 [0074.379] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x7c6 [0074.379] ReadFile (in: hFile=0x2b8, lpBuffer=0x28929d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28929d0*, lpNumberOfBytesRead=0x1c9aeb38*=0x7c6, lpOverlapped=0x0) returned 1 [0074.379] CloseHandle (hObject=0x2b8) returned 1 [0074.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", lpFilePart=0x0) returned 0x2e [0074.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0sn5.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.426] GetFileType (hFile=0x2b8) returned 0x1 [0074.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.426] GetFileType (hFile=0x2b8) returned 0x1 [0074.426] WriteFile (in: hFile=0x2b8, lpBuffer=0x2739588*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x2739588*, lpNumberOfBytesWritten=0x1c9aea78*=0x7d0, lpOverlapped=0x0) returned 1 [0074.427] CloseHandle (hObject=0x2b8) returned 1 [0074.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", lpFilePart=0x0) returned 0x2e [0074.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", lpFilePart=0x0) returned 0x2e [0074.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0sn5.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.429] GetFileType (hFile=0x2b8) returned 0x1 [0074.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.429] GetFileType (hFile=0x2b8) returned 0x1 [0074.429] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x7d0 [0074.429] WriteFile (in: hFile=0x2b8, lpBuffer=0x273b2d0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x273b2d0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.429] CloseHandle (hObject=0x2b8) returned 1 [0074.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png", lpFilePart=0x0) returned 0x2e [0074.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MFNONS5wbmc=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MFNONS5wbmc=", lpFilePart=0x0) returned 0x32 [0074.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.429] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0sn5.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed0c490, ftCreationTime.dwHighDateTime=0x1d5de15, ftLastAccessTime.dwLowDateTime=0xfad1e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xd4155800, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x7da)) returned 1 [0074.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.429] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0SN5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0sn5.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MFNONS5wbmc=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mfnons5wbmc=")) returned 1 [0074.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", lpFilePart=0x0) returned 0x30 [0074.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9jzlli.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.431] GetFileType (hFile=0x2b8) returned 0x1 [0074.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.431] GetFileType (hFile=0x2b8) returned 0x1 [0074.431] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x915a [0074.431] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=37200, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x9150 [0074.431] ReadFile (in: hFile=0x2b8, lpBuffer=0x273c608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x273c608*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.432] CloseHandle (hObject=0x2b8) returned 1 [0074.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", lpFilePart=0x0) returned 0x30 [0074.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.438] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9jzlli.pps"), fInfoLevelId=0x0, lpFileInformation=0x27a89c8 | out: lpFileInformation=0x27a89c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d29bf0, ftCreationTime.dwHighDateTime=0x1d5e651, ftLastAccessTime.dwLowDateTime=0xee3b0bd0, ftLastAccessTime.dwHighDateTime=0x1d5df5c, ftLastWriteTime.dwLowDateTime=0xee3b0bd0, ftLastWriteTime.dwHighDateTime=0x1d5df5c, nFileSizeHigh=0x0, nFileSizeLow=0x915a)) returned 1 [0074.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", lpFilePart=0x0) returned 0x30 [0074.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9jzlli.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.438] GetFileType (hFile=0x2b8) returned 0x1 [0074.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.438] GetFileType (hFile=0x2b8) returned 0x1 [0074.438] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x915a [0074.438] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a8c20, nNumberOfBytesToRead=0x915a, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27a8c20*, lpNumberOfBytesRead=0x1c9aeb38*=0x915a, lpOverlapped=0x0) returned 1 [0074.439] CloseHandle (hObject=0x2b8) returned 1 [0074.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", lpFilePart=0x0) returned 0x30 [0074.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9jzlli.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.470] GetFileType (hFile=0x2b8) returned 0x1 [0074.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.470] GetFileType (hFile=0x2b8) returned 0x1 [0074.470] WriteFile (in: hFile=0x2b8, lpBuffer=0x284cef0*, nNumberOfBytesToWrite=0x9160, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x284cef0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x9160, lpOverlapped=0x0) returned 1 [0074.472] CloseHandle (hObject=0x2b8) returned 1 [0074.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", lpFilePart=0x0) returned 0x30 [0074.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", lpFilePart=0x0) returned 0x30 [0074.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9jzlli.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.472] GetFileType (hFile=0x2b8) returned 0x1 [0074.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.473] GetFileType (hFile=0x2b8) returned 0x1 [0074.473] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x9160 [0074.473] WriteFile (in: hFile=0x2b8, lpBuffer=0x2856ef8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2856ef8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.473] CloseHandle (hObject=0x2b8) returned 1 [0074.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps", lpFilePart=0x0) returned 0x30 [0074.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OWpaTGxJLnBwcw==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OWpaTGxJLnBwcw==", lpFilePart=0x0) returned 0x36 [0074.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.474] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9jzlli.pps"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d29bf0, ftCreationTime.dwHighDateTime=0x1d5e651, ftLastAccessTime.dwLowDateTime=0xee3b0bd0, ftLastAccessTime.dwHighDateTime=0x1d5df5c, ftLastWriteTime.dwLowDateTime=0xd41c7c20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x916a)) returned 1 [0074.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.474] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9jZLlI.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9jzlli.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OWpaTGxJLnBwcw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\owpatgxjlnbwcw==")) returned 1 [0074.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", lpFilePart=0x0) returned 0x3c [0074.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9zb7n8b_mfprvgkolp.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.478] GetFileType (hFile=0x2b8) returned 0x1 [0074.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.478] GetFileType (hFile=0x2b8) returned 0x1 [0074.478] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x6ecd [0074.478] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=28355, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x6ec3 [0074.478] ReadFile (in: hFile=0x2b8, lpBuffer=0x2858470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2858470*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.479] CloseHandle (hObject=0x2b8) returned 1 [0074.479] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", lpFilePart=0x0) returned 0x3c [0074.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9zb7n8b_mfprvgkolp.flv"), fInfoLevelId=0x0, lpFileInformation=0x28c4830 | out: lpFileInformation=0x28c4830*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc357a290, ftCreationTime.dwHighDateTime=0x1d5e202, ftLastAccessTime.dwLowDateTime=0x71b0df60, ftLastAccessTime.dwHighDateTime=0x1d5e09a, ftLastWriteTime.dwLowDateTime=0x71b0df60, ftLastWriteTime.dwHighDateTime=0x1d5e09a, nFileSizeHigh=0x0, nFileSizeLow=0x6ecd)) returned 1 [0074.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", lpFilePart=0x0) returned 0x3c [0074.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9zb7n8b_mfprvgkolp.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.481] GetFileType (hFile=0x2b8) returned 0x1 [0074.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.481] GetFileType (hFile=0x2b8) returned 0x1 [0074.481] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x6ecd [0074.481] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c4ae8, nNumberOfBytesToRead=0x6ecd, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28c4ae8*, lpNumberOfBytesRead=0x1c9aeb38*=0x6ecd, lpOverlapped=0x0) returned 1 [0074.481] CloseHandle (hObject=0x2b8) returned 1 [0074.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", lpFilePart=0x0) returned 0x3c [0074.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9zb7n8b_mfprvgkolp.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.531] GetFileType (hFile=0x2b8) returned 0x1 [0074.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.531] GetFileType (hFile=0x2b8) returned 0x1 [0074.531] WriteFile (in: hFile=0x2b8, lpBuffer=0x270eb00*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x270eb00*, lpNumberOfBytesWritten=0x1c9aebc8*=0x6ed0, lpOverlapped=0x0) returned 1 [0074.532] CloseHandle (hObject=0x2b8) returned 1 [0074.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", lpFilePart=0x0) returned 0x3c [0074.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", lpFilePart=0x0) returned 0x3c [0074.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9zb7n8b_mfprvgkolp.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.533] GetFileType (hFile=0x2b8) returned 0x1 [0074.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.533] GetFileType (hFile=0x2b8) returned 0x1 [0074.533] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x6ed0 [0074.533] WriteFile (in: hFile=0x2b8, lpBuffer=0x2716948*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2716948*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.533] CloseHandle (hObject=0x2b8) returned 1 [0074.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv", lpFilePart=0x0) returned 0x3c [0074.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OVpiN044Ql9NZnBSdmdrT0xQLmZsdg==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OVpiN044Ql9NZnBSdmdrT0xQLmZsdg==", lpFilePart=0x0) returned 0x46 [0074.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.534] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9zb7n8b_mfprvgkolp.flv"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc357a290, ftCreationTime.dwHighDateTime=0x1d5e202, ftLastAccessTime.dwLowDateTime=0x71b0df60, ftLastAccessTime.dwHighDateTime=0x1d5e09a, ftLastWriteTime.dwLowDateTime=0xd423a040, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x6eda)) returned 1 [0074.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.534] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9Zb7N8B_MfpRvgkOLP.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9zb7n8b_mfprvgkolp.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OVpiN044Ql9NZnBSdmdrT0xQLmZsdg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ovpin044ql9nznbsdmdrt0xqlmzsdg==")) returned 1 [0074.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", lpFilePart=0x0) returned 0x31 [0074.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cpfkag3.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.535] GetFileType (hFile=0x2b8) returned 0x1 [0074.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.535] GetFileType (hFile=0x2b8) returned 0x1 [0074.535] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xefba [0074.535] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=61360, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xefb0 [0074.535] ReadFile (in: hFile=0x2b8, lpBuffer=0x2717cf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2717cf0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.536] CloseHandle (hObject=0x2b8) returned 1 [0074.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", lpFilePart=0x0) returned 0x31 [0074.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cpfkag3.mp4"), fInfoLevelId=0x0, lpFileInformation=0x2784070 | out: lpFileInformation=0x2784070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3203f0, ftCreationTime.dwHighDateTime=0x1d5daee, ftLastAccessTime.dwLowDateTime=0xe5c324a0, ftLastAccessTime.dwHighDateTime=0x1d5e35e, ftLastWriteTime.dwLowDateTime=0xe5c324a0, ftLastWriteTime.dwHighDateTime=0x1d5e35e, nFileSizeHigh=0x0, nFileSizeLow=0xefba)) returned 1 [0074.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", lpFilePart=0x0) returned 0x31 [0074.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cpfkag3.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.542] GetFileType (hFile=0x2b8) returned 0x1 [0074.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.542] GetFileType (hFile=0x2b8) returned 0x1 [0074.542] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xefba [0074.542] ReadFile (in: hFile=0x2b8, lpBuffer=0x27842c8, nNumberOfBytesToRead=0xefba, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27842c8*, lpNumberOfBytesRead=0x1c9aeb38*=0xefba, lpOverlapped=0x0) returned 1 [0074.543] CloseHandle (hObject=0x2b8) returned 1 [0074.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", lpFilePart=0x0) returned 0x31 [0074.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cpfkag3.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.556] GetFileType (hFile=0x2b8) returned 0x1 [0074.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.556] GetFileType (hFile=0x2b8) returned 0x1 [0074.556] WriteFile (in: hFile=0x2b8, lpBuffer=0x2827e00*, nNumberOfBytesToWrite=0xefc0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2827e00*, lpNumberOfBytesWritten=0x1c9aebc8*=0xefc0, lpOverlapped=0x0) returned 1 [0074.557] CloseHandle (hObject=0x2b8) returned 1 [0074.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", lpFilePart=0x0) returned 0x31 [0074.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", lpFilePart=0x0) returned 0x31 [0074.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cpfkag3.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.558] GetFileType (hFile=0x2b8) returned 0x1 [0074.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.558] GetFileType (hFile=0x2b8) returned 0x1 [0074.558] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xefc0 [0074.558] WriteFile (in: hFile=0x2b8, lpBuffer=0x2837c68*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2837c68*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.558] CloseHandle (hObject=0x2b8) returned 1 [0074.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4", lpFilePart=0x0) returned 0x31 [0074.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Q3BGa0FnMy5tcDQ=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Q3BGa0FnMy5tcDQ=", lpFilePart=0x0) returned 0x36 [0074.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.559] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cpfkag3.mp4"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3203f0, ftCreationTime.dwHighDateTime=0x1d5daee, ftLastAccessTime.dwLowDateTime=0xe5c324a0, ftLastAccessTime.dwHighDateTime=0x1d5e35e, ftLastWriteTime.dwLowDateTime=0xd4286300, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xefca)) returned 1 [0074.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.559] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CpFkAg3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cpfkag3.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Q3BGa0FnMy5tcDQ=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\q3bga0fnmy5tcdq=")) returned 1 [0074.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x31 [0074.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.560] GetFileType (hFile=0x2b8) returned 0x1 [0074.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.560] GetFileType (hFile=0x2b8) returned 0x1 [0074.560] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x11a [0074.560] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=272, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x110 [0074.560] ReadFile (in: hFile=0x2b8, lpBuffer=0x2838fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2838fb8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.561] CloseHandle (hObject=0x2b8) returned 1 [0074.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x31 [0074.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.563] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x28a51d8 | out: lpFileInformation=0x28a51d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a)) returned 1 [0074.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x31 [0074.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.563] GetFileType (hFile=0x2b8) returned 0x1 [0074.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.563] GetFileType (hFile=0x2b8) returned 0x1 [0074.563] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x11a [0074.563] ReadFile (in: hFile=0x2b8, lpBuffer=0x28a5568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28a5568*, lpNumberOfBytesRead=0x1c9aeb38*=0x11a, lpOverlapped=0x0) returned 1 [0074.563] CloseHandle (hObject=0x2b8) returned 1 [0074.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x31 [0074.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.626] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0074.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab3e0) returned 1 [0074.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", lpFilePart=0x0) returned 0x3c [0074.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fk8vct0-qn2o01_3ol.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.631] GetFileType (hFile=0x2b8) returned 0x1 [0074.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.631] GetFileType (hFile=0x2b8) returned 0x1 [0074.631] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x91b [0074.632] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=2321, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x911 [0074.632] ReadFile (in: hFile=0x2b8, lpBuffer=0x2756588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2756588*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.632] CloseHandle (hObject=0x2b8) returned 1 [0074.633] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", lpFilePart=0x0) returned 0x3c [0074.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fk8vct0-qn2o01_3ol.mp3"), fInfoLevelId=0x0, lpFileInformation=0x27c2988 | out: lpFileInformation=0x27c2988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa39212c0, ftCreationTime.dwHighDateTime=0x1d5d9cd, ftLastAccessTime.dwLowDateTime=0xed814b10, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0xed814b10, ftLastWriteTime.dwHighDateTime=0x1d5e104, nFileSizeHigh=0x0, nFileSizeLow=0x91b)) returned 1 [0074.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", lpFilePart=0x0) returned 0x3c [0074.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fk8vct0-qn2o01_3ol.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.639] GetFileType (hFile=0x2b8) returned 0x1 [0074.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.639] GetFileType (hFile=0x2b8) returned 0x1 [0074.639] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x91b [0074.639] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c3578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27c3578*, lpNumberOfBytesRead=0x1c9aeb38*=0x91b, lpOverlapped=0x0) returned 1 [0074.639] CloseHandle (hObject=0x2b8) returned 1 [0074.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", lpFilePart=0x0) returned 0x3c [0074.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fk8vct0-qn2o01_3ol.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.673] GetFileType (hFile=0x2b8) returned 0x1 [0074.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.673] GetFileType (hFile=0x2b8) returned 0x1 [0074.674] WriteFile (in: hFile=0x2b8, lpBuffer=0x283e088*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x283e088*, lpNumberOfBytesWritten=0x1c9aea78*=0x920, lpOverlapped=0x0) returned 1 [0074.674] CloseHandle (hObject=0x2b8) returned 1 [0074.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", lpFilePart=0x0) returned 0x3c [0074.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", lpFilePart=0x0) returned 0x3c [0074.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fk8vct0-qn2o01_3ol.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.675] GetFileType (hFile=0x2b8) returned 0x1 [0074.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.675] GetFileType (hFile=0x2b8) returned 0x1 [0074.675] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x920 [0074.676] WriteFile (in: hFile=0x2b8, lpBuffer=0x283fe98*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x283fe98*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.676] CloseHandle (hObject=0x2b8) returned 1 [0074.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3", lpFilePart=0x0) returned 0x3c [0074.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zks4VkNUMC1RTjJPMDFfM29MLm1wMw==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zks4VkNUMC1RTjJPMDFfM29MLm1wMw==", lpFilePart=0x0) returned 0x46 [0074.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.676] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fk8vct0-qn2o01_3ol.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa39212c0, ftCreationTime.dwHighDateTime=0x1d5d9cd, ftLastAccessTime.dwLowDateTime=0xed814b10, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0xd43b6e00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x92a)) returned 1 [0074.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.676] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fK8VCT0-QN2O01_3oL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fk8vct0-qn2o01_3ol.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zks4VkNUMC1RTjJPMDFfM29MLm1wMw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zks4vknumc1rtjjpmdffm29mlm1wmw==")) returned 1 [0074.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", lpFilePart=0x0) returned 0x2e [0074.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fufk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.679] GetFileType (hFile=0x2b8) returned 0x1 [0074.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.679] GetFileType (hFile=0x2b8) returned 0x1 [0074.679] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x4306 [0074.679] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=17148, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x42fc [0074.679] ReadFile (in: hFile=0x2b8, lpBuffer=0x2841238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2841238*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.680] CloseHandle (hObject=0x2b8) returned 1 [0074.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", lpFilePart=0x0) returned 0x2e [0074.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.681] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fufk.mp3"), fInfoLevelId=0x0, lpFileInformation=0x28ad530 | out: lpFileInformation=0x28ad530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2251890, ftCreationTime.dwHighDateTime=0x1d5d8be, ftLastAccessTime.dwLowDateTime=0xa8b6b160, ftLastAccessTime.dwHighDateTime=0x1d5e06d, ftLastWriteTime.dwLowDateTime=0xa8b6b160, ftLastWriteTime.dwHighDateTime=0x1d5e06d, nFileSizeHigh=0x0, nFileSizeLow=0x4306)) returned 1 [0074.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", lpFilePart=0x0) returned 0x2e [0074.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fufk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.682] GetFileType (hFile=0x2b8) returned 0x1 [0074.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.682] GetFileType (hFile=0x2b8) returned 0x1 [0074.682] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x4306 [0074.682] ReadFile (in: hFile=0x2b8, lpBuffer=0x28ad778, nNumberOfBytesToRead=0x4306, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28ad778*, lpNumberOfBytesRead=0x1c9aeb38*=0x4306, lpOverlapped=0x0) returned 1 [0074.682] CloseHandle (hObject=0x2b8) returned 1 [0074.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", lpFilePart=0x0) returned 0x2e [0074.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fufk.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.733] GetFileType (hFile=0x2b8) returned 0x1 [0074.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.733] GetFileType (hFile=0x2b8) returned 0x1 [0074.733] WriteFile (in: hFile=0x2b8, lpBuffer=0x2767bd8*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2767bd8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x4310, lpOverlapped=0x0) returned 1 [0074.734] CloseHandle (hObject=0x2b8) returned 1 [0074.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", lpFilePart=0x0) returned 0x2e [0074.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", lpFilePart=0x0) returned 0x2e [0074.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fufk.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.735] GetFileType (hFile=0x2b8) returned 0x1 [0074.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.735] GetFileType (hFile=0x2b8) returned 0x1 [0074.735] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4310 [0074.735] WriteFile (in: hFile=0x2b8, lpBuffer=0x276cd60*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x276cd60*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.736] CloseHandle (hObject=0x2b8) returned 1 [0074.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3", lpFilePart=0x0) returned 0x2e [0074.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RnVGSy5tcDM=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RnVGSy5tcDM=", lpFilePart=0x0) returned 0x32 [0074.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fufk.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2251890, ftCreationTime.dwHighDateTime=0x1d5d8be, ftLastAccessTime.dwLowDateTime=0xa8b6b160, ftLastAccessTime.dwHighDateTime=0x1d5e06d, ftLastWriteTime.dwLowDateTime=0xd4429220, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x431a)) returned 1 [0074.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.736] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FuFK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fufk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RnVGSy5tcDM=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rnvgsy5tcdm=")) returned 1 [0074.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", lpFilePart=0x0) returned 0x34 [0074.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f_av2trlxu.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.738] GetFileType (hFile=0x2b8) returned 0x1 [0074.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.738] GetFileType (hFile=0x2b8) returned 0x1 [0074.738] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x7b28 [0074.738] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=31518, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x7b1e [0074.738] ReadFile (in: hFile=0x2b8, lpBuffer=0x276e0a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x276e0a8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.739] CloseHandle (hObject=0x2b8) returned 1 [0074.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", lpFilePart=0x0) returned 0x34 [0074.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f_av2trlxu.mp4"), fInfoLevelId=0x0, lpFileInformation=0x27da428 | out: lpFileInformation=0x27da428*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d01a7e0, ftCreationTime.dwHighDateTime=0x1d5df64, ftLastAccessTime.dwLowDateTime=0x78f57d60, ftLastAccessTime.dwHighDateTime=0x1d5e501, ftLastWriteTime.dwLowDateTime=0x78f57d60, ftLastWriteTime.dwHighDateTime=0x1d5e501, nFileSizeHigh=0x0, nFileSizeLow=0x7b28)) returned 1 [0074.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", lpFilePart=0x0) returned 0x34 [0074.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f_av2trlxu.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.745] GetFileType (hFile=0x2b8) returned 0x1 [0074.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.745] GetFileType (hFile=0x2b8) returned 0x1 [0074.745] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x7b28 [0074.745] ReadFile (in: hFile=0x2b8, lpBuffer=0x27da6a0, nNumberOfBytesToRead=0x7b28, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27da6a0*, lpNumberOfBytesRead=0x1c9aeb38*=0x7b28, lpOverlapped=0x0) returned 1 [0074.745] CloseHandle (hObject=0x2b8) returned 1 [0074.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", lpFilePart=0x0) returned 0x34 [0074.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f_av2trlxu.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.758] GetFileType (hFile=0x2b8) returned 0x1 [0074.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.758] GetFileType (hFile=0x2b8) returned 0x1 [0074.758] WriteFile (in: hFile=0x2b8, lpBuffer=0x2877a78*, nNumberOfBytesToWrite=0x7b30, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2877a78*, lpNumberOfBytesWritten=0x1c9aebc8*=0x7b30, lpOverlapped=0x0) returned 1 [0074.759] CloseHandle (hObject=0x2b8) returned 1 [0074.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", lpFilePart=0x0) returned 0x34 [0074.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", lpFilePart=0x0) returned 0x34 [0074.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f_av2trlxu.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.760] GetFileType (hFile=0x2b8) returned 0x1 [0074.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.760] GetFileType (hFile=0x2b8) returned 0x1 [0074.760] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x7b30 [0074.760] WriteFile (in: hFile=0x2b8, lpBuffer=0x2880490*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2880490*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.760] CloseHandle (hObject=0x2b8) returned 1 [0074.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4", lpFilePart=0x0) returned 0x34 [0074.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Rl9hVjJUckxYdS5tcDQ=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Rl9hVjJUckxYdS5tcDQ=", lpFilePart=0x0) returned 0x3a [0074.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f_av2trlxu.mp4"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d01a7e0, ftCreationTime.dwHighDateTime=0x1d5df64, ftLastAccessTime.dwLowDateTime=0x78f57d60, ftLastAccessTime.dwHighDateTime=0x1d5e501, ftLastWriteTime.dwLowDateTime=0xd44754e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x7b3a)) returned 1 [0074.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.761] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F_aV2TrLXu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f_av2trlxu.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Rl9hVjJUckxYdS5tcDQ=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rl9hvjjuckxyds5tcdq=")) returned 1 [0074.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", lpFilePart=0x0) returned 0x39 [0074.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmsvop6ogktr2t3.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.762] GetFileType (hFile=0x2b8) returned 0x1 [0074.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.762] GetFileType (hFile=0x2b8) returned 0x1 [0074.762] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x15bd6 [0074.762] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=89036, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x15bcc [0074.762] ReadFile (in: hFile=0x2b8, lpBuffer=0x2881818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2881818*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.763] CloseHandle (hObject=0x2b8) returned 1 [0074.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", lpFilePart=0x0) returned 0x39 [0074.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.764] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmsvop6ogktr2t3.m4a"), fInfoLevelId=0x0, lpFileInformation=0x28edb98 | out: lpFileInformation=0x28edb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d48be90, ftCreationTime.dwHighDateTime=0x1d5d97a, ftLastAccessTime.dwLowDateTime=0x6bf86610, ftLastAccessTime.dwHighDateTime=0x1d5db77, ftLastWriteTime.dwLowDateTime=0x6bf86610, ftLastWriteTime.dwHighDateTime=0x1d5db77, nFileSizeHigh=0x0, nFileSizeLow=0x15bd6)) returned 1 [0074.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", lpFilePart=0x0) returned 0x39 [0074.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmsvop6ogktr2t3.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.765] GetFileType (hFile=0x2b8) returned 0x1 [0074.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.765] GetFileType (hFile=0x2b8) returned 0x1 [0074.765] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x15bd6 [0074.765] ReadFile (in: hFile=0x2b8, lpBuffer=0x128a0fc8, nNumberOfBytesToRead=0x15bd6, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x128a0fc8*, lpNumberOfBytesRead=0x1c9aeb38*=0x15bd6, lpOverlapped=0x0) returned 1 [0074.766] CloseHandle (hObject=0x2b8) returned 1 [0074.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", lpFilePart=0x0) returned 0x39 [0074.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmsvop6ogktr2t3.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.817] GetFileType (hFile=0x2b8) returned 0x1 [0074.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.817] GetFileType (hFile=0x2b8) returned 0x1 [0074.817] WriteFile (in: hFile=0x2b8, lpBuffer=0x1290dbc0*, nNumberOfBytesToWrite=0x15be0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x1290dbc0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x15be0, lpOverlapped=0x0) returned 1 [0074.819] CloseHandle (hObject=0x2b8) returned 1 [0074.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", lpFilePart=0x0) returned 0x39 [0074.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", lpFilePart=0x0) returned 0x39 [0074.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmsvop6ogktr2t3.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.820] GetFileType (hFile=0x2b8) returned 0x1 [0074.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.820] GetFileType (hFile=0x2b8) returned 0x1 [0074.820] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x15be0 [0074.820] WriteFile (in: hFile=0x2b8, lpBuffer=0x26f78d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26f78d8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.820] CloseHandle (hObject=0x2b8) returned 1 [0074.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a", lpFilePart=0x0) returned 0x39 [0074.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R21zVm9wNm9na3RyMlQzLm00YQ==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R21zVm9wNm9na3RyMlQzLm00YQ==", lpFilePart=0x0) returned 0x42 [0074.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.821] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmsvop6ogktr2t3.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d48be90, ftCreationTime.dwHighDateTime=0x1d5d97a, ftLastAccessTime.dwLowDateTime=0x6bf86610, ftLastAccessTime.dwHighDateTime=0x1d5db77, ftLastWriteTime.dwLowDateTime=0xd450da60, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x15bea)) returned 1 [0074.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.821] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GmsVop6ogktr2T3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmsvop6ogktr2t3.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R21zVm9wNm9na3RyMlQzLm00YQ==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\r21zvm9wnm9na3rymlqzlm00yq==")) returned 1 [0074.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", lpFilePart=0x0) returned 0x3e [0074.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hf6j0mu7rhnm 4tk0v5a.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.822] GetFileType (hFile=0x2b8) returned 0x1 [0074.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.822] GetFileType (hFile=0x2b8) returned 0x1 [0074.822] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1ff5 [0074.822] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=8171, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1feb [0074.822] ReadFile (in: hFile=0x2b8, lpBuffer=0x26f8ca0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26f8ca0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.823] CloseHandle (hObject=0x2b8) returned 1 [0074.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", lpFilePart=0x0) returned 0x3e [0074.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.829] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hf6j0mu7rhnm 4tk0v5a.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2765060 | out: lpFileInformation=0x2765060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4387a0d0, ftCreationTime.dwHighDateTime=0x1d5d846, ftLastAccessTime.dwLowDateTime=0xc3dfb770, ftLastAccessTime.dwHighDateTime=0x1d5e5a9, ftLastWriteTime.dwLowDateTime=0xc3dfb770, ftLastWriteTime.dwHighDateTime=0x1d5e5a9, nFileSizeHigh=0x0, nFileSizeLow=0x1ff5)) returned 1 [0074.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", lpFilePart=0x0) returned 0x3e [0074.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hf6j0mu7rhnm 4tk0v5a.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.829] GetFileType (hFile=0x2b8) returned 0x1 [0074.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.829] GetFileType (hFile=0x2b8) returned 0x1 [0074.829] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x1ff5 [0074.829] ReadFile (in: hFile=0x2b8, lpBuffer=0x2765328, nNumberOfBytesToRead=0x1ff5, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2765328*, lpNumberOfBytesRead=0x1c9aeb38*=0x1ff5, lpOverlapped=0x0) returned 1 [0074.829] CloseHandle (hObject=0x2b8) returned 1 [0074.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", lpFilePart=0x0) returned 0x3e [0074.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hf6j0mu7rhnm 4tk0v5a.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.841] GetFileType (hFile=0x2b8) returned 0x1 [0074.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.841] GetFileType (hFile=0x2b8) returned 0x1 [0074.841] WriteFile (in: hFile=0x2b8, lpBuffer=0x27e5f18*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27e5f18*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2000, lpOverlapped=0x0) returned 1 [0074.842] CloseHandle (hObject=0x2b8) returned 1 [0074.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", lpFilePart=0x0) returned 0x3e [0074.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", lpFilePart=0x0) returned 0x3e [0074.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hf6j0mu7rhnm 4tk0v5a.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.842] GetFileType (hFile=0x2b8) returned 0x1 [0074.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.842] GetFileType (hFile=0x2b8) returned 0x1 [0074.842] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2000 [0074.842] WriteFile (in: hFile=0x2b8, lpBuffer=0x27e8ea8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27e8ea8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.843] CloseHandle (hObject=0x2b8) returned 1 [0074.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a", lpFilePart=0x0) returned 0x3e [0074.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aGY2ajBNdTdSaE5NIDR0SzBWNUEubTRh", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aGY2ajBNdTdSaE5NIDR0SzBWNUEubTRh", lpFilePart=0x0) returned 0x46 [0074.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hf6j0mu7rhnm 4tk0v5a.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4387a0d0, ftCreationTime.dwHighDateTime=0x1d5d846, ftLastAccessTime.dwLowDateTime=0xc3dfb770, ftLastAccessTime.dwHighDateTime=0x1d5e5a9, ftLastWriteTime.dwLowDateTime=0xd4533bc0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x200a)) returned 1 [0074.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.843] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hf6j0Mu7RhNM 4tK0V5A.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hf6j0mu7rhnm 4tk0v5a.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aGY2ajBNdTdSaE5NIDR0SzBWNUEubTRh" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\agy2ajbndtdsae5nidr0szbwnueubtrh")) returned 1 [0074.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", lpFilePart=0x0) returned 0x38 [0074.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imlmklnnxh p4k.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.845] GetFileType (hFile=0x2b8) returned 0x1 [0074.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.845] GetFileType (hFile=0x2b8) returned 0x1 [0074.845] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x45a [0074.845] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1104, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x450 [0074.845] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ea270, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27ea270*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.846] CloseHandle (hObject=0x2b8) returned 1 [0074.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", lpFilePart=0x0) returned 0x38 [0074.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.848] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imlmklnnxh p4k.avi"), fInfoLevelId=0x0, lpFileInformation=0x28565f0 | out: lpFileInformation=0x28565f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc1d050, ftCreationTime.dwHighDateTime=0x1d5df03, ftLastAccessTime.dwLowDateTime=0xfc917240, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xfc917240, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x45a)) returned 1 [0074.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", lpFilePart=0x0) returned 0x38 [0074.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imlmklnnxh p4k.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.848] GetFileType (hFile=0x2b8) returned 0x1 [0074.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.848] GetFileType (hFile=0x2b8) returned 0x1 [0074.848] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x45a [0074.848] ReadFile (in: hFile=0x2b8, lpBuffer=0x2856d00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2856d00*, lpNumberOfBytesRead=0x1c9aeb38*=0x45a, lpOverlapped=0x0) returned 1 [0074.848] CloseHandle (hObject=0x2b8) returned 1 [0074.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", lpFilePart=0x0) returned 0x38 [0074.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imlmklnnxh p4k.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.898] GetFileType (hFile=0x2b8) returned 0x1 [0074.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.898] GetFileType (hFile=0x2b8) returned 0x1 [0074.898] WriteFile (in: hFile=0x2b8, lpBuffer=0x26fa870*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x1c9aea78, lpOverlapped=0x0 | out: lpBuffer=0x26fa870*, lpNumberOfBytesWritten=0x1c9aea78*=0x460, lpOverlapped=0x0) returned 1 [0074.899] CloseHandle (hObject=0x2b8) returned 1 [0074.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", lpFilePart=0x0) returned 0x38 [0074.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", lpFilePart=0x0) returned 0x38 [0074.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imlmklnnxh p4k.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.900] GetFileType (hFile=0x2b8) returned 0x1 [0074.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.900] GetFileType (hFile=0x2b8) returned 0x1 [0074.900] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x460 [0074.900] WriteFile (in: hFile=0x2b8, lpBuffer=0x26fc648*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26fc648*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.900] CloseHandle (hObject=0x2b8) returned 1 [0074.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi", lpFilePart=0x0) returned 0x38 [0074.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aW1MbWtsTm54SCBQNEsuYXZp", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aW1MbWtsTm54SCBQNEsuYXZp", lpFilePart=0x0) returned 0x3e [0074.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imlmklnnxh p4k.avi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc1d050, ftCreationTime.dwHighDateTime=0x1d5df03, ftLastAccessTime.dwLowDateTime=0xfc917240, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xd45cc140, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x46a)) returned 1 [0074.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.901] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\imLmklNnxH P4K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imlmklnnxh p4k.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aW1MbWtsTm54SCBQNEsuYXZp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aw1mbwtstm54scbqnesuyxzp")) returned 1 [0074.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", lpFilePart=0x0) returned 0x2d [0074.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jts.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.932] GetFileType (hFile=0x2b8) returned 0x1 [0074.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.932] GetFileType (hFile=0x2b8) returned 0x1 [0074.932] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xed5e [0074.932] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=60756, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xed54 [0074.932] ReadFile (in: hFile=0x2b8, lpBuffer=0x26fd9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26fd9b8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.933] CloseHandle (hObject=0x2b8) returned 1 [0074.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", lpFilePart=0x0) returned 0x2d [0074.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.938] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jts.gif"), fInfoLevelId=0x0, lpFileInformation=0x2769db8 | out: lpFileInformation=0x2769db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9464cfa0, ftCreationTime.dwHighDateTime=0x1d5e147, ftLastAccessTime.dwLowDateTime=0xfe5044a0, ftLastAccessTime.dwHighDateTime=0x1d5e52d, ftLastWriteTime.dwLowDateTime=0xfe5044a0, ftLastWriteTime.dwHighDateTime=0x1d5e52d, nFileSizeHigh=0x0, nFileSizeLow=0xed5e)) returned 1 [0074.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", lpFilePart=0x0) returned 0x2d [0074.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jts.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.939] GetFileType (hFile=0x2b8) returned 0x1 [0074.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.939] GetFileType (hFile=0x2b8) returned 0x1 [0074.939] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xed5e [0074.939] ReadFile (in: hFile=0x2b8, lpBuffer=0x2769ff0, nNumberOfBytesToRead=0xed5e, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2769ff0*, lpNumberOfBytesRead=0x1c9aeb38*=0xed5e, lpOverlapped=0x0) returned 1 [0074.939] CloseHandle (hObject=0x2b8) returned 1 [0074.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", lpFilePart=0x0) returned 0x2d [0074.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0074.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jts.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.952] GetFileType (hFile=0x2b8) returned 0x1 [0074.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0074.952] GetFileType (hFile=0x2b8) returned 0x1 [0074.952] WriteFile (in: hFile=0x2b8, lpBuffer=0x280d408*, nNumberOfBytesToWrite=0xed60, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x280d408*, lpNumberOfBytesWritten=0x1c9aebc8*=0xed60, lpOverlapped=0x0) returned 1 [0074.954] CloseHandle (hObject=0x2b8) returned 1 [0074.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", lpFilePart=0x0) returned 0x2d [0074.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", lpFilePart=0x0) returned 0x2d [0074.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0074.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jts.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.955] GetFileType (hFile=0x2b8) returned 0x1 [0074.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0074.955] GetFileType (hFile=0x2b8) returned 0x1 [0074.955] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xed60 [0074.955] WriteFile (in: hFile=0x2b8, lpBuffer=0x281cfc8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x281cfc8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0074.955] CloseHandle (hObject=0x2b8) returned 1 [0074.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif", lpFilePart=0x0) returned 0x2d [0074.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SlRzLmdpZg==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SlRzLmdpZg==", lpFilePart=0x0) returned 0x32 [0074.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0074.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jts.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9464cfa0, ftCreationTime.dwHighDateTime=0x1d5e147, ftLastAccessTime.dwLowDateTime=0xfe5044a0, ftLastAccessTime.dwHighDateTime=0x1d5e52d, ftLastWriteTime.dwLowDateTime=0xd463e560, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xed6a)) returned 1 [0074.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0074.956] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JTs.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jts.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SlRzLmdpZg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\slrzlmdpzg==")) returned 1 [0074.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", lpFilePart=0x0) returned 0x3c [0074.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0074.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l6hss0a5rlecpxjyny.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.957] GetFileType (hFile=0x2b8) returned 0x1 [0074.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0074.957] GetFileType (hFile=0x2b8) returned 0x1 [0074.957] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x12d03 [0074.957] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=77049, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x12cf9 [0074.957] ReadFile (in: hFile=0x2b8, lpBuffer=0x281e330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x281e330*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0074.958] CloseHandle (hObject=0x2b8) returned 1 [0074.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11d00) returned 0x0 [0074.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", lpFilePart=0x0) returned 0x3c [0074.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0074.960] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l6hss0a5rlecpxjyny.mp3"), fInfoLevelId=0x0, lpFileInformation=0x288a6b0 | out: lpFileInformation=0x288a6b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be0c410, ftCreationTime.dwHighDateTime=0x1d5de9f, ftLastAccessTime.dwLowDateTime=0x671934f0, ftLastAccessTime.dwHighDateTime=0x1d5db66, ftLastWriteTime.dwLowDateTime=0x671934f0, ftLastWriteTime.dwHighDateTime=0x1d5db66, nFileSizeHigh=0x0, nFileSizeLow=0x12d03)) returned 1 [0074.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0074.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", lpFilePart=0x0) returned 0x3c [0074.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0074.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l6hss0a5rlecpxjyny.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0074.960] GetFileType (hFile=0x2b8) returned 0x1 [0074.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0074.960] GetFileType (hFile=0x2b8) returned 0x1 [0074.960] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x12d03 [0074.960] ReadFile (in: hFile=0x2b8, lpBuffer=0x288a968, nNumberOfBytesToRead=0x12d03, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x288a968*, lpNumberOfBytesRead=0x1c9aeb38*=0x12d03, lpOverlapped=0x0) returned 1 [0074.960] CloseHandle (hObject=0x2b8) returned 1 [0075.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", lpFilePart=0x0) returned 0x3c [0075.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l6hss0a5rlecpxjyny.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.052] GetFileType (hFile=0x2b8) returned 0x1 [0075.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.053] GetFileType (hFile=0x2b8) returned 0x1 [0075.053] WriteFile (in: hFile=0x2b8, lpBuffer=0x2777488*, nNumberOfBytesToWrite=0x12d10, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2777488*, lpNumberOfBytesWritten=0x1c9aebc8*=0x12d10, lpOverlapped=0x0) returned 1 [0075.054] CloseHandle (hObject=0x2b8) returned 1 [0075.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", lpFilePart=0x0) returned 0x3c [0075.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", lpFilePart=0x0) returned 0x3c [0075.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l6hss0a5rlecpxjyny.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.055] GetFileType (hFile=0x2b8) returned 0x1 [0075.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.055] GetFileType (hFile=0x2b8) returned 0x1 [0075.055] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x12d10 [0075.055] WriteFile (in: hFile=0x2b8, lpBuffer=0x278b308*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x278b308*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.056] CloseHandle (hObject=0x2b8) returned 1 [0075.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3", lpFilePart=0x0) returned 0x3c [0075.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bDZIc1MwQTVyTGVDUFhKeU5ZLm1wMw==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bDZIc1MwQTVyTGVDUFhKeU5ZLm1wMw==", lpFilePart=0x0) returned 0x46 [0075.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.056] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l6hss0a5rlecpxjyny.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be0c410, ftCreationTime.dwHighDateTime=0x1d5de9f, ftLastAccessTime.dwLowDateTime=0x671934f0, ftLastAccessTime.dwHighDateTime=0x1d5db66, ftLastWriteTime.dwLowDateTime=0xd4748f00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x12d1a)) returned 1 [0075.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.056] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\l6HsS0A5rLeCPXJyNY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l6hss0a5rlecpxjyny.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bDZIc1MwQTVyTGVDUFhKeU5ZLm1wMw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bdzic1mwqtvytgvdufhkeu5zlm1wmw==")) returned 1 [0075.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", lpFilePart=0x0) returned 0x39 [0075.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ms2hdxjixdhidrk.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.057] GetFileType (hFile=0x2b8) returned 0x1 [0075.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.057] GetFileType (hFile=0x2b8) returned 0x1 [0075.057] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x14a43 [0075.058] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=84537, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x14a39 [0075.058] ReadFile (in: hFile=0x2b8, lpBuffer=0x278c6d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x278c6d0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.058] CloseHandle (hObject=0x2b8) returned 1 [0075.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", lpFilePart=0x0) returned 0x39 [0075.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.064] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ms2hdxjixdhidrk.swf"), fInfoLevelId=0x0, lpFileInformation=0x27f8980 | out: lpFileInformation=0x27f8980*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ba9a80, ftCreationTime.dwHighDateTime=0x1d5dff9, ftLastAccessTime.dwLowDateTime=0x2850cde0, ftLastAccessTime.dwHighDateTime=0x1d5e30a, ftLastWriteTime.dwLowDateTime=0x2850cde0, ftLastWriteTime.dwHighDateTime=0x1d5e30a, nFileSizeHigh=0x0, nFileSizeLow=0x14a43)) returned 1 [0075.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", lpFilePart=0x0) returned 0x39 [0075.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ms2hdxjixdhidrk.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.064] GetFileType (hFile=0x2b8) returned 0x1 [0075.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.064] GetFileType (hFile=0x2b8) returned 0x1 [0075.064] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x14a43 [0075.064] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f8c18, nNumberOfBytesToRead=0x14a43, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27f8c18*, lpNumberOfBytesRead=0x1c9aeb38*=0x14a43, lpOverlapped=0x0) returned 1 [0075.065] CloseHandle (hObject=0x2b8) returned 1 [0075.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", lpFilePart=0x0) returned 0x39 [0075.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ms2hdxjixdhidrk.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.160] GetFileType (hFile=0x2b8) returned 0x1 [0075.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.160] GetFileType (hFile=0x2b8) returned 0x1 [0075.160] WriteFile (in: hFile=0x2b8, lpBuffer=0x2724838*, nNumberOfBytesToWrite=0x14a50, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2724838*, lpNumberOfBytesWritten=0x1c9aebc8*=0x14a50, lpOverlapped=0x0) returned 1 [0075.162] CloseHandle (hObject=0x2b8) returned 1 [0075.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", lpFilePart=0x0) returned 0x39 [0075.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", lpFilePart=0x0) returned 0x39 [0075.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ms2hdxjixdhidrk.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.163] GetFileType (hFile=0x2b8) returned 0x1 [0075.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.163] GetFileType (hFile=0x2b8) returned 0x1 [0075.163] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x14a50 [0075.163] WriteFile (in: hFile=0x2b8, lpBuffer=0x273a1c0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x273a1c0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.163] CloseHandle (hObject=0x2b8) returned 1 [0075.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf", lpFilePart=0x0) returned 0x39 [0075.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bVMyaGRYaml4ZEhpRFJrLnN3Zg==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bVMyaGRYaml4ZEhpRFJrLnN3Zg==", lpFilePart=0x0) returned 0x42 [0075.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.164] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ms2hdxjixdhidrk.swf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ba9a80, ftCreationTime.dwHighDateTime=0x1d5dff9, ftLastAccessTime.dwLowDateTime=0x2850cde0, ftLastAccessTime.dwHighDateTime=0x1d5e30a, ftLastWriteTime.dwLowDateTime=0xd48538a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a)) returned 1 [0075.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.164] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mS2hdXjixdHiDRk.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ms2hdxjixdhidrk.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bVMyaGRYaml4ZEhpRFJrLnN3Zg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bvmyagryaml4zehprfjrlnn3zg==")) returned 1 [0075.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", lpFilePart=0x0) returned 0x39 [0075.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\myhrvadrxgz3ktm.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.165] GetFileType (hFile=0x2b8) returned 0x1 [0075.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.165] GetFileType (hFile=0x2b8) returned 0x1 [0075.165] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x10fe2 [0075.165] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=69592, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x10fd8 [0075.165] ReadFile (in: hFile=0x2b8, lpBuffer=0x273b570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x273b570*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.166] CloseHandle (hObject=0x2b8) returned 1 [0075.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.174] SleepEx (dwMilliseconds=0x2, bAlertable=0) returned 0x0 [0075.175] SleepEx (dwMilliseconds=0x2, bAlertable=0) returned 0x0 [0075.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", lpFilePart=0x0) returned 0x39 [0075.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.194] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\myhrvadrxgz3ktm.ots"), fInfoLevelId=0x0, lpFileInformation=0x26b94a8 | out: lpFileInformation=0x26b94a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2b6f0, ftCreationTime.dwHighDateTime=0x1d5e23f, ftLastAccessTime.dwLowDateTime=0xc9cf8bb0, ftLastAccessTime.dwHighDateTime=0x1d5d979, ftLastWriteTime.dwLowDateTime=0xc9cf8bb0, ftLastWriteTime.dwHighDateTime=0x1d5d979, nFileSizeHigh=0x0, nFileSizeLow=0x10fe2)) returned 1 [0075.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", lpFilePart=0x0) returned 0x39 [0075.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\myhrvadrxgz3ktm.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.195] GetFileType (hFile=0x2b8) returned 0x1 [0075.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.195] GetFileType (hFile=0x2b8) returned 0x1 [0075.195] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x10fe2 [0075.195] ReadFile (in: hFile=0x2b8, lpBuffer=0x26b9740, nNumberOfBytesToRead=0x10fe2, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26b9740*, lpNumberOfBytesRead=0x1c9aeb38*=0x10fe2, lpOverlapped=0x0) returned 1 [0075.195] CloseHandle (hObject=0x2b8) returned 1 [0075.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", lpFilePart=0x0) returned 0x39 [0075.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\myhrvadrxgz3ktm.ots"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.238] GetFileType (hFile=0x2b8) returned 0x1 [0075.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.238] GetFileType (hFile=0x2b8) returned 0x1 [0075.238] WriteFile (in: hFile=0x2b8, lpBuffer=0x2763500*, nNumberOfBytesToWrite=0x10ff0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2763500*, lpNumberOfBytesWritten=0x1c9aebc8*=0x10ff0, lpOverlapped=0x0) returned 1 [0075.240] CloseHandle (hObject=0x2b8) returned 1 [0075.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", lpFilePart=0x0) returned 0x39 [0075.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", lpFilePart=0x0) returned 0x39 [0075.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\myhrvadrxgz3ktm.ots"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.240] GetFileType (hFile=0x2b8) returned 0x1 [0075.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.241] GetFileType (hFile=0x2b8) returned 0x1 [0075.241] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x10ff0 [0075.241] WriteFile (in: hFile=0x2b8, lpBuffer=0x2775428*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2775428*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.241] CloseHandle (hObject=0x2b8) returned 1 [0075.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots", lpFilePart=0x0) returned 0x39 [0075.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bXloUnZBRHJ4R3ozS3RNLm90cw==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bXloUnZBRHJ4R3ozS3RNLm90cw==", lpFilePart=0x0) returned 0x42 [0075.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.241] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\myhrvadrxgz3ktm.ots"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2b6f0, ftCreationTime.dwHighDateTime=0x1d5e23f, ftLastAccessTime.dwLowDateTime=0xc9cf8bb0, ftLastAccessTime.dwHighDateTime=0x1d5d979, ftLastWriteTime.dwLowDateTime=0xd4911f80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x10ffa)) returned 1 [0075.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.241] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\myhRvADrxGz3KtM.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\myhrvadrxgz3ktm.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bXloUnZBRHJ4R3ozS3RNLm90cw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxlounzbrhj4r3ozs3rnlm90cw==")) returned 1 [0075.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", lpFilePart=0x0) returned 0x3c [0075.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj4hiyandjonjxzeud.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.243] GetFileType (hFile=0x2b8) returned 0x1 [0075.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.243] GetFileType (hFile=0x2b8) returned 0x1 [0075.243] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x632a [0075.243] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=25376, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x6320 [0075.243] ReadFile (in: hFile=0x2b8, lpBuffer=0x27767e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27767e8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.244] CloseHandle (hObject=0x2b8) returned 1 [0075.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", lpFilePart=0x0) returned 0x3c [0075.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj4hiyandjonjxzeud.png"), fInfoLevelId=0x0, lpFileInformation=0x27e2a58 | out: lpFileInformation=0x27e2a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b026a0, ftCreationTime.dwHighDateTime=0x1d5db02, ftLastAccessTime.dwLowDateTime=0xd9781320, ftLastAccessTime.dwHighDateTime=0x1d5e815, ftLastWriteTime.dwLowDateTime=0xd9781320, ftLastWriteTime.dwHighDateTime=0x1d5e815, nFileSizeHigh=0x0, nFileSizeLow=0x632a)) returned 1 [0075.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", lpFilePart=0x0) returned 0x3c [0075.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj4hiyandjonjxzeud.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.251] GetFileType (hFile=0x2b8) returned 0x1 [0075.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.251] GetFileType (hFile=0x2b8) returned 0x1 [0075.251] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x632a [0075.251] ReadFile (in: hFile=0x2b8, lpBuffer=0x27e2d10, nNumberOfBytesToRead=0x632a, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27e2d10*, lpNumberOfBytesRead=0x1c9aeb38*=0x632a, lpOverlapped=0x0) returned 1 [0075.251] CloseHandle (hObject=0x2b8) returned 1 [0075.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", lpFilePart=0x0) returned 0x3c [0075.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj4hiyandjonjxzeud.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.274] GetFileType (hFile=0x2b8) returned 0x1 [0075.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.274] GetFileType (hFile=0x2b8) returned 0x1 [0075.274] WriteFile (in: hFile=0x2b8, lpBuffer=0x2878658*, nNumberOfBytesToWrite=0x6330, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2878658*, lpNumberOfBytesWritten=0x1c9aebc8*=0x6330, lpOverlapped=0x0) returned 1 [0075.275] CloseHandle (hObject=0x2b8) returned 1 [0075.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", lpFilePart=0x0) returned 0x3c [0075.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", lpFilePart=0x0) returned 0x3c [0075.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj4hiyandjonjxzeud.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.276] GetFileType (hFile=0x2b8) returned 0x1 [0075.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.276] GetFileType (hFile=0x2b8) returned 0x1 [0075.276] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x6330 [0075.276] WriteFile (in: hFile=0x2b8, lpBuffer=0x287f900*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x287f900*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.276] CloseHandle (hObject=0x2b8) returned 1 [0075.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png", lpFilePart=0x0) returned 0x3c [0075.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tko0aGlZYU5kak9Oalh6RVVkLnBuZw==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tko0aGlZYU5kak9Oalh6RVVkLnBuZw==", lpFilePart=0x0) returned 0x46 [0075.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.277] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj4hiyandjonjxzeud.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b026a0, ftCreationTime.dwHighDateTime=0x1d5db02, ftLastAccessTime.dwLowDateTime=0xd9781320, ftLastAccessTime.dwHighDateTime=0x1d5e815, ftLastWriteTime.dwLowDateTime=0xd495e240, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x633a)) returned 1 [0075.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.277] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NJ4hiYaNdjONjXzEUd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj4hiyandjonjxzeud.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tko0aGlZYU5kak9Oalh6RVVkLnBuZw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tko0aglzyu5kak9oalh6rvvklnbuzw==")) returned 1 [0075.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", lpFilePart=0x0) returned 0x33 [0075.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxqi pa d.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.278] GetFileType (hFile=0x2b8) returned 0x1 [0075.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.278] GetFileType (hFile=0x2b8) returned 0x1 [0075.279] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xe2f8 [0075.279] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=58094, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xe2ee [0075.279] ReadFile (in: hFile=0x2b8, lpBuffer=0x2880cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2880cb0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.279] CloseHandle (hObject=0x2b8) returned 1 [0075.280] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", lpFilePart=0x0) returned 0x33 [0075.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.296] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxqi pa d.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2710fb8 | out: lpFileInformation=0x2710fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50a04d00, ftCreationTime.dwHighDateTime=0x1d5e2ad, ftLastAccessTime.dwLowDateTime=0xddad8820, ftLastAccessTime.dwHighDateTime=0x1d5e6a4, ftLastWriteTime.dwLowDateTime=0xddad8820, ftLastWriteTime.dwHighDateTime=0x1d5e6a4, nFileSizeHigh=0x0, nFileSizeLow=0xe2f8)) returned 1 [0075.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", lpFilePart=0x0) returned 0x33 [0075.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxqi pa d.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.297] GetFileType (hFile=0x2b8) returned 0x1 [0075.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.297] GetFileType (hFile=0x2b8) returned 0x1 [0075.297] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xe2f8 [0075.297] ReadFile (in: hFile=0x2b8, lpBuffer=0x2711220, nNumberOfBytesToRead=0xe2f8, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2711220*, lpNumberOfBytesRead=0x1c9aeb38*=0xe2f8, lpOverlapped=0x0) returned 1 [0075.297] CloseHandle (hObject=0x2b8) returned 1 [0075.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", lpFilePart=0x0) returned 0x33 [0075.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxqi pa d.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.336] GetFileType (hFile=0x2b8) returned 0x1 [0075.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.336] GetFileType (hFile=0x2b8) returned 0x1 [0075.336] WriteFile (in: hFile=0x2b8, lpBuffer=0x27b2710*, nNumberOfBytesToWrite=0xe300, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27b2710*, lpNumberOfBytesWritten=0x1c9aebc8*=0xe300, lpOverlapped=0x0) returned 1 [0075.337] CloseHandle (hObject=0x2b8) returned 1 [0075.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", lpFilePart=0x0) returned 0x33 [0075.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", lpFilePart=0x0) returned 0x33 [0075.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxqi pa d.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.338] GetFileType (hFile=0x2b8) returned 0x1 [0075.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.338] GetFileType (hFile=0x2b8) returned 0x1 [0075.338] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xe300 [0075.338] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c18d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27c18d8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.339] CloseHandle (hObject=0x2b8) returned 1 [0075.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp", lpFilePart=0x0) returned 0x33 [0075.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UFhRaSBwQSBkLmJtcA==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UFhRaSBwQSBkLmJtcA==", lpFilePart=0x0) returned 0x3a [0075.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.339] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxqi pa d.bmp"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50a04d00, ftCreationTime.dwHighDateTime=0x1d5e2ad, ftLastAccessTime.dwLowDateTime=0xddad8820, ftLastAccessTime.dwHighDateTime=0x1d5e6a4, ftLastWriteTime.dwLowDateTime=0xd49f67c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe30a)) returned 1 [0075.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.339] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PXQi pA d.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxqi pa d.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UFhRaSBwQSBkLmJtcA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhrasbwqsbklmjtca==")) returned 1 [0075.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", lpFilePart=0x0) returned 0x2e [0075.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\roud.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.340] GetFileType (hFile=0x2b8) returned 0x1 [0075.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.340] GetFileType (hFile=0x2b8) returned 0x1 [0075.340] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x11d62 [0075.341] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=73048, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x11d58 [0075.341] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c2c30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27c2c30*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.341] CloseHandle (hObject=0x2b8) returned 1 [0075.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", lpFilePart=0x0) returned 0x2e [0075.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\roud.mkv"), fInfoLevelId=0x0, lpFileInformation=0x282ef20 | out: lpFileInformation=0x282ef20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfed5600, ftCreationTime.dwHighDateTime=0x1d5d887, ftLastAccessTime.dwLowDateTime=0x4cd9a240, ftLastAccessTime.dwHighDateTime=0x1d5e0a3, ftLastWriteTime.dwLowDateTime=0x4cd9a240, ftLastWriteTime.dwHighDateTime=0x1d5e0a3, nFileSizeHigh=0x0, nFileSizeLow=0x11d62)) returned 1 [0075.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", lpFilePart=0x0) returned 0x2e [0075.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\roud.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.347] GetFileType (hFile=0x2b8) returned 0x1 [0075.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.347] GetFileType (hFile=0x2b8) returned 0x1 [0075.347] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x11d62 [0075.347] ReadFile (in: hFile=0x2b8, lpBuffer=0x282f168, nNumberOfBytesToRead=0x11d62, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x282f168*, lpNumberOfBytesRead=0x1c9aeb38*=0x11d62, lpOverlapped=0x0) returned 1 [0075.348] CloseHandle (hObject=0x2b8) returned 1 [0075.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", lpFilePart=0x0) returned 0x2e [0075.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\roud.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.377] GetFileType (hFile=0x2b8) returned 0x1 [0075.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.377] GetFileType (hFile=0x2b8) returned 0x1 [0075.377] WriteFile (in: hFile=0x2b8, lpBuffer=0x26fa0f8*, nNumberOfBytesToWrite=0x11d70, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x26fa0f8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x11d70, lpOverlapped=0x0) returned 1 [0075.379] CloseHandle (hObject=0x2b8) returned 1 [0075.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", lpFilePart=0x0) returned 0x2e [0075.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", lpFilePart=0x0) returned 0x2e [0075.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\roud.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.380] GetFileType (hFile=0x2b8) returned 0x1 [0075.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.380] GetFileType (hFile=0x2b8) returned 0x1 [0075.380] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x11d70 [0075.380] WriteFile (in: hFile=0x2b8, lpBuffer=0x270cce0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x270cce0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.380] CloseHandle (hObject=0x2b8) returned 1 [0075.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv", lpFilePart=0x0) returned 0x2e [0075.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ck91ZC5ta3Y=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ck91ZC5ta3Y=", lpFilePart=0x0) returned 0x32 [0075.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.381] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\roud.mkv"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfed5600, ftCreationTime.dwHighDateTime=0x1d5d887, ftLastAccessTime.dwLowDateTime=0x4cd9a240, ftLastAccessTime.dwHighDateTime=0x1d5e0a3, ftLastWriteTime.dwLowDateTime=0xd4a68be0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x11d7a)) returned 1 [0075.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.381] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rOud.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\roud.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ck91ZC5ta3Y=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ck91zc5ta3y=")) returned 1 [0075.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", lpFilePart=0x0) returned 0x31 [0075.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrmhnr0.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.382] GetFileType (hFile=0x2b8) returned 0x1 [0075.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.382] GetFileType (hFile=0x2b8) returned 0x1 [0075.382] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x173d0 [0075.382] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=95174, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x173c6 [0075.382] ReadFile (in: hFile=0x2b8, lpBuffer=0x270e018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x270e018*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.383] CloseHandle (hObject=0x2b8) returned 1 [0075.384] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", lpFilePart=0x0) returned 0x31 [0075.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrmhnr0.flv"), fInfoLevelId=0x0, lpFileInformation=0x277a348 | out: lpFileInformation=0x277a348*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e86750, ftCreationTime.dwHighDateTime=0x1d5e1db, ftLastAccessTime.dwLowDateTime=0xe85d46d0, ftLastAccessTime.dwHighDateTime=0x1d5e527, ftLastWriteTime.dwLowDateTime=0xe85d46d0, ftLastWriteTime.dwHighDateTime=0x1d5e527, nFileSizeHigh=0x0, nFileSizeLow=0x173d0)) returned 1 [0075.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", lpFilePart=0x0) returned 0x31 [0075.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrmhnr0.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.389] GetFileType (hFile=0x2b8) returned 0x1 [0075.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.390] GetFileType (hFile=0x2b8) returned 0x1 [0075.390] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x173d0 [0075.390] ReadFile (in: hFile=0x2b8, lpBuffer=0x126ecf28, nNumberOfBytesToRead=0x173d0, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x126ecf28*, lpNumberOfBytesRead=0x1c9aeb38*=0x173d0, lpOverlapped=0x0) returned 1 [0075.391] CloseHandle (hObject=0x2b8) returned 1 [0075.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", lpFilePart=0x0) returned 0x31 [0075.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrmhnr0.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.431] GetFileType (hFile=0x2b8) returned 0x1 [0075.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.431] GetFileType (hFile=0x2b8) returned 0x1 [0075.431] WriteFile (in: hFile=0x2b8, lpBuffer=0x12761318*, nNumberOfBytesToWrite=0x173e0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12761318*, lpNumberOfBytesWritten=0x1c9aebc8*=0x173e0, lpOverlapped=0x0) returned 1 [0075.433] CloseHandle (hObject=0x2b8) returned 1 [0075.434] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", lpFilePart=0x0) returned 0x31 [0075.434] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", lpFilePart=0x0) returned 0x31 [0075.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrmhnr0.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.434] GetFileType (hFile=0x2b8) returned 0x1 [0075.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.434] GetFileType (hFile=0x2b8) returned 0x1 [0075.434] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x173e0 [0075.434] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f2200*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27f2200*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.434] CloseHandle (hObject=0x2b8) returned 1 [0075.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv", lpFilePart=0x0) returned 0x31 [0075.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\clJNSG5SMC5mbHY=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\clJNSG5SMC5mbHY=", lpFilePart=0x0) returned 0x36 [0075.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.435] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrmhnr0.flv"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e86750, ftCreationTime.dwHighDateTime=0x1d5e1db, ftLastAccessTime.dwLowDateTime=0xe85d46d0, ftLastAccessTime.dwHighDateTime=0x1d5e527, ftLastWriteTime.dwLowDateTime=0xd4adb000, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x173ea)) returned 1 [0075.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.435] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rRMHnR0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrmhnr0.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\clJNSG5SMC5mbHY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cljnsg5smc5mbhy=")) returned 1 [0075.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", lpFilePart=0x0) returned 0x38 [0075.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s jus7ap0qvvtv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.436] GetFileType (hFile=0x2b8) returned 0x1 [0075.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.436] GetFileType (hFile=0x2b8) returned 0x1 [0075.436] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xb7be [0075.436] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=47028, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xb7b4 [0075.436] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f3570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27f3570*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.437] CloseHandle (hObject=0x2b8) returned 1 [0075.437] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", lpFilePart=0x0) returned 0x38 [0075.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.439] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s jus7ap0qvvtv.mp4"), fInfoLevelId=0x0, lpFileInformation=0x285f8a0 | out: lpFileInformation=0x285f8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3233f690, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0xc2d67f0, ftLastAccessTime.dwHighDateTime=0x1d5e160, ftLastWriteTime.dwLowDateTime=0xc2d67f0, ftLastWriteTime.dwHighDateTime=0x1d5e160, nFileSizeHigh=0x0, nFileSizeLow=0xb7be)) returned 1 [0075.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.439] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", lpFilePart=0x0) returned 0x38 [0075.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s jus7ap0qvvtv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.439] GetFileType (hFile=0x2b8) returned 0x1 [0075.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.439] GetFileType (hFile=0x2b8) returned 0x1 [0075.439] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xb7be [0075.439] ReadFile (in: hFile=0x2b8, lpBuffer=0x285fb38, nNumberOfBytesToRead=0xb7be, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x285fb38*, lpNumberOfBytesRead=0x1c9aeb38*=0xb7be, lpOverlapped=0x0) returned 1 [0075.444] CloseHandle (hObject=0x2b8) returned 1 [0075.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", lpFilePart=0x0) returned 0x38 [0075.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s jus7ap0qvvtv.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.459] GetFileType (hFile=0x2b8) returned 0x1 [0075.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.459] GetFileType (hFile=0x2b8) returned 0x1 [0075.459] WriteFile (in: hFile=0x2b8, lpBuffer=0x28f8bd8*, nNumberOfBytesToWrite=0xb7c0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x28f8bd8*, lpNumberOfBytesWritten=0x1c9aebc8*=0xb7c0, lpOverlapped=0x0) returned 1 [0075.460] CloseHandle (hObject=0x2b8) returned 1 [0075.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", lpFilePart=0x0) returned 0x38 [0075.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", lpFilePart=0x0) returned 0x38 [0075.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s jus7ap0qvvtv.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.473] GetFileType (hFile=0x2b8) returned 0x1 [0075.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.474] GetFileType (hFile=0x2b8) returned 0x1 [0075.474] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xb7c0 [0075.474] WriteFile (in: hFile=0x2b8, lpBuffer=0x26c82f0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26c82f0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.474] CloseHandle (hObject=0x2b8) returned 1 [0075.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4", lpFilePart=0x0) returned 0x38 [0075.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cyBKdXM3QXAwUXZWdHYubXA0", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cyBKdXM3QXAwUXZWdHYubXA0", lpFilePart=0x0) returned 0x3e [0075.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.474] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s jus7ap0qvvtv.mp4"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3233f690, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0xc2d67f0, ftLastAccessTime.dwHighDateTime=0x1d5e160, ftLastWriteTime.dwLowDateTime=0xd4b4d420, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xb7ca)) returned 1 [0075.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.474] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s Jus7Ap0QvVtv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s jus7ap0qvvtv.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cyBKdXM3QXAwUXZWdHYubXA0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cybkdxm3qxawuxzwdhyubxa0")) returned 1 [0075.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", lpFilePart=0x0) returned 0x2e [0075.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s_py.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.475] GetFileType (hFile=0x2b8) returned 0x1 [0075.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.475] GetFileType (hFile=0x2b8) returned 0x1 [0075.475] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x14d9a [0075.475] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=85392, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x14d90 [0075.475] ReadFile (in: hFile=0x2b8, lpBuffer=0x26c9668, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26c9668*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.476] CloseHandle (hObject=0x2b8) returned 1 [0075.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", lpFilePart=0x0) returned 0x2e [0075.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.482] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s_py.avi"), fInfoLevelId=0x0, lpFileInformation=0x2735998 | out: lpFileInformation=0x2735998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2b8a60, ftCreationTime.dwHighDateTime=0x1d5dfc7, ftLastAccessTime.dwLowDateTime=0x89e4c6b0, ftLastAccessTime.dwHighDateTime=0x1d5de96, ftLastWriteTime.dwLowDateTime=0x89e4c6b0, ftLastWriteTime.dwHighDateTime=0x1d5de96, nFileSizeHigh=0x0, nFileSizeLow=0x14d9a)) returned 1 [0075.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", lpFilePart=0x0) returned 0x2e [0075.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s_py.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.482] GetFileType (hFile=0x2b8) returned 0x1 [0075.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.483] GetFileType (hFile=0x2b8) returned 0x1 [0075.483] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x14d9a [0075.483] ReadFile (in: hFile=0x2b8, lpBuffer=0x1278f6c8, nNumberOfBytesToRead=0x14d9a, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x1278f6c8*, lpNumberOfBytesRead=0x1c9aeb38*=0x14d9a, lpOverlapped=0x0) returned 1 [0075.484] CloseHandle (hObject=0x2b8) returned 1 [0075.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", lpFilePart=0x0) returned 0x2e [0075.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s_py.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.523] GetFileType (hFile=0x2b8) returned 0x1 [0075.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.523] GetFileType (hFile=0x2b8) returned 0x1 [0075.523] WriteFile (in: hFile=0x2b8, lpBuffer=0x127f7b88*, nNumberOfBytesToWrite=0x14da0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x127f7b88*, lpNumberOfBytesWritten=0x1c9aebc8*=0x14da0, lpOverlapped=0x0) returned 1 [0075.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", lpFilePart=0x0) returned 0x2e [0075.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", lpFilePart=0x0) returned 0x2e [0075.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s_py.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.526] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x14da0 [0075.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi", lpFilePart=0x0) returned 0x2e [0075.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c19wWS5hdmk=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c19wWS5hdmk=", lpFilePart=0x0) returned 0x32 [0075.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.526] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s_py.avi"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2b8a60, ftCreationTime.dwHighDateTime=0x1d5dfc7, ftLastAccessTime.dwLowDateTime=0x89e4c6b0, ftLastAccessTime.dwHighDateTime=0x1d5de96, ftLastWriteTime.dwLowDateTime=0xd4bbf840, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x14daa)) returned 1 [0075.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.526] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\s_pY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s_py.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c19wWS5hdmk=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c19wws5hdmk=")) returned 1 [0075.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", lpFilePart=0x0) returned 0x33 [0075.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tt6m-h27p.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.527] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x4a6e [0075.527] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=19044, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x4a64 [0075.527] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ae950, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27ae950*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", lpFilePart=0x0) returned 0x33 [0075.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tt6m-h27p.swf"), fInfoLevelId=0x0, lpFileInformation=0x281ac80 | out: lpFileInformation=0x281ac80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fed32d0, ftCreationTime.dwHighDateTime=0x1d5daf5, ftLastAccessTime.dwLowDateTime=0x17fce3a0, ftLastAccessTime.dwHighDateTime=0x1d5d9f2, ftLastWriteTime.dwLowDateTime=0x17fce3a0, ftLastWriteTime.dwHighDateTime=0x1d5d9f2, nFileSizeHigh=0x0, nFileSizeLow=0x4a6e)) returned 1 [0075.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", lpFilePart=0x0) returned 0x33 [0075.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tt6m-h27p.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.530] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x4a6e [0075.530] ReadFile (in: hFile=0x2b8, lpBuffer=0x281aee8, nNumberOfBytesToRead=0x4a6e, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x281aee8*, lpNumberOfBytesRead=0x1c9aeb38*=0x4a6e, lpOverlapped=0x0) returned 1 [0075.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", lpFilePart=0x0) returned 0x33 [0075.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tt6m-h27p.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", lpFilePart=0x0) returned 0x33 [0075.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", lpFilePart=0x0) returned 0x33 [0075.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tt6m-h27p.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.542] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4a70 [0075.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf", lpFilePart=0x0) returned 0x33 [0075.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dHQ2bS1oMjdwLnN3Zg==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dHQ2bS1oMjdwLnN3Zg==", lpFilePart=0x0) returned 0x3a [0075.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tt6m-h27p.swf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fed32d0, ftCreationTime.dwHighDateTime=0x1d5daf5, ftLastAccessTime.dwLowDateTime=0x17fce3a0, ftLastAccessTime.dwHighDateTime=0x1d5d9f2, ftLastWriteTime.dwLowDateTime=0xd4be59a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4a7a)) returned 1 [0075.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.542] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tt6m-h27p.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tt6m-h27p.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dHQ2bS1oMjdwLnN3Zg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dhq2bs1omjdwlnn3zg==")) returned 1 [0075.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", lpFilePart=0x0) returned 0x2e [0075.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u uz.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.543] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x2bc3 [0075.543] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=11193, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x2bb9 [0075.543] ReadFile (in: hFile=0x2b8, lpBuffer=0x28af900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28af900*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", lpFilePart=0x0) returned 0x2e [0075.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u uz.swf"), fInfoLevelId=0x0, lpFileInformation=0x274ed60 | out: lpFileInformation=0x274ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e2ea80, ftCreationTime.dwHighDateTime=0x1d5dd88, ftLastAccessTime.dwLowDateTime=0x81e05f70, ftLastAccessTime.dwHighDateTime=0x1d5d8a0, ftLastWriteTime.dwLowDateTime=0x81e05f70, ftLastWriteTime.dwHighDateTime=0x1d5d8a0, nFileSizeHigh=0x0, nFileSizeLow=0x2bc3)) returned 1 [0075.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", lpFilePart=0x0) returned 0x2e [0075.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u uz.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.563] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x2bc3 [0075.563] ReadFile (in: hFile=0x2b8, lpBuffer=0x274efa8, nNumberOfBytesToRead=0x2bc3, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x274efa8*, lpNumberOfBytesRead=0x1c9aeb38*=0x2bc3, lpOverlapped=0x0) returned 1 [0075.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", lpFilePart=0x0) returned 0x2e [0075.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u uz.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.600] GetFileType (hFile=0x2b8) returned 0x1 [0075.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.600] GetFileType (hFile=0x2b8) returned 0x1 [0075.600] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d38a0*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27d38a0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2bd0, lpOverlapped=0x0) returned 1 [0075.601] CloseHandle (hObject=0x2b8) returned 1 [0075.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", lpFilePart=0x0) returned 0x2e [0075.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", lpFilePart=0x0) returned 0x2e [0075.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u uz.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.602] GetFileType (hFile=0x2b8) returned 0x1 [0075.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.602] GetFileType (hFile=0x2b8) returned 0x1 [0075.602] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2bd0 [0075.602] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d72e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27d72e8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.602] CloseHandle (hObject=0x2b8) returned 1 [0075.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf", lpFilePart=0x0) returned 0x2e [0075.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dSBVei5zd2Y=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dSBVei5zd2Y=", lpFilePart=0x0) returned 0x32 [0075.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u uz.swf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e2ea80, ftCreationTime.dwHighDateTime=0x1d5dd88, ftLastAccessTime.dwLowDateTime=0x81e05f70, ftLastAccessTime.dwHighDateTime=0x1d5d8a0, ftLastWriteTime.dwLowDateTime=0xd4c7df20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x2bda)) returned 1 [0075.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.602] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u Uz.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u uz.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dSBVei5zd2Y=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dsbvei5zd2y=")) returned 1 [0075.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpFilePart=0x0) returned 0x71 [0075.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.603] GetFileType (hFile=0x2b8) returned 0x1 [0075.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.603] GetFileType (hFile=0x2b8) returned 0x1 [0075.603] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x27200 [0075.603] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=160246, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x271f6 [0075.603] ReadFile (in: hFile=0x2b8, lpBuffer=0x27d8720, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27d8720*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.604] CloseHandle (hObject=0x2b8) returned 1 [0075.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpFilePart=0x0) returned 0x71 [0075.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.606] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe"), fInfoLevelId=0x0, lpFileInformation=0x28448b0 | out: lpFileInformation=0x28448b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaa95700, ftCreationTime.dwHighDateTime=0x1d5f1ef, ftLastAccessTime.dwLowDateTime=0xaaa95700, ftLastAccessTime.dwHighDateTime=0x1d5f1ef, ftLastWriteTime.dwLowDateTime=0xa846fd00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x27200)) returned 1 [0075.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpFilePart=0x0) returned 0x71 [0075.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.606] GetFileType (hFile=0x2b8) returned 0x1 [0075.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.606] GetFileType (hFile=0x2b8) returned 0x1 [0075.606] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x27200 [0075.607] ReadFile (in: hFile=0x2b8, lpBuffer=0x1280c960, nNumberOfBytesToRead=0x27200, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x1280c960*, lpNumberOfBytesRead=0x1c9aeb38*=0x27200, lpOverlapped=0x0) returned 1 [0075.609] CloseHandle (hObject=0x2b8) returned 1 [0075.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe", lpFilePart=0x0) returned 0x71 [0075.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\us-2020-03-03-16-18-40-0c03624b-9417807a-3c69d917-c6c250ef-c4987959.com.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0075.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab3e0) returned 1 [0075.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", lpFilePart=0x0) returned 0x3e [0075.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlri46chd-3fbyruwkm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.639] GetFileType (hFile=0x2b8) returned 0x1 [0075.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.639] GetFileType (hFile=0x2b8) returned 0x1 [0075.639] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x13bc9 [0075.639] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=80831, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x13bbf [0075.639] ReadFile (in: hFile=0x2b8, lpBuffer=0x28bc7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28bc7d8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.640] CloseHandle (hObject=0x2b8) returned 1 [0075.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", lpFilePart=0x0) returned 0x3e [0075.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlri46chd-3fbyruwkm.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2761d98 | out: lpFileInformation=0x2761d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e03980, ftCreationTime.dwHighDateTime=0x1d5e591, ftLastAccessTime.dwLowDateTime=0xb2afa20, ftLastAccessTime.dwHighDateTime=0x1d5e002, ftLastWriteTime.dwLowDateTime=0xb2afa20, ftLastWriteTime.dwHighDateTime=0x1d5e002, nFileSizeHigh=0x0, nFileSizeLow=0x13bc9)) returned 1 [0075.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", lpFilePart=0x0) returned 0x3e [0075.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlri46chd-3fbyruwkm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.661] GetFileType (hFile=0x2b8) returned 0x1 [0075.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.661] GetFileType (hFile=0x2b8) returned 0x1 [0075.661] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x13bc9 [0075.661] ReadFile (in: hFile=0x2b8, lpBuffer=0x2762060, nNumberOfBytesToRead=0x13bc9, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2762060*, lpNumberOfBytesRead=0x1c9aeb38*=0x13bc9, lpOverlapped=0x0) returned 1 [0075.661] CloseHandle (hObject=0x2b8) returned 1 [0075.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", lpFilePart=0x0) returned 0x3e [0075.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlri46chd-3fbyruwkm.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.701] GetFileType (hFile=0x2b8) returned 0x1 [0075.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.701] GetFileType (hFile=0x2b8) returned 0x1 [0075.701] WriteFile (in: hFile=0x2b8, lpBuffer=0x2813fc8*, nNumberOfBytesToWrite=0x13bd0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2813fc8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x13bd0, lpOverlapped=0x0) returned 1 [0075.703] CloseHandle (hObject=0x2b8) returned 1 [0075.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", lpFilePart=0x0) returned 0x3e [0075.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", lpFilePart=0x0) returned 0x3e [0075.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlri46chd-3fbyruwkm.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.704] GetFileType (hFile=0x2b8) returned 0x1 [0075.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.704] GetFileType (hFile=0x2b8) returned 0x1 [0075.704] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x13bd0 [0075.704] WriteFile (in: hFile=0x2b8, lpBuffer=0x2828b28*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2828b28*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.704] CloseHandle (hObject=0x2b8) returned 1 [0075.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx", lpFilePart=0x0) returned 0x3e [0075.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d2xSaTQ2Y0hELTNmYllSdVdrTS54bHN4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d2xSaTQ2Y0hELTNmYllSdVdrTS54bHN4", lpFilePart=0x0) returned 0x46 [0075.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlri46chd-3fbyruwkm.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e03980, ftCreationTime.dwHighDateTime=0x1d5e591, ftLastAccessTime.dwLowDateTime=0xb2afa20, ftLastAccessTime.dwHighDateTime=0x1d5e002, ftLastWriteTime.dwLowDateTime=0xd4d62760, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x13bda)) returned 1 [0075.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.707] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wlRi46cHD-3fbYRuWkM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wlri46chd-3fbyruwkm.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d2xSaTQ2Y0hELTNmYllSdVdrTS54bHN4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d2xsatq2y0heltnmyllsdvdrts54bhn4")) returned 1 [0075.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", lpFilePart=0x0) returned 0x3b [0075.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x5kdmjr7az9kcd083.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.708] GetFileType (hFile=0x2b8) returned 0x1 [0075.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.708] GetFileType (hFile=0x2b8) returned 0x1 [0075.708] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x34ea [0075.708] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=13536, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x34e0 [0075.708] ReadFile (in: hFile=0x2b8, lpBuffer=0x2829ef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2829ef8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.709] CloseHandle (hObject=0x2b8) returned 1 [0075.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", lpFilePart=0x0) returned 0x3b [0075.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x5kdmjr7az9kcd083.ods"), fInfoLevelId=0x0, lpFileInformation=0x2896228 | out: lpFileInformation=0x2896228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7c90230, ftCreationTime.dwHighDateTime=0x1d5d97e, ftLastAccessTime.dwLowDateTime=0xb679bfb0, ftLastAccessTime.dwHighDateTime=0x1d5db70, ftLastWriteTime.dwLowDateTime=0xb679bfb0, ftLastWriteTime.dwHighDateTime=0x1d5db70, nFileSizeHigh=0x0, nFileSizeLow=0x34ea)) returned 1 [0075.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", lpFilePart=0x0) returned 0x3b [0075.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x5kdmjr7az9kcd083.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.715] GetFileType (hFile=0x2b8) returned 0x1 [0075.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.715] GetFileType (hFile=0x2b8) returned 0x1 [0075.715] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x34ea [0075.715] ReadFile (in: hFile=0x2b8, lpBuffer=0x28964d0, nNumberOfBytesToRead=0x34ea, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28964d0*, lpNumberOfBytesRead=0x1c9aeb38*=0x34ea, lpOverlapped=0x0) returned 1 [0075.715] CloseHandle (hObject=0x2b8) returned 1 [0075.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", lpFilePart=0x0) returned 0x3b [0075.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x5kdmjr7az9kcd083.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.728] GetFileType (hFile=0x2b8) returned 0x1 [0075.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.728] GetFileType (hFile=0x2b8) returned 0x1 [0075.728] WriteFile (in: hFile=0x2b8, lpBuffer=0x291d6d8*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x291d6d8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x34f0, lpOverlapped=0x0) returned 1 [0075.729] CloseHandle (hObject=0x2b8) returned 1 [0075.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", lpFilePart=0x0) returned 0x3b [0075.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", lpFilePart=0x0) returned 0x3b [0075.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x5kdmjr7az9kcd083.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.729] GetFileType (hFile=0x2b8) returned 0x1 [0075.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.729] GetFileType (hFile=0x2b8) returned 0x1 [0075.729] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x34f0 [0075.730] WriteFile (in: hFile=0x2b8, lpBuffer=0x2921b18*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2921b18*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.730] CloseHandle (hObject=0x2b8) returned 1 [0075.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods", lpFilePart=0x0) returned 0x3b [0075.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eDVLZE1KUjdBWjlLQ2QwODMub2Rz", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eDVLZE1KUjdBWjlLQ2QwODMub2Rz", lpFilePart=0x0) returned 0x42 [0075.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x5kdmjr7az9kcd083.ods"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7c90230, ftCreationTime.dwHighDateTime=0x1d5d97e, ftLastAccessTime.dwLowDateTime=0xb679bfb0, ftLastAccessTime.dwHighDateTime=0x1d5db70, ftLastWriteTime.dwLowDateTime=0xd4daea20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x34fa)) returned 1 [0075.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.730] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x5KdMJR7AZ9KCd083.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x5kdmjr7az9kcd083.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eDVLZE1KUjdBWjlLQ2QwODMub2Rz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edvlze1kujdbwjllq2qwodmub2rz")) returned 1 [0075.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", lpFilePart=0x0) returned 0x34 [0075.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhynqm1kvv.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.731] GetFileType (hFile=0x2b8) returned 0x1 [0075.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.731] GetFileType (hFile=0x2b8) returned 0x1 [0075.731] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x4a2b [0075.731] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=18977, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x4a21 [0075.731] ReadFile (in: hFile=0x2b8, lpBuffer=0x2922eb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2922eb8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.732] CloseHandle (hObject=0x2b8) returned 1 [0075.732] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", lpFilePart=0x0) returned 0x34 [0075.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhynqm1kvv.doc"), fInfoLevelId=0x0, lpFileInformation=0x2708b00 | out: lpFileInformation=0x2708b00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18189c20, ftCreationTime.dwHighDateTime=0x1d5dddb, ftLastAccessTime.dwLowDateTime=0xcbde0510, ftLastAccessTime.dwHighDateTime=0x1d5dc05, ftLastWriteTime.dwLowDateTime=0xcbde0510, ftLastWriteTime.dwHighDateTime=0x1d5dc05, nFileSizeHigh=0x0, nFileSizeLow=0x4a2b)) returned 1 [0075.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", lpFilePart=0x0) returned 0x34 [0075.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhynqm1kvv.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.762] GetFileType (hFile=0x2b8) returned 0x1 [0075.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.762] GetFileType (hFile=0x2b8) returned 0x1 [0075.762] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x4a2b [0075.762] ReadFile (in: hFile=0x2b8, lpBuffer=0x2708d78, nNumberOfBytesToRead=0x4a2b, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2708d78*, lpNumberOfBytesRead=0x1c9aeb38*=0x4a2b, lpOverlapped=0x0) returned 1 [0075.762] CloseHandle (hObject=0x2b8) returned 1 [0075.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", lpFilePart=0x0) returned 0x34 [0075.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhynqm1kvv.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.797] GetFileType (hFile=0x2b8) returned 0x1 [0075.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.797] GetFileType (hFile=0x2b8) returned 0x1 [0075.797] WriteFile (in: hFile=0x2b8, lpBuffer=0x2796e50*, nNumberOfBytesToWrite=0x4a30, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2796e50*, lpNumberOfBytesWritten=0x1c9aebc8*=0x4a30, lpOverlapped=0x0) returned 1 [0075.798] CloseHandle (hObject=0x2b8) returned 1 [0075.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", lpFilePart=0x0) returned 0x34 [0075.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", lpFilePart=0x0) returned 0x34 [0075.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhynqm1kvv.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.799] GetFileType (hFile=0x2b8) returned 0x1 [0075.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.799] GetFileType (hFile=0x2b8) returned 0x1 [0075.799] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x4a30 [0075.799] WriteFile (in: hFile=0x2b8, lpBuffer=0x279c768*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x279c768*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.799] CloseHandle (hObject=0x2b8) returned 1 [0075.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc", lpFilePart=0x0) returned 0x34 [0075.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WmhZblFtMWt2Vi5kb2M=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WmhZblFtMWt2Vi5kb2M=", lpFilePart=0x0) returned 0x3a [0075.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhynqm1kvv.doc"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18189c20, ftCreationTime.dwHighDateTime=0x1d5dddb, ftLastAccessTime.dwLowDateTime=0xcbde0510, ftLastAccessTime.dwHighDateTime=0x1d5dc05, ftLastWriteTime.dwLowDateTime=0xd4e6d100, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4a3a)) returned 1 [0075.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.800] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZhYnQm1kvV.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhynqm1kvv.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WmhZblFtMWt2Vi5kb2M=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wmhzblftmwt2vi5kb2m=")) returned 1 [0075.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", lpFilePart=0x0) returned 0x38 [0075.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0075.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zvaleabv8yapxh.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.801] GetFileType (hFile=0x2b8) returned 0x1 [0075.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0075.801] GetFileType (hFile=0x2b8) returned 0x1 [0075.801] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x5854 [0075.801] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=22602, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x584a [0075.801] ReadFile (in: hFile=0x2b8, lpBuffer=0x279daf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x279daf0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0075.802] CloseHandle (hObject=0x2b8) returned 1 [0075.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cb0) returned 0x0 [0075.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", lpFilePart=0x0) returned 0x38 [0075.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.808] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zvaleabv8yapxh.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2809d60 | out: lpFileInformation=0x2809d60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28538040, ftCreationTime.dwHighDateTime=0x1d5dba7, ftLastAccessTime.dwLowDateTime=0x14e039f0, ftLastAccessTime.dwHighDateTime=0x1d5dc19, ftLastWriteTime.dwLowDateTime=0x14e039f0, ftLastWriteTime.dwHighDateTime=0x1d5dc19, nFileSizeHigh=0x0, nFileSizeLow=0x5854)) returned 1 [0075.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0075.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", lpFilePart=0x0) returned 0x38 [0075.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0075.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zvaleabv8yapxh.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.808] GetFileType (hFile=0x2b8) returned 0x1 [0075.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0075.808] GetFileType (hFile=0x2b8) returned 0x1 [0075.808] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x5854 [0075.808] ReadFile (in: hFile=0x2b8, lpBuffer=0x2809ff8, nNumberOfBytesToRead=0x5854, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2809ff8*, lpNumberOfBytesRead=0x1c9aeb38*=0x5854, lpOverlapped=0x0) returned 1 [0075.809] CloseHandle (hObject=0x2b8) returned 1 [0075.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", lpFilePart=0x0) returned 0x38 [0075.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zvaleabv8yapxh.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.819] GetFileType (hFile=0x2b8) returned 0x1 [0075.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.819] GetFileType (hFile=0x2b8) returned 0x1 [0075.819] WriteFile (in: hFile=0x2b8, lpBuffer=0x289c330*, nNumberOfBytesToWrite=0x5860, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x289c330*, lpNumberOfBytesWritten=0x1c9aebc8*=0x5860, lpOverlapped=0x0) returned 1 [0075.821] CloseHandle (hObject=0x2b8) returned 1 [0075.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", lpFilePart=0x0) returned 0x38 [0075.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", lpFilePart=0x0) returned 0x38 [0075.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0075.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zvaleabv8yapxh.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.821] GetFileType (hFile=0x2b8) returned 0x1 [0075.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0075.821] GetFileType (hFile=0x2b8) returned 0x1 [0075.821] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x5860 [0075.821] WriteFile (in: hFile=0x2b8, lpBuffer=0x28a2ac0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28a2ac0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0075.821] CloseHandle (hObject=0x2b8) returned 1 [0075.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a", lpFilePart=0x0) returned 0x38 [0075.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WnZBTEVBYnY4WWFweEgubTRh", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WnZBTEVBYnY4WWFweEgubTRh", lpFilePart=0x0) returned 0x3e [0075.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0075.822] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zvaleabv8yapxh.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28538040, ftCreationTime.dwHighDateTime=0x1d5dba7, ftLastAccessTime.dwLowDateTime=0x14e039f0, ftLastAccessTime.dwHighDateTime=0x1d5dc19, ftLastWriteTime.dwLowDateTime=0xd4e93260, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x586a)) returned 1 [0075.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0075.822] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZvALEAbv8YapxH.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zvaleabv8yapxh.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WnZBTEVBYnY4WWFweEgubTRh" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wnzbtevbyny4wwfweegubtrh")) returned 1 [0075.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je", lpFilePart=0x0) returned 0x2f [0075.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\", lpFilePart=0x0) returned 0x30 [0075.823] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633b54d0, ftCreationTime.dwHighDateTime=0x1d5e435, ftLastAccessTime.dwLowDateTime=0xb020d800, ftLastAccessTime.dwHighDateTime=0x1d5e1cf, ftLastWriteTime.dwLowDateTime=0xb020d800, ftLastWriteTime.dwHighDateTime=0x1d5e1cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0075.823] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633b54d0, ftCreationTime.dwHighDateTime=0x1d5e435, ftLastAccessTime.dwLowDateTime=0xb020d800, ftLastAccessTime.dwHighDateTime=0x1d5e1cf, ftLastWriteTime.dwLowDateTime=0xb020d800, ftLastWriteTime.dwHighDateTime=0x1d5e1cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.823] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf707e5a0, ftCreationTime.dwHighDateTime=0x1d5e090, ftLastAccessTime.dwLowDateTime=0xde990880, ftLastAccessTime.dwHighDateTime=0x1d5e1e1, ftLastWriteTime.dwLowDateTime=0xde990880, ftLastWriteTime.dwHighDateTime=0x1d5e1e1, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7kkwBqkP4AiRF.bmp", cAlternateFileName="E7KKWB~1.BMP")) returned 1 [0075.823] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e11ff0, ftCreationTime.dwHighDateTime=0x1d5e59a, ftLastAccessTime.dwLowDateTime=0xcbd771d0, ftLastAccessTime.dwHighDateTime=0x1d5e57b, ftLastWriteTime.dwLowDateTime=0xcbd771d0, ftLastWriteTime.dwHighDateTime=0x1d5e57b, nFileSizeHigh=0x0, nFileSizeLow=0x12ff1, dwReserved0=0x0, dwReserved1=0x0, cFileName="KFucPAazOa.m4a", cAlternateFileName="KFUCPA~1.M4A")) returned 1 [0075.823] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a13de0, ftCreationTime.dwHighDateTime=0x1d5e413, ftLastAccessTime.dwLowDateTime=0x5cba8db0, ftLastAccessTime.dwHighDateTime=0x1d5e06b, ftLastWriteTime.dwLowDateTime=0x5cba8db0, ftLastWriteTime.dwHighDateTime=0x1d5e06b, nFileSizeHigh=0x0, nFileSizeLow=0xe007, dwReserved0=0x0, dwReserved1=0x0, cFileName="s_efwh3wQaYHReO.png", cAlternateFileName="S_EFWH~1.PNG")) returned 1 [0075.823] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc1e9e0, ftCreationTime.dwHighDateTime=0x1d5e3fd, ftLastAccessTime.dwLowDateTime=0x7dc08150, ftLastAccessTime.dwHighDateTime=0x1d5e722, ftLastWriteTime.dwLowDateTime=0x7dc08150, ftLastWriteTime.dwHighDateTime=0x1d5e722, nFileSizeHigh=0x0, nFileSizeLow=0x5f17, dwReserved0=0x0, dwReserved1=0x0, cFileName="YlJ3zrkG22uz8SmbFD.png", cAlternateFileName="YLJ3ZR~1.PNG")) returned 1 [0075.824] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.824] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0075.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0075.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0075.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0075.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je", lpFilePart=0x0) returned 0x2f [0075.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\", lpFilePart=0x0) returned 0x30 [0075.824] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633b54d0, ftCreationTime.dwHighDateTime=0x1d5e435, ftLastAccessTime.dwLowDateTime=0xb020d800, ftLastAccessTime.dwHighDateTime=0x1d5e1cf, ftLastWriteTime.dwLowDateTime=0xb020d800, ftLastWriteTime.dwHighDateTime=0x1d5e1cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0075.824] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633b54d0, ftCreationTime.dwHighDateTime=0x1d5e435, ftLastAccessTime.dwLowDateTime=0xb020d800, ftLastAccessTime.dwHighDateTime=0x1d5e1cf, ftLastWriteTime.dwLowDateTime=0xb020d800, ftLastWriteTime.dwHighDateTime=0x1d5e1cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.825] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf707e5a0, ftCreationTime.dwHighDateTime=0x1d5e090, ftLastAccessTime.dwLowDateTime=0xde990880, ftLastAccessTime.dwHighDateTime=0x1d5e1e1, ftLastWriteTime.dwLowDateTime=0xde990880, ftLastWriteTime.dwHighDateTime=0x1d5e1e1, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7kkwBqkP4AiRF.bmp", cAlternateFileName="E7KKWB~1.BMP")) returned 1 [0075.825] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e11ff0, ftCreationTime.dwHighDateTime=0x1d5e59a, ftLastAccessTime.dwLowDateTime=0xcbd771d0, ftLastAccessTime.dwHighDateTime=0x1d5e57b, ftLastWriteTime.dwLowDateTime=0xcbd771d0, ftLastWriteTime.dwHighDateTime=0x1d5e57b, nFileSizeHigh=0x0, nFileSizeLow=0x12ff1, dwReserved0=0x0, dwReserved1=0x0, cFileName="KFucPAazOa.m4a", cAlternateFileName="KFUCPA~1.M4A")) returned 1 [0075.825] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a13de0, ftCreationTime.dwHighDateTime=0x1d5e413, ftLastAccessTime.dwLowDateTime=0x5cba8db0, ftLastAccessTime.dwHighDateTime=0x1d5e06b, ftLastWriteTime.dwLowDateTime=0x5cba8db0, ftLastWriteTime.dwHighDateTime=0x1d5e06b, nFileSizeHigh=0x0, nFileSizeLow=0xe007, dwReserved0=0x0, dwReserved1=0x0, cFileName="s_efwh3wQaYHReO.png", cAlternateFileName="S_EFWH~1.PNG")) returned 1 [0075.825] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc1e9e0, ftCreationTime.dwHighDateTime=0x1d5e3fd, ftLastAccessTime.dwLowDateTime=0x7dc08150, ftLastAccessTime.dwHighDateTime=0x1d5e722, ftLastWriteTime.dwLowDateTime=0x7dc08150, ftLastWriteTime.dwHighDateTime=0x1d5e722, nFileSizeHigh=0x0, nFileSizeLow=0x5f17, dwReserved0=0x0, dwReserved1=0x0, cFileName="YlJ3zrkG22uz8SmbFD.png", cAlternateFileName="YLJ3ZR~1.PNG")) returned 1 [0075.825] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc1e9e0, ftCreationTime.dwHighDateTime=0x1d5e3fd, ftLastAccessTime.dwLowDateTime=0x7dc08150, ftLastAccessTime.dwHighDateTime=0x1d5e722, ftLastWriteTime.dwLowDateTime=0x7dc08150, ftLastWriteTime.dwHighDateTime=0x1d5e722, nFileSizeHigh=0x0, nFileSizeLow=0x5f17, dwReserved0=0x0, dwReserved1=0x0, cFileName="YlJ3zrkG22uz8SmbFD.png", cAlternateFileName="YLJ3ZR~1.PNG")) returned 0 [0075.825] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0075.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0075.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0075.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", lpFilePart=0x0) returned 0x42 [0075.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0075.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\e7kkwbqkp4airf.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.826] GetFileType (hFile=0x2b8) returned 0x1 [0075.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0075.826] GetFileType (hFile=0x2b8) returned 0x1 [0075.826] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x165e2 [0075.826] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=91608, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x165d8 [0075.826] ReadFile (in: hFile=0x2b8, lpBuffer=0x28a6ea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28a6ea0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0075.827] CloseHandle (hObject=0x2b8) returned 1 [0075.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11cb0) returned 0x0 [0075.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", lpFilePart=0x0) returned 0x42 [0075.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0075.840] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\e7kkwbqkp4airf.bmp"), fInfoLevelId=0x0, lpFileInformation=0x273c310 | out: lpFileInformation=0x273c310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf707e5a0, ftCreationTime.dwHighDateTime=0x1d5e090, ftLastAccessTime.dwLowDateTime=0xde990880, ftLastAccessTime.dwHighDateTime=0x1d5e1e1, ftLastWriteTime.dwLowDateTime=0xde990880, ftLastWriteTime.dwHighDateTime=0x1d5e1e1, nFileSizeHigh=0x0, nFileSizeLow=0x165e2)) returned 1 [0075.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0075.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", lpFilePart=0x0) returned 0x42 [0075.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0075.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\e7kkwbqkp4airf.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.841] GetFileType (hFile=0x2b8) returned 0x1 [0075.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0075.841] GetFileType (hFile=0x2b8) returned 0x1 [0075.841] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x165e2 [0075.841] ReadFile (in: hFile=0x2b8, lpBuffer=0x1291ee40, nNumberOfBytesToRead=0x165e2, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x1291ee40*, lpNumberOfBytesRead=0x1c9aea98*=0x165e2, lpOverlapped=0x0) returned 1 [0075.843] CloseHandle (hObject=0x2b8) returned 1 [0075.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", lpFilePart=0x0) returned 0x42 [0075.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0075.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\e7kkwbqkp4airf.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.904] GetFileType (hFile=0x2b8) returned 0x1 [0075.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0075.904] GetFileType (hFile=0x2b8) returned 0x1 [0075.904] WriteFile (in: hFile=0x2b8, lpBuffer=0x12935460*, nNumberOfBytesToWrite=0x165f0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x12935460*, lpNumberOfBytesWritten=0x1c9aeb28*=0x165f0, lpOverlapped=0x0) returned 1 [0075.909] CloseHandle (hObject=0x2b8) returned 1 [0075.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", lpFilePart=0x0) returned 0x42 [0075.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", lpFilePart=0x0) returned 0x42 [0075.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0075.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\e7kkwbqkp4airf.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.911] GetFileType (hFile=0x2b8) returned 0x1 [0075.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0075.911] GetFileType (hFile=0x2b8) returned 0x1 [0075.911] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x165f0 [0075.911] WriteFile (in: hFile=0x2b8, lpBuffer=0x26928d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x26928d8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0075.911] CloseHandle (hObject=0x2b8) returned 1 [0075.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp", lpFilePart=0x0) returned 0x42 [0075.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\RTdra3dCcWtQNEFpUkYuYm1w", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\RTdra3dCcWtQNEFpUkYuYm1w", lpFilePart=0x0) returned 0x48 [0075.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0075.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\e7kkwbqkp4airf.bmp"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf707e5a0, ftCreationTime.dwHighDateTime=0x1d5e090, ftLastAccessTime.dwLowDateTime=0xde990880, ftLastAccessTime.dwHighDateTime=0x1d5e1e1, ftLastWriteTime.dwLowDateTime=0xd4f77aa0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x165fa)) returned 1 [0075.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0075.911] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\E7kkwBqkP4AiRF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\e7kkwbqkp4airf.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\RTdra3dCcWtQNEFpUkYuYm1w" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\rtdra3dccwtqnefpukyuym1w")) returned 1 [0075.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", lpFilePart=0x0) returned 0x3e [0075.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0075.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\kfucpaazoa.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.912] GetFileType (hFile=0x2b8) returned 0x1 [0075.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0075.912] GetFileType (hFile=0x2b8) returned 0x1 [0075.912] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x12ff1 [0075.912] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=77799, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x12fe7 [0075.912] ReadFile (in: hFile=0x2b8, lpBuffer=0x2693cb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2693cb8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0075.913] CloseHandle (hObject=0x2b8) returned 1 [0075.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11cb0) returned 0x0 [0075.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", lpFilePart=0x0) returned 0x3e [0075.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0075.920] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\kfucpaazoa.m4a"), fInfoLevelId=0x0, lpFileInformation=0x26fffe8 | out: lpFileInformation=0x26fffe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e11ff0, ftCreationTime.dwHighDateTime=0x1d5e59a, ftLastAccessTime.dwLowDateTime=0xcbd771d0, ftLastAccessTime.dwHighDateTime=0x1d5e57b, ftLastWriteTime.dwLowDateTime=0xcbd771d0, ftLastWriteTime.dwHighDateTime=0x1d5e57b, nFileSizeHigh=0x0, nFileSizeLow=0x12ff1)) returned 1 [0075.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0075.920] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", lpFilePart=0x0) returned 0x3e [0075.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0075.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\kfucpaazoa.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.920] GetFileType (hFile=0x2b8) returned 0x1 [0075.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0075.920] GetFileType (hFile=0x2b8) returned 0x1 [0075.920] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x12ff1 [0075.920] ReadFile (in: hFile=0x2b8, lpBuffer=0x2700280, nNumberOfBytesToRead=0x12ff1, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2700280*, lpNumberOfBytesRead=0x1c9aea98*=0x12ff1, lpOverlapped=0x0) returned 1 [0075.921] CloseHandle (hObject=0x2b8) returned 1 [0075.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", lpFilePart=0x0) returned 0x3e [0075.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0075.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\kfucpaazoa.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0075.999] GetFileType (hFile=0x2b8) returned 0x1 [0075.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0075.999] GetFileType (hFile=0x2b8) returned 0x1 [0075.999] WriteFile (in: hFile=0x2b8, lpBuffer=0x27afe78*, nNumberOfBytesToWrite=0x13000, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x27afe78*, lpNumberOfBytesWritten=0x1c9aeb28*=0x13000, lpOverlapped=0x0) returned 1 [0076.001] CloseHandle (hObject=0x2b8) returned 1 [0076.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", lpFilePart=0x0) returned 0x3e [0076.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", lpFilePart=0x0) returned 0x3e [0076.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\kfucpaazoa.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.003] GetFileType (hFile=0x2b8) returned 0x1 [0076.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.003] GetFileType (hFile=0x2b8) returned 0x1 [0076.003] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x13000 [0076.003] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c3fa8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27c3fa8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.003] CloseHandle (hObject=0x2b8) returned 1 [0076.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a", lpFilePart=0x0) returned 0x3e [0076.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\S0Z1Y1BBYXpPYS5tNGE=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\S0Z1Y1BBYXpPYS5tNGE=", lpFilePart=0x0) returned 0x44 [0076.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.003] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\kfucpaazoa.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e11ff0, ftCreationTime.dwHighDateTime=0x1d5e59a, ftLastAccessTime.dwLowDateTime=0xcbd771d0, ftLastAccessTime.dwHighDateTime=0x1d5e57b, ftLastWriteTime.dwLowDateTime=0xd505c2e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1300a)) returned 1 [0076.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.004] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\KFucPAazOa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\kfucpaazoa.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\S0Z1Y1BBYXpPYS5tNGE=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\s0z1y1bbyxppys5tnge=")) returned 1 [0076.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", lpFilePart=0x0) returned 0x43 [0076.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\s_efwh3wqayhreo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.004] GetFileType (hFile=0x2b8) returned 0x1 [0076.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.004] GetFileType (hFile=0x2b8) returned 0x1 [0076.004] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xe007 [0076.004] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=57341, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xdffd [0076.005] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c5380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27c5380*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.005] CloseHandle (hObject=0x2b8) returned 1 [0076.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11cb0) returned 0x0 [0076.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", lpFilePart=0x0) returned 0x43 [0076.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.007] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\s_efwh3wqayhreo.png"), fInfoLevelId=0x0, lpFileInformation=0x2831630 | out: lpFileInformation=0x2831630*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a13de0, ftCreationTime.dwHighDateTime=0x1d5e413, ftLastAccessTime.dwLowDateTime=0x5cba8db0, ftLastAccessTime.dwHighDateTime=0x1d5e06b, ftLastWriteTime.dwLowDateTime=0x5cba8db0, ftLastWriteTime.dwHighDateTime=0x1d5e06b, nFileSizeHigh=0x0, nFileSizeLow=0xe007)) returned 1 [0076.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", lpFilePart=0x0) returned 0x43 [0076.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\s_efwh3wqayhreo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.007] GetFileType (hFile=0x2b8) returned 0x1 [0076.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.007] GetFileType (hFile=0x2b8) returned 0x1 [0076.007] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xe007 [0076.007] ReadFile (in: hFile=0x2b8, lpBuffer=0x28318e8, nNumberOfBytesToRead=0xe007, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28318e8*, lpNumberOfBytesRead=0x1c9aea98*=0xe007, lpOverlapped=0x0) returned 1 [0076.008] CloseHandle (hObject=0x2b8) returned 1 [0076.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", lpFilePart=0x0) returned 0x43 [0076.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\s_efwh3wqayhreo.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.057] GetFileType (hFile=0x2b8) returned 0x1 [0076.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.057] GetFileType (hFile=0x2b8) returned 0x1 [0076.057] WriteFile (in: hFile=0x2b8, lpBuffer=0x270a798*, nNumberOfBytesToWrite=0xe010, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x270a798*, lpNumberOfBytesWritten=0x1c9aeb28*=0xe010, lpOverlapped=0x0) returned 1 [0076.059] CloseHandle (hObject=0x2b8) returned 1 [0076.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", lpFilePart=0x0) returned 0x43 [0076.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", lpFilePart=0x0) returned 0x43 [0076.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\s_efwh3wqayhreo.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.059] GetFileType (hFile=0x2b8) returned 0x1 [0076.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.059] GetFileType (hFile=0x2b8) returned 0x1 [0076.059] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xe010 [0076.060] WriteFile (in: hFile=0x2b8, lpBuffer=0x2719730*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2719730*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.060] CloseHandle (hObject=0x2b8) returned 1 [0076.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png", lpFilePart=0x0) returned 0x43 [0076.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\c19lZndoM3dRYVlIUmVPLnBuZw==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\c19lZndoM3dRYVlIUmVPLnBuZw==", lpFilePart=0x0) returned 0x4c [0076.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\s_efwh3wqayhreo.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a13de0, ftCreationTime.dwHighDateTime=0x1d5e413, ftLastAccessTime.dwLowDateTime=0x5cba8db0, ftLastAccessTime.dwHighDateTime=0x1d5e06b, ftLastWriteTime.dwLowDateTime=0xd50ce700, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe01a)) returned 1 [0076.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.060] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\s_efwh3wQaYHReO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\s_efwh3wqayhreo.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\c19lZndoM3dRYVlIUmVPLnBuZw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\c19lzndom3dryvliumvplnbuzw==")) returned 1 [0076.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", lpFilePart=0x0) returned 0x46 [0076.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\ylj3zrkg22uz8smbfd.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.061] GetFileType (hFile=0x2b8) returned 0x1 [0076.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.061] GetFileType (hFile=0x2b8) returned 0x1 [0076.061] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x5f17 [0076.061] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=24333, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x5f0d [0076.061] ReadFile (in: hFile=0x2b8, lpBuffer=0x271ab40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x271ab40*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.062] CloseHandle (hObject=0x2b8) returned 1 [0076.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11cb0) returned 0x0 [0076.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", lpFilePart=0x0) returned 0x46 [0076.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.068] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\ylj3zrkg22uz8smbfd.png"), fInfoLevelId=0x0, lpFileInformation=0x2786e30 | out: lpFileInformation=0x2786e30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc1e9e0, ftCreationTime.dwHighDateTime=0x1d5e3fd, ftLastAccessTime.dwLowDateTime=0x7dc08150, ftLastAccessTime.dwHighDateTime=0x1d5e722, ftLastWriteTime.dwLowDateTime=0x7dc08150, ftLastWriteTime.dwHighDateTime=0x1d5e722, nFileSizeHigh=0x0, nFileSizeLow=0x5f17)) returned 1 [0076.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", lpFilePart=0x0) returned 0x46 [0076.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\ylj3zrkg22uz8smbfd.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.068] GetFileType (hFile=0x2b8) returned 0x1 [0076.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.068] GetFileType (hFile=0x2b8) returned 0x1 [0076.068] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x5f17 [0076.068] ReadFile (in: hFile=0x2b8, lpBuffer=0x2787108, nNumberOfBytesToRead=0x5f17, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2787108*, lpNumberOfBytesRead=0x1c9aea98*=0x5f17, lpOverlapped=0x0) returned 1 [0076.069] CloseHandle (hObject=0x2b8) returned 1 [0076.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", lpFilePart=0x0) returned 0x46 [0076.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\ylj3zrkg22uz8smbfd.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.081] GetFileType (hFile=0x2b8) returned 0x1 [0076.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.081] GetFileType (hFile=0x2b8) returned 0x1 [0076.081] WriteFile (in: hFile=0x2b8, lpBuffer=0x281b898*, nNumberOfBytesToWrite=0x5f20, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x281b898*, lpNumberOfBytesWritten=0x1c9aeb28*=0x5f20, lpOverlapped=0x0) returned 1 [0076.082] CloseHandle (hObject=0x2b8) returned 1 [0076.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", lpFilePart=0x0) returned 0x46 [0076.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", lpFilePart=0x0) returned 0x46 [0076.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\ylj3zrkg22uz8smbfd.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.083] GetFileType (hFile=0x2b8) returned 0x1 [0076.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.083] GetFileType (hFile=0x2b8) returned 0x1 [0076.083] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x5f20 [0076.083] WriteFile (in: hFile=0x2b8, lpBuffer=0x2822780*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2822780*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.083] CloseHandle (hObject=0x2b8) returned 1 [0076.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png", lpFilePart=0x0) returned 0x46 [0076.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\WWxKM3pya0cyMnV6OFNtYkZELnBuZw==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\WWxKM3pya0cyMnV6OFNtYkZELnBuZw==", lpFilePart=0x0) returned 0x50 [0076.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\ylj3zrkg22uz8smbfd.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc1e9e0, ftCreationTime.dwHighDateTime=0x1d5e3fd, ftLastAccessTime.dwLowDateTime=0x7dc08150, ftLastAccessTime.dwHighDateTime=0x1d5e722, ftLastWriteTime.dwLowDateTime=0xd511a9c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x5f2a)) returned 1 [0076.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.083] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\YlJ3zrkG22uz8SmbFD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\ylj3zrkg22uz8smbfd.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\WWxKM3pya0cyMnV6OFNtYkZELnBuZw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\wwxkm3pya0cymnv6ofntykzelnbuzw==")) returned 1 [0076.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\README_3728769.txt", lpFilePart=0x0) returned 0x42 [0076.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0076.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\95g6Z 0Je\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\95g6z 0je\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0076.084] GetFileType (hFile=0x2b8) returned 0x1 [0076.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0076.084] GetFileType (hFile=0x2b8) returned 0x1 [0076.084] WriteFile (in: hFile=0x2b8, lpBuffer=0x2826a90*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x2826a90*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0076.085] CloseHandle (hObject=0x2b8) returned 1 [0076.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0076.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w", lpFilePart=0x0) returned 0x2a [0076.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\", lpFilePart=0x0) returned 0x2b [0076.086] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83f3eec0, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xcfd28790, ftLastAccessTime.dwHighDateTime=0x1d5e4a7, ftLastWriteTime.dwLowDateTime=0xcfd28790, ftLastWriteTime.dwHighDateTime=0x1d5e4a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0076.086] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83f3eec0, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xcfd28790, ftLastAccessTime.dwHighDateTime=0x1d5e4a7, ftLastWriteTime.dwLowDateTime=0xcfd28790, ftLastWriteTime.dwHighDateTime=0x1d5e4a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.086] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1269d9a0, ftCreationTime.dwHighDateTime=0x1d5d922, ftLastAccessTime.dwLowDateTime=0xf27f7640, ftLastAccessTime.dwHighDateTime=0x1d5deee, ftLastWriteTime.dwLowDateTime=0xf27f7640, ftLastWriteTime.dwHighDateTime=0x1d5deee, nFileSizeHigh=0x0, nFileSizeLow=0xfd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="2deiBcdelLz5ov79CC.jpg", cAlternateFileName="2DEIBC~1.JPG")) returned 1 [0076.086] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb254260, ftCreationTime.dwHighDateTime=0x1d5dea9, ftLastAccessTime.dwLowDateTime=0x6c1a9f90, ftLastAccessTime.dwHighDateTime=0x1d5e384, ftLastWriteTime.dwLowDateTime=0x6c1a9f90, ftLastWriteTime.dwHighDateTime=0x1d5e384, nFileSizeHigh=0x0, nFileSizeLow=0x71a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="O22O_DlY_T4fmAZtMtSo.m4a", cAlternateFileName="O22O_D~1.M4A")) returned 1 [0076.086] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3dce0, ftCreationTime.dwHighDateTime=0x1d5dc1a, ftLastAccessTime.dwLowDateTime=0x8d9fc560, ftLastAccessTime.dwHighDateTime=0x1d5e7b6, ftLastWriteTime.dwLowDateTime=0x8d9fc560, ftLastWriteTime.dwHighDateTime=0x1d5e7b6, nFileSizeHigh=0x0, nFileSizeLow=0x6db3, dwReserved0=0x0, dwReserved1=0x0, cFileName="vIE78t0uKaJ9.swf", cAlternateFileName="VIE78T~1.SWF")) returned 1 [0076.086] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6a31150, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x632bc4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddf0, ftLastWriteTime.dwLowDateTime=0x632bc4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xb38HcXs", cAlternateFileName="")) returned 1 [0076.087] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf8144e0, ftCreationTime.dwHighDateTime=0x1d5e62f, ftLastAccessTime.dwLowDateTime=0x2dfa9460, ftLastAccessTime.dwHighDateTime=0x1d5df1d, ftLastWriteTime.dwLowDateTime=0x2dfa9460, ftLastWriteTime.dwHighDateTime=0x1d5df1d, nFileSizeHigh=0x0, nFileSizeLow=0x9949, dwReserved0=0x0, dwReserved1=0x0, cFileName="xVbEeivw5T.ppt", cAlternateFileName="XVBEEI~1.PPT")) returned 1 [0076.087] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.087] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0076.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0076.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0076.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0076.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w", lpFilePart=0x0) returned 0x2a [0076.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\", lpFilePart=0x0) returned 0x2b [0076.088] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83f3eec0, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xcfd28790, ftLastAccessTime.dwHighDateTime=0x1d5e4a7, ftLastWriteTime.dwLowDateTime=0xcfd28790, ftLastWriteTime.dwHighDateTime=0x1d5e4a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0076.088] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83f3eec0, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xcfd28790, ftLastAccessTime.dwHighDateTime=0x1d5e4a7, ftLastWriteTime.dwLowDateTime=0xcfd28790, ftLastWriteTime.dwHighDateTime=0x1d5e4a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.088] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1269d9a0, ftCreationTime.dwHighDateTime=0x1d5d922, ftLastAccessTime.dwLowDateTime=0xf27f7640, ftLastAccessTime.dwHighDateTime=0x1d5deee, ftLastWriteTime.dwLowDateTime=0xf27f7640, ftLastWriteTime.dwHighDateTime=0x1d5deee, nFileSizeHigh=0x0, nFileSizeLow=0xfd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="2deiBcdelLz5ov79CC.jpg", cAlternateFileName="2DEIBC~1.JPG")) returned 1 [0076.088] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb254260, ftCreationTime.dwHighDateTime=0x1d5dea9, ftLastAccessTime.dwLowDateTime=0x6c1a9f90, ftLastAccessTime.dwHighDateTime=0x1d5e384, ftLastWriteTime.dwLowDateTime=0x6c1a9f90, ftLastWriteTime.dwHighDateTime=0x1d5e384, nFileSizeHigh=0x0, nFileSizeLow=0x71a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="O22O_DlY_T4fmAZtMtSo.m4a", cAlternateFileName="O22O_D~1.M4A")) returned 1 [0076.088] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3dce0, ftCreationTime.dwHighDateTime=0x1d5dc1a, ftLastAccessTime.dwLowDateTime=0x8d9fc560, ftLastAccessTime.dwHighDateTime=0x1d5e7b6, ftLastWriteTime.dwLowDateTime=0x8d9fc560, ftLastWriteTime.dwHighDateTime=0x1d5e7b6, nFileSizeHigh=0x0, nFileSizeLow=0x6db3, dwReserved0=0x0, dwReserved1=0x0, cFileName="vIE78t0uKaJ9.swf", cAlternateFileName="VIE78T~1.SWF")) returned 1 [0076.088] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6a31150, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x632bc4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddf0, ftLastWriteTime.dwLowDateTime=0x632bc4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xb38HcXs", cAlternateFileName="")) returned 1 [0076.089] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf8144e0, ftCreationTime.dwHighDateTime=0x1d5e62f, ftLastAccessTime.dwLowDateTime=0x2dfa9460, ftLastAccessTime.dwHighDateTime=0x1d5df1d, ftLastWriteTime.dwLowDateTime=0x2dfa9460, ftLastWriteTime.dwHighDateTime=0x1d5df1d, nFileSizeHigh=0x0, nFileSizeLow=0x9949, dwReserved0=0x0, dwReserved1=0x0, cFileName="xVbEeivw5T.ppt", cAlternateFileName="XVBEEI~1.PPT")) returned 1 [0076.089] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf8144e0, ftCreationTime.dwHighDateTime=0x1d5e62f, ftLastAccessTime.dwLowDateTime=0x2dfa9460, ftLastAccessTime.dwHighDateTime=0x1d5df1d, ftLastWriteTime.dwLowDateTime=0x2dfa9460, ftLastWriteTime.dwHighDateTime=0x1d5df1d, nFileSizeHigh=0x0, nFileSizeLow=0x9949, dwReserved0=0x0, dwReserved1=0x0, cFileName="xVbEeivw5T.ppt", cAlternateFileName="XVBEEI~1.PPT")) returned 0 [0076.089] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0076.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0076.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0076.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", lpFilePart=0x0) returned 0x41 [0076.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\2deibcdellz5ov79cc.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.089] GetFileType (hFile=0x2b8) returned 0x1 [0076.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.089] GetFileType (hFile=0x2b8) returned 0x1 [0076.089] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xfd10 [0076.089] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=64774, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xfd06 [0076.089] ReadFile (in: hFile=0x2b8, lpBuffer=0x282ae78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x282ae78*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.090] CloseHandle (hObject=0x2b8) returned 1 [0076.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11cb0) returned 0x0 [0076.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", lpFilePart=0x0) returned 0x41 [0076.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\2deibcdellz5ov79cc.jpg"), fInfoLevelId=0x0, lpFileInformation=0x28971a8 | out: lpFileInformation=0x28971a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1269d9a0, ftCreationTime.dwHighDateTime=0x1d5d922, ftLastAccessTime.dwLowDateTime=0xf27f7640, ftLastAccessTime.dwHighDateTime=0x1d5deee, ftLastWriteTime.dwLowDateTime=0xf27f7640, ftLastWriteTime.dwHighDateTime=0x1d5deee, nFileSizeHigh=0x0, nFileSizeLow=0xfd10)) returned 1 [0076.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", lpFilePart=0x0) returned 0x41 [0076.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\2deibcdellz5ov79cc.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.093] GetFileType (hFile=0x2b8) returned 0x1 [0076.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.093] GetFileType (hFile=0x2b8) returned 0x1 [0076.093] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xfd10 [0076.094] ReadFile (in: hFile=0x2b8, lpBuffer=0x2897470, nNumberOfBytesToRead=0xfd10, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2897470*, lpNumberOfBytesRead=0x1c9aea98*=0xfd10, lpOverlapped=0x0) returned 1 [0076.094] CloseHandle (hObject=0x2b8) returned 1 [0076.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", lpFilePart=0x0) returned 0x41 [0076.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\2deibcdellz5ov79cc.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.147] GetFileType (hFile=0x2b8) returned 0x1 [0076.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.147] GetFileType (hFile=0x2b8) returned 0x1 [0076.147] WriteFile (in: hFile=0x2b8, lpBuffer=0x2777a40*, nNumberOfBytesToWrite=0xfd20, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2777a40*, lpNumberOfBytesWritten=0x1c9aeb28*=0xfd20, lpOverlapped=0x0) returned 1 [0076.148] CloseHandle (hObject=0x2b8) returned 1 [0076.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", lpFilePart=0x0) returned 0x41 [0076.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", lpFilePart=0x0) returned 0x41 [0076.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\2deibcdellz5ov79cc.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.150] GetFileType (hFile=0x2b8) returned 0x1 [0076.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.150] GetFileType (hFile=0x2b8) returned 0x1 [0076.150] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xfd20 [0076.150] WriteFile (in: hFile=0x2b8, lpBuffer=0x2788700*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2788700*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.150] CloseHandle (hObject=0x2b8) returned 1 [0076.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg", lpFilePart=0x0) returned 0x41 [0076.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\MmRlaUJjZGVsTHo1b3Y3OUNDLmpwZw==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\MmRlaUJjZGVsTHo1b3Y3OUNDLmpwZw==", lpFilePart=0x0) returned 0x4b [0076.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\2deibcdellz5ov79cc.jpg"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1269d9a0, ftCreationTime.dwHighDateTime=0x1d5d922, ftLastAccessTime.dwLowDateTime=0xf27f7640, ftLastAccessTime.dwHighDateTime=0x1d5deee, ftLastWriteTime.dwLowDateTime=0xd51b2f40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xfd2a)) returned 1 [0076.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.150] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\2deiBcdelLz5ov79CC.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\2deibcdellz5ov79cc.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\MmRlaUJjZGVsTHo1b3Y3OUNDLmpwZw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\mmrlaujjzgvstho1b3y3oundlmpwzw==")) returned 1 [0076.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", lpFilePart=0x0) returned 0x43 [0076.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\o22o_dly_t4fmaztmtso.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.151] GetFileType (hFile=0x2b8) returned 0x1 [0076.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.151] GetFileType (hFile=0x2b8) returned 0x1 [0076.151] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x71a4 [0076.151] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=29082, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x719a [0076.151] ReadFile (in: hFile=0x2b8, lpBuffer=0x2789b00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2789b00*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.152] CloseHandle (hObject=0x2b8) returned 1 [0076.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11cb0) returned 0x0 [0076.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", lpFilePart=0x0) returned 0x43 [0076.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\o22o_dly_t4fmaztmtso.m4a"), fInfoLevelId=0x0, lpFileInformation=0x27f5e30 | out: lpFileInformation=0x27f5e30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb254260, ftCreationTime.dwHighDateTime=0x1d5dea9, ftLastAccessTime.dwLowDateTime=0x6c1a9f90, ftLastAccessTime.dwHighDateTime=0x1d5e384, ftLastWriteTime.dwLowDateTime=0x6c1a9f90, ftLastWriteTime.dwHighDateTime=0x1d5e384, nFileSizeHigh=0x0, nFileSizeLow=0x71a4)) returned 1 [0076.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", lpFilePart=0x0) returned 0x43 [0076.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\o22o_dly_t4fmaztmtso.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.161] GetFileType (hFile=0x2b8) returned 0x1 [0076.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.161] GetFileType (hFile=0x2b8) returned 0x1 [0076.161] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x71a4 [0076.161] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f6108, nNumberOfBytesToRead=0x71a4, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27f6108*, lpNumberOfBytesRead=0x1c9aea98*=0x71a4, lpOverlapped=0x0) returned 1 [0076.161] CloseHandle (hObject=0x2b8) returned 1 [0076.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", lpFilePart=0x0) returned 0x43 [0076.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\o22o_dly_t4fmaztmtso.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.193] GetFileType (hFile=0x2b8) returned 0x1 [0076.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.193] GetFileType (hFile=0x2b8) returned 0x1 [0076.193] WriteFile (in: hFile=0x2b8, lpBuffer=0x2890760*, nNumberOfBytesToWrite=0x71b0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2890760*, lpNumberOfBytesWritten=0x1c9aeb28*=0x71b0, lpOverlapped=0x0) returned 1 [0076.195] CloseHandle (hObject=0x2b8) returned 1 [0076.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", lpFilePart=0x0) returned 0x43 [0076.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", lpFilePart=0x0) returned 0x43 [0076.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\o22o_dly_t4fmaztmtso.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.195] GetFileType (hFile=0x2b8) returned 0x1 [0076.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.195] GetFileType (hFile=0x2b8) returned 0x1 [0076.195] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x71b0 [0076.195] WriteFile (in: hFile=0x2b8, lpBuffer=0x28988c8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x28988c8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.195] CloseHandle (hObject=0x2b8) returned 1 [0076.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a", lpFilePart=0x0) returned 0x43 [0076.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\TzIyT19EbFlfVDRmbUFadE10U28ubTRh", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\TzIyT19EbFlfVDRmbUFadE10U28ubTRh", lpFilePart=0x0) returned 0x4b [0076.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\o22o_dly_t4fmaztmtso.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb254260, ftCreationTime.dwHighDateTime=0x1d5dea9, ftLastAccessTime.dwLowDateTime=0x6c1a9f90, ftLastAccessTime.dwHighDateTime=0x1d5e384, ftLastWriteTime.dwLowDateTime=0xd5225360, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x71ba)) returned 1 [0076.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.196] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\O22O_DlY_T4fmAZtMtSo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\o22o_dly_t4fmaztmtso.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\TzIyT19EbFlfVDRmbUFadE10U28ubTRh" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\tziyt19ebflfvdrmbufade10u28ubtrh")) returned 1 [0076.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", lpFilePart=0x0) returned 0x3b [0076.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\vie78t0ukaj9.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.196] GetFileType (hFile=0x2b8) returned 0x1 [0076.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.196] GetFileType (hFile=0x2b8) returned 0x1 [0076.196] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x6db3 [0076.196] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=28073, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x6da9 [0076.197] ReadFile (in: hFile=0x2b8, lpBuffer=0x2899ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2899ca8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.197] CloseHandle (hObject=0x2b8) returned 1 [0076.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11cb0) returned 0x0 [0076.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", lpFilePart=0x0) returned 0x3b [0076.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.215] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\vie78t0ukaj9.swf"), fInfoLevelId=0x0, lpFileInformation=0x26aab20 | out: lpFileInformation=0x26aab20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3dce0, ftCreationTime.dwHighDateTime=0x1d5dc1a, ftLastAccessTime.dwLowDateTime=0x8d9fc560, ftLastAccessTime.dwHighDateTime=0x1d5e7b6, ftLastWriteTime.dwLowDateTime=0x8d9fc560, ftLastWriteTime.dwHighDateTime=0x1d5e7b6, nFileSizeHigh=0x0, nFileSizeLow=0x6db3)) returned 1 [0076.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", lpFilePart=0x0) returned 0x3b [0076.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\vie78t0ukaj9.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.216] GetFileType (hFile=0x2b8) returned 0x1 [0076.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.216] GetFileType (hFile=0x2b8) returned 0x1 [0076.216] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x6db3 [0076.216] ReadFile (in: hFile=0x2b8, lpBuffer=0x26aadb8, nNumberOfBytesToRead=0x6db3, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x26aadb8*, lpNumberOfBytesRead=0x1c9aea98*=0x6db3, lpOverlapped=0x0) returned 1 [0076.216] CloseHandle (hObject=0x2b8) returned 1 [0076.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", lpFilePart=0x0) returned 0x3b [0076.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\vie78t0ukaj9.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.250] GetFileType (hFile=0x2b8) returned 0x1 [0076.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.250] GetFileType (hFile=0x2b8) returned 0x1 [0076.250] WriteFile (in: hFile=0x2b8, lpBuffer=0x2743e68*, nNumberOfBytesToWrite=0x6dc0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2743e68*, lpNumberOfBytesWritten=0x1c9aeb28*=0x6dc0, lpOverlapped=0x0) returned 1 [0076.253] CloseHandle (hObject=0x2b8) returned 1 [0076.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", lpFilePart=0x0) returned 0x3b [0076.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", lpFilePart=0x0) returned 0x3b [0076.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\vie78t0ukaj9.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.254] GetFileType (hFile=0x2b8) returned 0x1 [0076.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.254] GetFileType (hFile=0x2b8) returned 0x1 [0076.254] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x6dc0 [0076.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf", lpFilePart=0x0) returned 0x3b [0076.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\dklFNzh0MHVLYUo5LnN3Zg==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\dklFNzh0MHVLYUo5LnN3Zg==", lpFilePart=0x0) returned 0x43 [0076.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.256] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\vie78t0ukaj9.swf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3dce0, ftCreationTime.dwHighDateTime=0x1d5dc1a, ftLastAccessTime.dwLowDateTime=0x8d9fc560, ftLastAccessTime.dwHighDateTime=0x1d5e7b6, ftLastWriteTime.dwLowDateTime=0xd52bd8e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x6dca)) returned 1 [0076.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.256] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\vIE78t0uKaJ9.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\vie78t0ukaj9.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\dklFNzh0MHVLYUo5LnN3Zg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\dklfnzh0mhvlyuo5lnn3zg==")) returned 1 [0076.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", lpFilePart=0x0) returned 0x39 [0076.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xvbeeivw5t.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.256] GetFileType (hFile=0x2b8) returned 0x1 [0076.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.256] GetFileType (hFile=0x2b8) returned 0x1 [0076.257] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x9949 [0076.257] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=39231, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x993f [0076.257] ReadFile (in: hFile=0x2b8, lpBuffer=0x274cf00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x274cf00*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.257] CloseHandle (hObject=0x2b8) returned 1 [0076.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", lpFilePart=0x0) returned 0x39 [0076.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.259] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xvbeeivw5t.ppt"), fInfoLevelId=0x0, lpFileInformation=0x27b9120 | out: lpFileInformation=0x27b9120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf8144e0, ftCreationTime.dwHighDateTime=0x1d5e62f, ftLastAccessTime.dwLowDateTime=0x2dfa9460, ftLastAccessTime.dwHighDateTime=0x1d5df1d, ftLastWriteTime.dwLowDateTime=0x2dfa9460, ftLastWriteTime.dwHighDateTime=0x1d5df1d, nFileSizeHigh=0x0, nFileSizeLow=0x9949)) returned 1 [0076.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", lpFilePart=0x0) returned 0x39 [0076.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xvbeeivw5t.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.259] GetFileType (hFile=0x2b8) returned 0x1 [0076.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.259] GetFileType (hFile=0x2b8) returned 0x1 [0076.259] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x9949 [0076.260] ReadFile (in: hFile=0x2b8, lpBuffer=0x27b93a8, nNumberOfBytesToRead=0x9949, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27b93a8*, lpNumberOfBytesRead=0x1c9aea98*=0x9949, lpOverlapped=0x0) returned 1 [0076.260] CloseHandle (hObject=0x2b8) returned 1 [0076.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", lpFilePart=0x0) returned 0x39 [0076.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xvbeeivw5t.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.340] GetFileType (hFile=0x2b8) returned 0x1 [0076.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.340] GetFileType (hFile=0x2b8) returned 0x1 [0076.340] WriteFile (in: hFile=0x2b8, lpBuffer=0x285fb90*, nNumberOfBytesToWrite=0x9950, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x285fb90*, lpNumberOfBytesWritten=0x1c9aeb28*=0x9950, lpOverlapped=0x0) returned 1 [0076.341] CloseHandle (hObject=0x2b8) returned 1 [0076.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", lpFilePart=0x0) returned 0x39 [0076.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", lpFilePart=0x0) returned 0x39 [0076.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xvbeeivw5t.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.341] GetFileType (hFile=0x2b8) returned 0x1 [0076.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.341] GetFileType (hFile=0x2b8) returned 0x1 [0076.341] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x9950 [0076.342] WriteFile (in: hFile=0x2b8, lpBuffer=0x286a3f0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x286a3f0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.342] CloseHandle (hObject=0x2b8) returned 1 [0076.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt", lpFilePart=0x0) returned 0x39 [0076.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\eFZiRWVpdnc1VC5wcHQ=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\eFZiRWVpdnc1VC5wcHQ=", lpFilePart=0x0) returned 0x3f [0076.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xvbeeivw5t.ppt"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf8144e0, ftCreationTime.dwHighDateTime=0x1d5e62f, ftLastAccessTime.dwLowDateTime=0x2dfa9460, ftLastAccessTime.dwHighDateTime=0x1d5df1d, ftLastWriteTime.dwLowDateTime=0xd537bfc0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x995a)) returned 1 [0076.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.342] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\xVbEeivw5T.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xvbeeivw5t.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\eFZiRWVpdnc1VC5wcHQ=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\efzirwvpdnc1vc5wchq=")) returned 1 [0076.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs", lpFilePart=0x0) returned 0x33 [0076.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\", lpFilePart=0x0) returned 0x34 [0076.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6a31150, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x632bc4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddf0, ftLastWriteTime.dwLowDateTime=0x632bc4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0076.343] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6a31150, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x632bc4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddf0, ftLastWriteTime.dwLowDateTime=0x632bc4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadabb750, ftCreationTime.dwHighDateTime=0x1d5df74, ftLastAccessTime.dwLowDateTime=0xf819ebd0, ftLastAccessTime.dwHighDateTime=0x1d5d7d2, ftLastWriteTime.dwLowDateTime=0xf819ebd0, ftLastWriteTime.dwHighDateTime=0x1d5d7d2, nFileSizeHigh=0x0, nFileSizeLow=0xa462, dwReserved0=0x0, dwReserved1=0x0, cFileName="GfegvD6x5B2WnaQI8W3.mp4", cAlternateFileName="GFEGVD~1.MP4")) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36baa800, ftCreationTime.dwHighDateTime=0x1d5e667, ftLastAccessTime.dwLowDateTime=0x65755d0, ftLastAccessTime.dwHighDateTime=0x1d5d85e, ftLastWriteTime.dwLowDateTime=0x65755d0, ftLastWriteTime.dwHighDateTime=0x1d5d85e, nFileSizeHigh=0x0, nFileSizeLow=0x351d, dwReserved0=0x0, dwReserved1=0x0, cFileName="iNBDHW9zV6xxzN.mp3", cAlternateFileName="INBDHW~1.MP3")) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45be2f10, ftCreationTime.dwHighDateTime=0x1d5d876, ftLastAccessTime.dwLowDateTime=0xfa289a0, ftLastAccessTime.dwHighDateTime=0x1d5e030, ftLastWriteTime.dwLowDateTime=0xfa289a0, ftLastWriteTime.dwHighDateTime=0x1d5e030, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z-3-yS1C1Ee3OwQWU.swf", cAlternateFileName="Z-3-YS~1.SWF")) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.343] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0076.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0076.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0076.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs", lpFilePart=0x0) returned 0x33 [0076.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\", lpFilePart=0x0) returned 0x34 [0076.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6a31150, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x632bc4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddf0, ftLastWriteTime.dwLowDateTime=0x632bc4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0076.344] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6a31150, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x632bc4c0, ftLastAccessTime.dwHighDateTime=0x1d5ddf0, ftLastWriteTime.dwLowDateTime=0x632bc4c0, ftLastWriteTime.dwHighDateTime=0x1d5ddf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.344] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadabb750, ftCreationTime.dwHighDateTime=0x1d5df74, ftLastAccessTime.dwLowDateTime=0xf819ebd0, ftLastAccessTime.dwHighDateTime=0x1d5d7d2, ftLastWriteTime.dwLowDateTime=0xf819ebd0, ftLastWriteTime.dwHighDateTime=0x1d5d7d2, nFileSizeHigh=0x0, nFileSizeLow=0xa462, dwReserved0=0x0, dwReserved1=0x0, cFileName="GfegvD6x5B2WnaQI8W3.mp4", cAlternateFileName="GFEGVD~1.MP4")) returned 1 [0076.344] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36baa800, ftCreationTime.dwHighDateTime=0x1d5e667, ftLastAccessTime.dwLowDateTime=0x65755d0, ftLastAccessTime.dwHighDateTime=0x1d5d85e, ftLastWriteTime.dwLowDateTime=0x65755d0, ftLastWriteTime.dwHighDateTime=0x1d5d85e, nFileSizeHigh=0x0, nFileSizeLow=0x351d, dwReserved0=0x0, dwReserved1=0x0, cFileName="iNBDHW9zV6xxzN.mp3", cAlternateFileName="INBDHW~1.MP3")) returned 1 [0076.344] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45be2f10, ftCreationTime.dwHighDateTime=0x1d5d876, ftLastAccessTime.dwLowDateTime=0xfa289a0, ftLastAccessTime.dwHighDateTime=0x1d5e030, ftLastWriteTime.dwLowDateTime=0xfa289a0, ftLastWriteTime.dwHighDateTime=0x1d5e030, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z-3-yS1C1Ee3OwQWU.swf", cAlternateFileName="Z-3-YS~1.SWF")) returned 1 [0076.345] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45be2f10, ftCreationTime.dwHighDateTime=0x1d5d876, ftLastAccessTime.dwLowDateTime=0xfa289a0, ftLastAccessTime.dwHighDateTime=0x1d5e030, ftLastWriteTime.dwLowDateTime=0xfa289a0, ftLastWriteTime.dwHighDateTime=0x1d5e030, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z-3-yS1C1Ee3OwQWU.swf", cAlternateFileName="Z-3-YS~1.SWF")) returned 0 [0076.345] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0076.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0076.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0076.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", lpFilePart=0x0) returned 0x4b [0076.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0076.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\gfegvd6x5b2wnaqi8w3.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.345] GetFileType (hFile=0x2b8) returned 0x1 [0076.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0076.345] GetFileType (hFile=0x2b8) returned 0x1 [0076.345] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0xa462 [0076.345] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=42072, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0xa458 [0076.345] ReadFile (in: hFile=0x2b8, lpBuffer=0x286e560, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x286e560*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0076.346] CloseHandle (hObject=0x2b8) returned 1 [0076.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", lpFilePart=0x0) returned 0x4b [0076.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0076.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\gfegvd6x5b2wnaqi8w3.mp4"), fInfoLevelId=0x0, lpFileInformation=0x2705168 | out: lpFileInformation=0x2705168*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadabb750, ftCreationTime.dwHighDateTime=0x1d5df74, ftLastAccessTime.dwLowDateTime=0xf819ebd0, ftLastAccessTime.dwHighDateTime=0x1d5d7d2, ftLastWriteTime.dwLowDateTime=0xf819ebd0, ftLastWriteTime.dwHighDateTime=0x1d5d7d2, nFileSizeHigh=0x0, nFileSizeLow=0xa462)) returned 1 [0076.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0076.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", lpFilePart=0x0) returned 0x4b [0076.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0076.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\gfegvd6x5b2wnaqi8w3.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.356] GetFileType (hFile=0x2b8) returned 0x1 [0076.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0076.356] GetFileType (hFile=0x2b8) returned 0x1 [0076.356] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0xa462 [0076.357] ReadFile (in: hFile=0x2b8, lpBuffer=0x2705450, nNumberOfBytesToRead=0xa462, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2705450*, lpNumberOfBytesRead=0x1c9ae9f8*=0xa462, lpOverlapped=0x0) returned 1 [0076.357] CloseHandle (hObject=0x2b8) returned 1 [0076.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", lpFilePart=0x0) returned 0x4b [0076.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0076.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\gfegvd6x5b2wnaqi8w3.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.395] GetFileType (hFile=0x2b8) returned 0x1 [0076.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0076.396] GetFileType (hFile=0x2b8) returned 0x1 [0076.396] WriteFile (in: hFile=0x2b8, lpBuffer=0x27af868*, nNumberOfBytesToWrite=0xa470, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x27af868*, lpNumberOfBytesWritten=0x1c9aea88*=0xa470, lpOverlapped=0x0) returned 1 [0076.397] CloseHandle (hObject=0x2b8) returned 1 [0076.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", lpFilePart=0x0) returned 0x4b [0076.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", lpFilePart=0x0) returned 0x4b [0076.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\gfegvd6x5b2wnaqi8w3.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.397] GetFileType (hFile=0x2b8) returned 0x1 [0076.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.397] GetFileType (hFile=0x2b8) returned 0x1 [0076.397] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0xa470 [0076.398] WriteFile (in: hFile=0x2b8, lpBuffer=0x27bacc8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x27bacc8*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0076.398] CloseHandle (hObject=0x2b8) returned 1 [0076.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4", lpFilePart=0x0) returned 0x4b [0076.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\R2ZlZ3ZENng1QjJXbmFRSThXMy5tcDQ=", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\R2ZlZ3ZENng1QjJXbmFRSThXMy5tcDQ=", lpFilePart=0x0) returned 0x54 [0076.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0076.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\gfegvd6x5b2wnaqi8w3.mp4"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadabb750, ftCreationTime.dwHighDateTime=0x1d5df74, ftLastAccessTime.dwLowDateTime=0xf819ebd0, ftLastAccessTime.dwHighDateTime=0x1d5d7d2, ftLastWriteTime.dwLowDateTime=0xd5414540, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xa47a)) returned 1 [0076.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0076.398] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\GfegvD6x5B2WnaQI8W3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\gfegvd6x5b2wnaqi8w3.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\R2ZlZ3ZENng1QjJXbmFRSThXMy5tcDQ=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\r2zlz3zenng1qjjxbmfrsthxmy5tcdq=")) returned 1 [0076.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", lpFilePart=0x0) returned 0x46 [0076.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0076.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\inbdhw9zv6xxzn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.399] GetFileType (hFile=0x2b8) returned 0x1 [0076.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0076.399] GetFileType (hFile=0x2b8) returned 0x1 [0076.399] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x351d [0076.399] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=13587, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x3513 [0076.399] ReadFile (in: hFile=0x2b8, lpBuffer=0x27bc100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x27bc100*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0076.400] CloseHandle (hObject=0x2b8) returned 1 [0076.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11c10) returned 0x0 [0076.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", lpFilePart=0x0) returned 0x46 [0076.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0076.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\inbdhw9zv6xxzn.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2828290 | out: lpFileInformation=0x2828290*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36baa800, ftCreationTime.dwHighDateTime=0x1d5e667, ftLastAccessTime.dwLowDateTime=0x65755d0, ftLastAccessTime.dwHighDateTime=0x1d5d85e, ftLastWriteTime.dwLowDateTime=0x65755d0, ftLastWriteTime.dwHighDateTime=0x1d5d85e, nFileSizeHigh=0x0, nFileSizeLow=0x351d)) returned 1 [0076.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0076.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", lpFilePart=0x0) returned 0x46 [0076.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0076.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\inbdhw9zv6xxzn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.405] GetFileType (hFile=0x2b8) returned 0x1 [0076.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0076.406] GetFileType (hFile=0x2b8) returned 0x1 [0076.406] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x351d [0076.406] ReadFile (in: hFile=0x2b8, lpBuffer=0x2828558, nNumberOfBytesToRead=0x351d, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2828558*, lpNumberOfBytesRead=0x1c9ae9f8*=0x351d, lpOverlapped=0x0) returned 1 [0076.406] CloseHandle (hObject=0x2b8) returned 1 [0076.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", lpFilePart=0x0) returned 0x46 [0076.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0076.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\inbdhw9zv6xxzn.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.417] GetFileType (hFile=0x2b8) returned 0x1 [0076.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0076.417] GetFileType (hFile=0x2b8) returned 0x1 [0076.417] WriteFile (in: hFile=0x2b8, lpBuffer=0x28af850*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x28af850*, lpNumberOfBytesWritten=0x1c9aea88*=0x3520, lpOverlapped=0x0) returned 1 [0076.418] CloseHandle (hObject=0x2b8) returned 1 [0076.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", lpFilePart=0x0) returned 0x46 [0076.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", lpFilePart=0x0) returned 0x46 [0076.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\inbdhw9zv6xxzn.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.419] GetFileType (hFile=0x2b8) returned 0x1 [0076.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.419] GetFileType (hFile=0x2b8) returned 0x1 [0076.419] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x3520 [0076.419] WriteFile (in: hFile=0x2b8, lpBuffer=0x28b3d18*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x28b3d18*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0076.419] CloseHandle (hObject=0x2b8) returned 1 [0076.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3", lpFilePart=0x0) returned 0x46 [0076.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\aU5CREhXOXpWNnh4ek4ubXAz", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\aU5CREhXOXpWNnh4ek4ubXAz", lpFilePart=0x0) returned 0x4c [0076.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0076.419] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\inbdhw9zv6xxzn.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36baa800, ftCreationTime.dwHighDateTime=0x1d5e667, ftLastAccessTime.dwLowDateTime=0x65755d0, ftLastAccessTime.dwHighDateTime=0x1d5d85e, ftLastWriteTime.dwLowDateTime=0xd543a6a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x352a)) returned 1 [0076.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0076.420] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\iNBDHW9zV6xxzN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\inbdhw9zv6xxzn.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\aU5CREhXOXpWNnh4ek4ubXAz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\au5crehxoxpwnnh4ek4ubxaz")) returned 1 [0076.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", lpFilePart=0x0) returned 0x49 [0076.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0076.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\z-3-ys1c1ee3owqwu.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.420] GetFileType (hFile=0x2b8) returned 0x1 [0076.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0076.420] GetFileType (hFile=0x2b8) returned 0x1 [0076.420] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x3700 [0076.420] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=14070, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x36f6 [0076.421] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b5138, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x28b5138*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0076.421] CloseHandle (hObject=0x2b8) returned 1 [0076.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11c10) returned 0x0 [0076.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", lpFilePart=0x0) returned 0x49 [0076.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0076.436] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\z-3-ys1c1ee3owqwu.swf"), fInfoLevelId=0x0, lpFileInformation=0x2742378 | out: lpFileInformation=0x2742378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45be2f10, ftCreationTime.dwHighDateTime=0x1d5d876, ftLastAccessTime.dwLowDateTime=0xfa289a0, ftLastAccessTime.dwHighDateTime=0x1d5e030, ftLastWriteTime.dwLowDateTime=0xfa289a0, ftLastWriteTime.dwHighDateTime=0x1d5e030, nFileSizeHigh=0x0, nFileSizeLow=0x3700)) returned 1 [0076.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0076.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", lpFilePart=0x0) returned 0x49 [0076.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0076.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\z-3-ys1c1ee3owqwu.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0076.437] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x3700 [0076.437] ReadFile (in: hFile=0x2b8, lpBuffer=0x2742660, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2742660*, lpNumberOfBytesRead=0x1c9ae9f8*=0x3700, lpOverlapped=0x0) returned 1 [0076.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", lpFilePart=0x0) returned 0x49 [0076.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0076.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\z-3-ys1c1ee3owqwu.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0076.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", lpFilePart=0x0) returned 0x49 [0076.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", lpFilePart=0x0) returned 0x49 [0076.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\z-3-ys1c1ee3owqwu.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.545] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x3710 [0076.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf", lpFilePart=0x0) returned 0x49 [0076.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Wi0zLXlTMUMxRWUzT3dRV1Uuc3dm", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Wi0zLXlTMUMxRWUzT3dRV1Uuc3dm", lpFilePart=0x0) returned 0x50 [0076.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0076.545] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\z-3-ys1c1ee3owqwu.swf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45be2f10, ftCreationTime.dwHighDateTime=0x1d5d876, ftLastAccessTime.dwLowDateTime=0xfa289a0, ftLastAccessTime.dwHighDateTime=0x1d5e030, ftLastWriteTime.dwLowDateTime=0xd556b1a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x371a)) returned 1 [0076.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0076.545] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Z-3-yS1C1Ee3OwQWU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\z-3-ys1c1ee3owqwu.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\Wi0zLXlTMUMxRWUzT3dRV1Uuc3dm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\wi0zlxltmumxrwuzt3drv1uuc3dm")) returned 1 [0076.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae490, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\README_3728769.txt", lpFilePart=0x0) returned 0x46 [0076.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae970) returned 1 [0076.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\Xb38HcXs\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\xb38hcxs\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0076.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8e0) returned 1 [0076.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\README_3728769.txt", lpFilePart=0x0) returned 0x3d [0076.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0076.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lb1w\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lb1w\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0076.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0076.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0076.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK", lpFilePart=0x0) returned 0x2c [0076.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\", lpFilePart=0x0) returned 0x2d [0076.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b098460, ftCreationTime.dwHighDateTime=0x1d5e229, ftLastAccessTime.dwLowDateTime=0x9a590070, ftLastAccessTime.dwHighDateTime=0x1d5ddb9, ftLastWriteTime.dwLowDateTime=0x9a590070, ftLastWriteTime.dwHighDateTime=0x1d5ddb9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0076.554] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b098460, ftCreationTime.dwHighDateTime=0x1d5e229, ftLastAccessTime.dwLowDateTime=0x9a590070, ftLastAccessTime.dwHighDateTime=0x1d5ddb9, ftLastWriteTime.dwLowDateTime=0x9a590070, ftLastWriteTime.dwHighDateTime=0x1d5ddb9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.554] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f401020, ftCreationTime.dwHighDateTime=0x1d5dbea, ftLastAccessTime.dwLowDateTime=0x1fe1bba0, ftLastAccessTime.dwHighDateTime=0x1d5dc1c, ftLastWriteTime.dwLowDateTime=0x1fe1bba0, ftLastWriteTime.dwHighDateTime=0x1d5dc1c, nFileSizeHigh=0x0, nFileSizeLow=0x6e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="C8LTL6RqCnSM5XHEK.pps", cAlternateFileName="C8LTL6~1.PPS")) returned 1 [0076.555] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8269100, ftCreationTime.dwHighDateTime=0x1d5dc28, ftLastAccessTime.dwLowDateTime=0xe72e8040, ftLastAccessTime.dwHighDateTime=0x1d5db62, ftLastWriteTime.dwLowDateTime=0xe72e8040, ftLastWriteTime.dwHighDateTime=0x1d5db62, nFileSizeHigh=0x0, nFileSizeLow=0x14af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9bQ.gif", cAlternateFileName="")) returned 1 [0076.555] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744acd0, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xc1d7ef20, ftLastAccessTime.dwHighDateTime=0x1d5d838, ftLastWriteTime.dwLowDateTime=0xc1d7ef20, ftLastWriteTime.dwHighDateTime=0x1d5d838, nFileSizeHigh=0x0, nFileSizeLow=0xe014, dwReserved0=0x0, dwReserved1=0x0, cFileName="fk QrJAdzCJahj3I.m4a", cAlternateFileName="FKQRJA~1.M4A")) returned 1 [0076.555] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6563ecc0, ftCreationTime.dwHighDateTime=0x1d5e7fc, ftLastAccessTime.dwLowDateTime=0xb08331d0, ftLastAccessTime.dwHighDateTime=0x1d5e157, ftLastWriteTime.dwLowDateTime=0xb08331d0, ftLastWriteTime.dwHighDateTime=0x1d5e157, nFileSizeHigh=0x0, nFileSizeLow=0x14408, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jj_vl_cS9iBsaNs.png", cAlternateFileName="JJ_VL_~1.PNG")) returned 1 [0076.555] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1de49d0, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xb0fd4c80, ftLastAccessTime.dwHighDateTime=0x1d5dd75, ftLastWriteTime.dwLowDateTime=0xb0fd4c80, ftLastWriteTime.dwHighDateTime=0x1d5dd75, nFileSizeHigh=0x0, nFileSizeLow=0xfbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="l3XqajSICcqI0TR.mkv", cAlternateFileName="L3XQAJ~1.MKV")) returned 1 [0076.555] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a78d440, ftCreationTime.dwHighDateTime=0x1d5da26, ftLastAccessTime.dwLowDateTime=0xa0797ab0, ftLastAccessTime.dwHighDateTime=0x1d5d865, ftLastWriteTime.dwLowDateTime=0xa0797ab0, ftLastWriteTime.dwHighDateTime=0x1d5d865, nFileSizeHigh=0x0, nFileSizeLow=0x13309, dwReserved0=0x0, dwReserved1=0x0, cFileName="pIu4BU7qxuI5Mtj_-Lw.xls", cAlternateFileName="PIU4BU~1.XLS")) returned 1 [0076.555] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe68a370, ftCreationTime.dwHighDateTime=0x1d5e003, ftLastAccessTime.dwLowDateTime=0x3cd6fbd0, ftLastAccessTime.dwHighDateTime=0x1d5d979, ftLastWriteTime.dwLowDateTime=0x3cd6fbd0, ftLastWriteTime.dwHighDateTime=0x1d5d979, nFileSizeHigh=0x0, nFileSizeLow=0x16de9, dwReserved0=0x0, dwReserved1=0x0, cFileName="rebdA0CI1L_R.wav", cAlternateFileName="REBDA0~1.WAV")) returned 1 [0076.555] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723d5c50, ftCreationTime.dwHighDateTime=0x1d5def7, ftLastAccessTime.dwLowDateTime=0xf1a406c0, ftLastAccessTime.dwHighDateTime=0x1d5e1d5, ftLastWriteTime.dwLowDateTime=0xf1a406c0, ftLastWriteTime.dwHighDateTime=0x1d5e1d5, nFileSizeHigh=0x0, nFileSizeLow=0x16ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="u2VuzboB.pptx", cAlternateFileName="U2VUZB~1.PPT")) returned 1 [0076.555] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24b33ca0, ftCreationTime.dwHighDateTime=0x1d5d805, ftLastAccessTime.dwLowDateTime=0x280532d0, ftLastAccessTime.dwHighDateTime=0x1d5e081, ftLastWriteTime.dwLowDateTime=0x280532d0, ftLastWriteTime.dwHighDateTime=0x1d5e081, nFileSizeHigh=0x0, nFileSizeLow=0x11a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="xHvhmvgbtD.jpg", cAlternateFileName="XHVHMV~1.JPG")) returned 1 [0076.556] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6971cf80, ftCreationTime.dwHighDateTime=0x1d5de1a, ftLastAccessTime.dwLowDateTime=0x22e14920, ftLastAccessTime.dwHighDateTime=0x1d5da31, ftLastWriteTime.dwLowDateTime=0x22e14920, ftLastWriteTime.dwHighDateTime=0x1d5da31, nFileSizeHigh=0x0, nFileSizeLow=0x18dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="znC094.rtf", cAlternateFileName="")) returned 1 [0076.556] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.556] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0076.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0076.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0076.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0076.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK", lpFilePart=0x0) returned 0x2c [0076.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\", lpFilePart=0x0) returned 0x2d [0076.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b098460, ftCreationTime.dwHighDateTime=0x1d5e229, ftLastAccessTime.dwLowDateTime=0x9a590070, ftLastAccessTime.dwHighDateTime=0x1d5ddb9, ftLastWriteTime.dwLowDateTime=0x9a590070, ftLastWriteTime.dwHighDateTime=0x1d5ddb9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0076.556] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b098460, ftCreationTime.dwHighDateTime=0x1d5e229, ftLastAccessTime.dwLowDateTime=0x9a590070, ftLastAccessTime.dwHighDateTime=0x1d5ddb9, ftLastWriteTime.dwLowDateTime=0x9a590070, ftLastWriteTime.dwHighDateTime=0x1d5ddb9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.556] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f401020, ftCreationTime.dwHighDateTime=0x1d5dbea, ftLastAccessTime.dwLowDateTime=0x1fe1bba0, ftLastAccessTime.dwHighDateTime=0x1d5dc1c, ftLastWriteTime.dwLowDateTime=0x1fe1bba0, ftLastWriteTime.dwHighDateTime=0x1d5dc1c, nFileSizeHigh=0x0, nFileSizeLow=0x6e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="C8LTL6RqCnSM5XHEK.pps", cAlternateFileName="C8LTL6~1.PPS")) returned 1 [0076.557] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8269100, ftCreationTime.dwHighDateTime=0x1d5dc28, ftLastAccessTime.dwLowDateTime=0xe72e8040, ftLastAccessTime.dwHighDateTime=0x1d5db62, ftLastWriteTime.dwLowDateTime=0xe72e8040, ftLastWriteTime.dwHighDateTime=0x1d5db62, nFileSizeHigh=0x0, nFileSizeLow=0x14af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9bQ.gif", cAlternateFileName="")) returned 1 [0076.557] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744acd0, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xc1d7ef20, ftLastAccessTime.dwHighDateTime=0x1d5d838, ftLastWriteTime.dwLowDateTime=0xc1d7ef20, ftLastWriteTime.dwHighDateTime=0x1d5d838, nFileSizeHigh=0x0, nFileSizeLow=0xe014, dwReserved0=0x0, dwReserved1=0x0, cFileName="fk QrJAdzCJahj3I.m4a", cAlternateFileName="FKQRJA~1.M4A")) returned 1 [0076.557] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6563ecc0, ftCreationTime.dwHighDateTime=0x1d5e7fc, ftLastAccessTime.dwLowDateTime=0xb08331d0, ftLastAccessTime.dwHighDateTime=0x1d5e157, ftLastWriteTime.dwLowDateTime=0xb08331d0, ftLastWriteTime.dwHighDateTime=0x1d5e157, nFileSizeHigh=0x0, nFileSizeLow=0x14408, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jj_vl_cS9iBsaNs.png", cAlternateFileName="JJ_VL_~1.PNG")) returned 1 [0076.557] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1de49d0, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xb0fd4c80, ftLastAccessTime.dwHighDateTime=0x1d5dd75, ftLastWriteTime.dwLowDateTime=0xb0fd4c80, ftLastWriteTime.dwHighDateTime=0x1d5dd75, nFileSizeHigh=0x0, nFileSizeLow=0xfbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="l3XqajSICcqI0TR.mkv", cAlternateFileName="L3XQAJ~1.MKV")) returned 1 [0076.557] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a78d440, ftCreationTime.dwHighDateTime=0x1d5da26, ftLastAccessTime.dwLowDateTime=0xa0797ab0, ftLastAccessTime.dwHighDateTime=0x1d5d865, ftLastWriteTime.dwLowDateTime=0xa0797ab0, ftLastWriteTime.dwHighDateTime=0x1d5d865, nFileSizeHigh=0x0, nFileSizeLow=0x13309, dwReserved0=0x0, dwReserved1=0x0, cFileName="pIu4BU7qxuI5Mtj_-Lw.xls", cAlternateFileName="PIU4BU~1.XLS")) returned 1 [0076.557] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe68a370, ftCreationTime.dwHighDateTime=0x1d5e003, ftLastAccessTime.dwLowDateTime=0x3cd6fbd0, ftLastAccessTime.dwHighDateTime=0x1d5d979, ftLastWriteTime.dwLowDateTime=0x3cd6fbd0, ftLastWriteTime.dwHighDateTime=0x1d5d979, nFileSizeHigh=0x0, nFileSizeLow=0x16de9, dwReserved0=0x0, dwReserved1=0x0, cFileName="rebdA0CI1L_R.wav", cAlternateFileName="REBDA0~1.WAV")) returned 1 [0076.558] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723d5c50, ftCreationTime.dwHighDateTime=0x1d5def7, ftLastAccessTime.dwLowDateTime=0xf1a406c0, ftLastAccessTime.dwHighDateTime=0x1d5e1d5, ftLastWriteTime.dwLowDateTime=0xf1a406c0, ftLastWriteTime.dwHighDateTime=0x1d5e1d5, nFileSizeHigh=0x0, nFileSizeLow=0x16ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="u2VuzboB.pptx", cAlternateFileName="U2VUZB~1.PPT")) returned 1 [0076.558] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24b33ca0, ftCreationTime.dwHighDateTime=0x1d5d805, ftLastAccessTime.dwLowDateTime=0x280532d0, ftLastAccessTime.dwHighDateTime=0x1d5e081, ftLastWriteTime.dwLowDateTime=0x280532d0, ftLastWriteTime.dwHighDateTime=0x1d5e081, nFileSizeHigh=0x0, nFileSizeLow=0x11a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="xHvhmvgbtD.jpg", cAlternateFileName="XHVHMV~1.JPG")) returned 1 [0076.558] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6971cf80, ftCreationTime.dwHighDateTime=0x1d5de1a, ftLastAccessTime.dwLowDateTime=0x22e14920, ftLastAccessTime.dwHighDateTime=0x1d5da31, ftLastWriteTime.dwLowDateTime=0x22e14920, ftLastWriteTime.dwHighDateTime=0x1d5da31, nFileSizeHigh=0x0, nFileSizeLow=0x18dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="znC094.rtf", cAlternateFileName="")) returned 1 [0076.558] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6971cf80, ftCreationTime.dwHighDateTime=0x1d5de1a, ftLastAccessTime.dwLowDateTime=0x22e14920, ftLastAccessTime.dwHighDateTime=0x1d5da31, ftLastWriteTime.dwLowDateTime=0x22e14920, ftLastWriteTime.dwHighDateTime=0x1d5da31, nFileSizeHigh=0x0, nFileSizeLow=0x18dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="znC094.rtf", cAlternateFileName="")) returned 0 [0076.558] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0076.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0076.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0076.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", lpFilePart=0x0) returned 0x42 [0076.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c8ltl6rqcnsm5xhek.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.558] GetFileType (hFile=0x2b8) returned 0x1 [0076.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.559] GetFileType (hFile=0x2b8) returned 0x1 [0076.559] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x6e62 [0076.559] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=28248, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x6e58 [0076.559] ReadFile (in: hFile=0x2b8, lpBuffer=0x27dcaa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27dcaa0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.559] CloseHandle (hObject=0x2b8) returned 1 [0076.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", lpFilePart=0x0) returned 0x42 [0076.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.561] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c8ltl6rqcnsm5xhek.pps"), fInfoLevelId=0x0, lpFileInformation=0x2848d30 | out: lpFileInformation=0x2848d30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f401020, ftCreationTime.dwHighDateTime=0x1d5dbea, ftLastAccessTime.dwLowDateTime=0x1fe1bba0, ftLastAccessTime.dwHighDateTime=0x1d5dc1c, ftLastWriteTime.dwLowDateTime=0x1fe1bba0, ftLastWriteTime.dwHighDateTime=0x1d5dc1c, nFileSizeHigh=0x0, nFileSizeLow=0x6e62)) returned 1 [0076.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", lpFilePart=0x0) returned 0x42 [0076.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c8ltl6rqcnsm5xhek.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.561] GetFileType (hFile=0x2b8) returned 0x1 [0076.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.562] GetFileType (hFile=0x2b8) returned 0x1 [0076.562] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x6e62 [0076.562] ReadFile (in: hFile=0x2b8, lpBuffer=0x2848ff8, nNumberOfBytesToRead=0x6e62, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2848ff8*, lpNumberOfBytesRead=0x1c9aea98*=0x6e62, lpOverlapped=0x0) returned 1 [0076.562] CloseHandle (hObject=0x2b8) returned 1 [0076.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", lpFilePart=0x0) returned 0x42 [0076.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c8ltl6rqcnsm5xhek.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.575] GetFileType (hFile=0x2b8) returned 0x1 [0076.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.575] GetFileType (hFile=0x2b8) returned 0x1 [0076.575] WriteFile (in: hFile=0x2b8, lpBuffer=0x28e2180*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x28e2180*, lpNumberOfBytesWritten=0x1c9aeb28*=0x6e70, lpOverlapped=0x0) returned 1 [0076.576] CloseHandle (hObject=0x2b8) returned 1 [0076.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", lpFilePart=0x0) returned 0x42 [0076.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", lpFilePart=0x0) returned 0x42 [0076.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c8ltl6rqcnsm5xhek.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.577] GetFileType (hFile=0x2b8) returned 0x1 [0076.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.577] GetFileType (hFile=0x2b8) returned 0x1 [0076.577] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x6e70 [0076.577] WriteFile (in: hFile=0x2b8, lpBuffer=0x28e9f90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x28e9f90*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.577] CloseHandle (hObject=0x2b8) returned 1 [0076.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps", lpFilePart=0x0) returned 0x42 [0076.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\QzhMVEw2UnFDblNNNVhIRUsucHBz", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\QzhMVEw2UnFDblNNNVhIRUsucHBz", lpFilePart=0x0) returned 0x49 [0076.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c8ltl6rqcnsm5xhek.pps"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f401020, ftCreationTime.dwHighDateTime=0x1d5dbea, ftLastAccessTime.dwLowDateTime=0x1fe1bba0, ftLastAccessTime.dwHighDateTime=0x1d5dc1c, ftLastWriteTime.dwLowDateTime=0xd55b7460, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x6e7a)) returned 1 [0076.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.578] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C8LTL6RqCnSM5XHEK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c8ltl6rqcnsm5xhek.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\QzhMVEw2UnFDblNNNVhIRUsucHBz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\qzhmvew2unfdblnnnvhirusuchbz")) returned 1 [0076.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", lpFilePart=0x0) returned 0x35 [0076.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c9bq.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.578] GetFileType (hFile=0x2b8) returned 0x1 [0076.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.578] GetFileType (hFile=0x2b8) returned 0x1 [0076.578] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x14af0 [0076.579] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=84710, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x14ae6 [0076.579] ReadFile (in: hFile=0x2b8, lpBuffer=0x28eb358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28eb358*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.579] CloseHandle (hObject=0x2b8) returned 1 [0076.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", lpFilePart=0x0) returned 0x35 [0076.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c9bq.gif"), fInfoLevelId=0x0, lpFileInformation=0x2738de0 | out: lpFileInformation=0x2738de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8269100, ftCreationTime.dwHighDateTime=0x1d5dc28, ftLastAccessTime.dwLowDateTime=0xe72e8040, ftLastAccessTime.dwHighDateTime=0x1d5db62, ftLastWriteTime.dwLowDateTime=0xe72e8040, ftLastWriteTime.dwHighDateTime=0x1d5db62, nFileSizeHigh=0x0, nFileSizeLow=0x14af0)) returned 1 [0076.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", lpFilePart=0x0) returned 0x35 [0076.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c9bq.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.598] GetFileType (hFile=0x2b8) returned 0x1 [0076.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.598] GetFileType (hFile=0x2b8) returned 0x1 [0076.598] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x14af0 [0076.598] ReadFile (in: hFile=0x2b8, lpBuffer=0x2739048, nNumberOfBytesToRead=0x14af0, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2739048*, lpNumberOfBytesRead=0x1c9aea98*=0x14af0, lpOverlapped=0x0) returned 1 [0076.598] CloseHandle (hObject=0x2b8) returned 1 [0076.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", lpFilePart=0x0) returned 0x35 [0076.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c9bq.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.645] GetFileType (hFile=0x2b8) returned 0x1 [0076.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.646] GetFileType (hFile=0x2b8) returned 0x1 [0076.646] WriteFile (in: hFile=0x2b8, lpBuffer=0x27edd38*, nNumberOfBytesToWrite=0x14b00, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x27edd38*, lpNumberOfBytesWritten=0x1c9aeb28*=0x14b00, lpOverlapped=0x0) returned 1 [0076.648] CloseHandle (hObject=0x2b8) returned 1 [0076.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", lpFilePart=0x0) returned 0x35 [0076.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", lpFilePart=0x0) returned 0x35 [0076.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c9bq.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.648] GetFileType (hFile=0x2b8) returned 0x1 [0076.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.648] GetFileType (hFile=0x2b8) returned 0x1 [0076.648] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x14b00 [0076.648] WriteFile (in: hFile=0x2b8, lpBuffer=0x2803700*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2803700*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.648] CloseHandle (hObject=0x2b8) returned 1 [0076.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif", lpFilePart=0x0) returned 0x35 [0076.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\QzliUS5naWY=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\QzliUS5naWY=", lpFilePart=0x0) returned 0x39 [0076.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.649] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c9bq.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8269100, ftCreationTime.dwHighDateTime=0x1d5dc28, ftLastAccessTime.dwLowDateTime=0xe72e8040, ftLastAccessTime.dwHighDateTime=0x1d5db62, ftLastWriteTime.dwLowDateTime=0xd5675b40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x14b0a)) returned 1 [0076.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.649] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\C9bQ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\c9bq.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\QzliUS5naWY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\qzlius5nawy=")) returned 1 [0076.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", lpFilePart=0x0) returned 0x41 [0076.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\fk qrjadzcjahj3i.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.649] GetFileType (hFile=0x2b8) returned 0x1 [0076.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.649] GetFileType (hFile=0x2b8) returned 0x1 [0076.650] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xe014 [0076.650] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=57354, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xe00a [0076.650] ReadFile (in: hFile=0x2b8, lpBuffer=0x2804aa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2804aa0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.650] CloseHandle (hObject=0x2b8) returned 1 [0076.651] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11bc0) returned 0x0 [0076.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", lpFilePart=0x0) returned 0x41 [0076.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\fk qrjadzcjahj3i.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2870be0 | out: lpFileInformation=0x2870be0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744acd0, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xc1d7ef20, ftLastAccessTime.dwHighDateTime=0x1d5d838, ftLastWriteTime.dwLowDateTime=0xc1d7ef20, ftLastWriteTime.dwHighDateTime=0x1d5d838, nFileSizeHigh=0x0, nFileSizeLow=0xe014)) returned 1 [0076.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", lpFilePart=0x0) returned 0x41 [0076.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\fk qrjadzcjahj3i.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.652] GetFileType (hFile=0x2b8) returned 0x1 [0076.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.652] GetFileType (hFile=0x2b8) returned 0x1 [0076.652] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xe014 [0076.652] ReadFile (in: hFile=0x2b8, lpBuffer=0x2870ea8, nNumberOfBytesToRead=0xe014, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2870ea8*, lpNumberOfBytesRead=0x1c9aea98*=0xe014, lpOverlapped=0x0) returned 1 [0076.653] CloseHandle (hObject=0x2b8) returned 1 [0076.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", lpFilePart=0x0) returned 0x41 [0076.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\fk qrjadzcjahj3i.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.783] GetFileType (hFile=0x2b8) returned 0x1 [0076.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.783] GetFileType (hFile=0x2b8) returned 0x1 [0076.783] WriteFile (in: hFile=0x2b8, lpBuffer=0x2748d18*, nNumberOfBytesToWrite=0xe020, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2748d18*, lpNumberOfBytesWritten=0x1c9aeb28*=0xe020, lpOverlapped=0x0) returned 1 [0076.785] CloseHandle (hObject=0x2b8) returned 1 [0076.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", lpFilePart=0x0) returned 0x41 [0076.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", lpFilePart=0x0) returned 0x41 [0076.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\fk qrjadzcjahj3i.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.786] GetFileType (hFile=0x2b8) returned 0x1 [0076.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.786] GetFileType (hFile=0x2b8) returned 0x1 [0076.786] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xe020 [0076.786] WriteFile (in: hFile=0x2b8, lpBuffer=0x2757ed0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2757ed0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.786] CloseHandle (hObject=0x2b8) returned 1 [0076.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a", lpFilePart=0x0) returned 0x41 [0076.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\ZmsgUXJKQWR6Q0phaGozSS5tNGE=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\ZmsgUXJKQWR6Q0phaGozSS5tNGE=", lpFilePart=0x0) returned 0x49 [0076.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.786] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\fk qrjadzcjahj3i.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744acd0, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xc1d7ef20, ftLastAccessTime.dwHighDateTime=0x1d5d838, ftLastWriteTime.dwLowDateTime=0xd57cc7a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe02a)) returned 1 [0076.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.786] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\fk QrJAdzCJahj3I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\fk qrjadzcjahj3i.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\ZmsgUXJKQWR6Q0phaGozSS5tNGE=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\zmsguxjkqwr6q0phagozss5tnge=")) returned 1 [0076.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", lpFilePart=0x0) returned 0x40 [0076.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\jj_vl_cs9ibsans.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.787] GetFileType (hFile=0x2b8) returned 0x1 [0076.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.787] GetFileType (hFile=0x2b8) returned 0x1 [0076.787] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x14408 [0076.787] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=82942, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x143fe [0076.787] ReadFile (in: hFile=0x2b8, lpBuffer=0x27592c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27592c0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.788] CloseHandle (hObject=0x2b8) returned 1 [0076.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11c88) returned 0x0 [0076.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", lpFilePart=0x0) returned 0x40 [0076.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\jj_vl_cs9ibsans.png"), fInfoLevelId=0x0, lpFileInformation=0x27c5f48 | out: lpFileInformation=0x27c5f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6563ecc0, ftCreationTime.dwHighDateTime=0x1d5e7fc, ftLastAccessTime.dwLowDateTime=0xb08331d0, ftLastAccessTime.dwHighDateTime=0x1d5e157, ftLastWriteTime.dwLowDateTime=0xb08331d0, ftLastWriteTime.dwHighDateTime=0x1d5e157, nFileSizeHigh=0x0, nFileSizeLow=0x14408)) returned 1 [0076.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", lpFilePart=0x0) returned 0x40 [0076.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\jj_vl_cs9ibsans.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.790] GetFileType (hFile=0x2b8) returned 0x1 [0076.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.790] GetFileType (hFile=0x2b8) returned 0x1 [0076.790] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x14408 [0076.790] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c6200, nNumberOfBytesToRead=0x14408, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27c6200*, lpNumberOfBytesRead=0x1c9aea98*=0x14408, lpOverlapped=0x0) returned 1 [0076.790] CloseHandle (hObject=0x2b8) returned 1 [0076.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", lpFilePart=0x0) returned 0x40 [0076.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\jj_vl_cs9ibsans.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.802] GetFileType (hFile=0x2b8) returned 0x1 [0076.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.803] GetFileType (hFile=0x2b8) returned 0x1 [0076.803] WriteFile (in: hFile=0x2b8, lpBuffer=0x2879a20*, nNumberOfBytesToWrite=0x14410, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2879a20*, lpNumberOfBytesWritten=0x1c9aeb28*=0x14410, lpOverlapped=0x0) returned 1 [0076.805] CloseHandle (hObject=0x2b8) returned 1 [0076.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", lpFilePart=0x0) returned 0x40 [0076.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", lpFilePart=0x0) returned 0x40 [0076.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\jj_vl_cs9ibsans.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.805] GetFileType (hFile=0x2b8) returned 0x1 [0076.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.805] GetFileType (hFile=0x2b8) returned 0x1 [0076.805] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x14410 [0076.805] WriteFile (in: hFile=0x2b8, lpBuffer=0x288edb8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x288edb8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.805] CloseHandle (hObject=0x2b8) returned 1 [0076.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png", lpFilePart=0x0) returned 0x40 [0076.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\SmpfdmxfY1M5aUJzYU5zLnBuZw==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\SmpfdmxfY1M5aUJzYU5zLnBuZw==", lpFilePart=0x0) returned 0x49 [0076.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\jj_vl_cs9ibsans.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6563ecc0, ftCreationTime.dwHighDateTime=0x1d5e7fc, ftLastAccessTime.dwLowDateTime=0xb08331d0, ftLastAccessTime.dwHighDateTime=0x1d5e157, ftLastWriteTime.dwLowDateTime=0xd57f2900, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1441a)) returned 1 [0076.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.806] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\Jj_vl_cS9iBsaNs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\jj_vl_cs9ibsans.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\SmpfdmxfY1M5aUJzYU5zLnBuZw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\smpfdmxfy1m5aujzyu5zlnbuzw==")) returned 1 [0076.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", lpFilePart=0x0) returned 0x40 [0076.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\l3xqajsiccqi0tr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.806] GetFileType (hFile=0x2b8) returned 0x1 [0076.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.806] GetFileType (hFile=0x2b8) returned 0x1 [0076.807] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xfbe6 [0076.807] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=64476, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xfbdc [0076.807] ReadFile (in: hFile=0x2b8, lpBuffer=0x28901a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28901a8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.807] CloseHandle (hObject=0x2b8) returned 1 [0076.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11c88) returned 0x0 [0076.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", lpFilePart=0x0) returned 0x40 [0076.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\l3xqajsiccqi0tr.mkv"), fInfoLevelId=0x0, lpFileInformation=0x28fce30 | out: lpFileInformation=0x28fce30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1de49d0, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xb0fd4c80, ftLastAccessTime.dwHighDateTime=0x1d5dd75, ftLastWriteTime.dwLowDateTime=0xb0fd4c80, ftLastWriteTime.dwHighDateTime=0x1d5dd75, nFileSizeHigh=0x0, nFileSizeLow=0xfbe6)) returned 1 [0076.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", lpFilePart=0x0) returned 0x40 [0076.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\l3xqajsiccqi0tr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.811] GetFileType (hFile=0x2b8) returned 0x1 [0076.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.811] GetFileType (hFile=0x2b8) returned 0x1 [0076.811] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xfbe6 [0076.812] ReadFile (in: hFile=0x2b8, lpBuffer=0x28fd0e8, nNumberOfBytesToRead=0xfbe6, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28fd0e8*, lpNumberOfBytesRead=0x1c9aea98*=0xfbe6, lpOverlapped=0x0) returned 1 [0076.813] CloseHandle (hObject=0x2b8) returned 1 [0076.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", lpFilePart=0x0) returned 0x40 [0076.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\l3xqajsiccqi0tr.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.869] GetFileType (hFile=0x2b8) returned 0x1 [0076.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.870] GetFileType (hFile=0x2b8) returned 0x1 [0076.870] WriteFile (in: hFile=0x2b8, lpBuffer=0x27dbea8*, nNumberOfBytesToWrite=0xfbf0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x27dbea8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xfbf0, lpOverlapped=0x0) returned 1 [0076.871] CloseHandle (hObject=0x2b8) returned 1 [0076.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", lpFilePart=0x0) returned 0x40 [0076.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", lpFilePart=0x0) returned 0x40 [0076.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\l3xqajsiccqi0tr.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.872] GetFileType (hFile=0x2b8) returned 0x1 [0076.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.872] GetFileType (hFile=0x2b8) returned 0x1 [0076.872] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xfbf0 [0076.872] WriteFile (in: hFile=0x2b8, lpBuffer=0x27eca20*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27eca20*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.872] CloseHandle (hObject=0x2b8) returned 1 [0076.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv", lpFilePart=0x0) returned 0x40 [0076.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\bDNYcWFqU0lDY3FJMFRSLm1rdg==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\bDNYcWFqU0lDY3FJMFRSLm1rdg==", lpFilePart=0x0) returned 0x49 [0076.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\l3xqajsiccqi0tr.mkv"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1de49d0, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xb0fd4c80, ftLastAccessTime.dwHighDateTime=0x1d5dd75, ftLastWriteTime.dwLowDateTime=0xd588ae80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xfbfa)) returned 1 [0076.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.872] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\l3XqajSICcqI0TR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\l3xqajsiccqi0tr.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\bDNYcWFqU0lDY3FJMFRSLm1rdg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\bdnycwfqu0ldy3fjmfrslm1rdg==")) returned 1 [0076.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", lpFilePart=0x0) returned 0x44 [0076.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\piu4bu7qxui5mtj_-lw.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.873] GetFileType (hFile=0x2b8) returned 0x1 [0076.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.873] GetFileType (hFile=0x2b8) returned 0x1 [0076.873] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x13309 [0076.873] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=78591, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x132ff [0076.873] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ede20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27ede20*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.874] CloseHandle (hObject=0x2b8) returned 1 [0076.874] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11c38) returned 0x0 [0076.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", lpFilePart=0x0) returned 0x44 [0076.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.882] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\piu4bu7qxui5mtj_-lw.xls"), fInfoLevelId=0x0, lpFileInformation=0x285b358 | out: lpFileInformation=0x285b358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a78d440, ftCreationTime.dwHighDateTime=0x1d5da26, ftLastAccessTime.dwLowDateTime=0xa0797ab0, ftLastAccessTime.dwHighDateTime=0x1d5d865, ftLastWriteTime.dwLowDateTime=0xa0797ab0, ftLastWriteTime.dwHighDateTime=0x1d5d865, nFileSizeHigh=0x0, nFileSizeLow=0x13309)) returned 1 [0076.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", lpFilePart=0x0) returned 0x44 [0076.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\piu4bu7qxui5mtj_-lw.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.882] GetFileType (hFile=0x2b8) returned 0x1 [0076.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.882] GetFileType (hFile=0x2b8) returned 0x1 [0076.882] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x13309 [0076.882] ReadFile (in: hFile=0x2b8, lpBuffer=0x285b630, nNumberOfBytesToRead=0x13309, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x285b630*, lpNumberOfBytesRead=0x1c9aea98*=0x13309, lpOverlapped=0x0) returned 1 [0076.883] CloseHandle (hObject=0x2b8) returned 1 [0076.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", lpFilePart=0x0) returned 0x44 [0076.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0076.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\piu4bu7qxui5mtj_-lw.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.901] GetFileType (hFile=0x2b8) returned 0x1 [0076.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0076.902] GetFileType (hFile=0x2b8) returned 0x1 [0076.902] WriteFile (in: hFile=0x2b8, lpBuffer=0x290bb58*, nNumberOfBytesToWrite=0x13310, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x290bb58*, lpNumberOfBytesWritten=0x1c9aeb28*=0x13310, lpOverlapped=0x0) returned 1 [0076.904] CloseHandle (hObject=0x2b8) returned 1 [0076.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", lpFilePart=0x0) returned 0x44 [0076.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", lpFilePart=0x0) returned 0x44 [0076.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0076.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\piu4bu7qxui5mtj_-lw.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.904] GetFileType (hFile=0x2b8) returned 0x1 [0076.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0076.904] GetFileType (hFile=0x2b8) returned 0x1 [0076.904] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x13310 [0076.904] WriteFile (in: hFile=0x2b8, lpBuffer=0x291fe30*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x291fe30*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0076.904] CloseHandle (hObject=0x2b8) returned 1 [0076.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls", lpFilePart=0x0) returned 0x44 [0076.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\cEl1NEJVN3F4dUk1TXRqXy1Mdy54bHM=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\cEl1NEJVN3F4dUk1TXRqXy1Mdy54bHM=", lpFilePart=0x0) returned 0x4d [0076.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0076.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\piu4bu7qxui5mtj_-lw.xls"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a78d440, ftCreationTime.dwHighDateTime=0x1d5da26, ftLastAccessTime.dwLowDateTime=0xa0797ab0, ftLastAccessTime.dwHighDateTime=0x1d5d865, ftLastWriteTime.dwLowDateTime=0xd58d7140, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1331a)) returned 1 [0076.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0076.905] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\pIu4BU7qxuI5Mtj_-Lw.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\piu4bu7qxui5mtj_-lw.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\cEl1NEJVN3F4dUk1TXRqXy1Mdy54bHM=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\cel1nejvn3f4duk1txrqxy1mdy54bhm=")) returned 1 [0076.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", lpFilePart=0x0) returned 0x3d [0076.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0076.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\rebda0ci1l_r.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.905] GetFileType (hFile=0x2b8) returned 0x1 [0076.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0076.905] GetFileType (hFile=0x2b8) returned 0x1 [0076.905] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x16de9 [0076.906] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=93663, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x16ddf [0076.922] ReadFile (in: hFile=0x2b8, lpBuffer=0x2921230, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2921230*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0076.923] CloseHandle (hObject=0x2b8) returned 1 [0076.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11c88) returned 0x0 [0076.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", lpFilePart=0x0) returned 0x3d [0076.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0076.936] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\rebda0ci1l_r.wav"), fInfoLevelId=0x0, lpFileInformation=0x27b28d8 | out: lpFileInformation=0x27b28d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe68a370, ftCreationTime.dwHighDateTime=0x1d5e003, ftLastAccessTime.dwLowDateTime=0x3cd6fbd0, ftLastAccessTime.dwHighDateTime=0x1d5d979, ftLastWriteTime.dwLowDateTime=0x3cd6fbd0, ftLastWriteTime.dwHighDateTime=0x1d5d979, nFileSizeHigh=0x0, nFileSizeLow=0x16de9)) returned 1 [0076.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0076.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", lpFilePart=0x0) returned 0x3d [0076.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0076.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\rebda0ci1l_r.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0076.937] GetFileType (hFile=0x2b8) returned 0x1 [0076.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0076.937] GetFileType (hFile=0x2b8) returned 0x1 [0076.937] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x16de9 [0076.937] ReadFile (in: hFile=0x2b8, lpBuffer=0x127770e8, nNumberOfBytesToRead=0x16de9, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x127770e8*, lpNumberOfBytesRead=0x1c9aea98*=0x16de9, lpOverlapped=0x0) returned 1 [0076.938] CloseHandle (hObject=0x2b8) returned 1 [0077.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", lpFilePart=0x0) returned 0x3d [0077.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0077.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\rebda0ci1l_r.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.014] GetFileType (hFile=0x2b8) returned 0x1 [0077.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0077.014] GetFileType (hFile=0x2b8) returned 0x1 [0077.014] WriteFile (in: hFile=0x2b8, lpBuffer=0x127e9738*, nNumberOfBytesToWrite=0x16df0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x127e9738*, lpNumberOfBytesWritten=0x1c9aeb28*=0x16df0, lpOverlapped=0x0) returned 1 [0077.016] CloseHandle (hObject=0x2b8) returned 1 [0077.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", lpFilePart=0x0) returned 0x3d [0077.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", lpFilePart=0x0) returned 0x3d [0077.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\rebda0ci1l_r.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.017] GetFileType (hFile=0x2b8) returned 0x1 [0077.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.017] GetFileType (hFile=0x2b8) returned 0x1 [0077.017] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x16df0 [0077.017] WriteFile (in: hFile=0x2b8, lpBuffer=0x282a888*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x282a888*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0077.017] CloseHandle (hObject=0x2b8) returned 1 [0077.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav", lpFilePart=0x0) returned 0x3d [0077.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\cmViZEEwQ0kxTF9SLndhdg==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\cmViZEEwQ0kxTF9SLndhdg==", lpFilePart=0x0) returned 0x45 [0077.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0077.017] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\rebda0ci1l_r.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe68a370, ftCreationTime.dwHighDateTime=0x1d5e003, ftLastAccessTime.dwLowDateTime=0x3cd6fbd0, ftLastAccessTime.dwHighDateTime=0x1d5d979, ftLastWriteTime.dwLowDateTime=0xd5a07c40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x16dfa)) returned 1 [0077.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0077.017] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\rebdA0CI1L_R.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\rebda0ci1l_r.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\cmViZEEwQ0kxTF9SLndhdg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\cmvizeewq0kxtf9slndhdg==")) returned 1 [0077.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", lpFilePart=0x0) returned 0x3a [0077.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0077.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\u2vuzbob.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.018] GetFileType (hFile=0x2b8) returned 0x1 [0077.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0077.018] GetFileType (hFile=0x2b8) returned 0x1 [0077.018] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x16ffa [0077.018] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=94192, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x16ff0 [0077.018] ReadFile (in: hFile=0x2b8, lpBuffer=0x282bc48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x282bc48*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0077.019] CloseHandle (hObject=0x2b8) returned 1 [0077.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11d28) returned 0x0 [0077.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", lpFilePart=0x0) returned 0x3a [0077.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0077.024] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\u2vuzbob.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2898ac8 | out: lpFileInformation=0x2898ac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723d5c50, ftCreationTime.dwHighDateTime=0x1d5def7, ftLastAccessTime.dwLowDateTime=0xf1a406c0, ftLastAccessTime.dwHighDateTime=0x1d5e1d5, ftLastWriteTime.dwLowDateTime=0xf1a406c0, ftLastWriteTime.dwHighDateTime=0x1d5e1d5, nFileSizeHigh=0x0, nFileSizeLow=0x16ffa)) returned 1 [0077.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0077.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", lpFilePart=0x0) returned 0x3a [0077.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0077.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\u2vuzbob.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.024] GetFileType (hFile=0x2b8) returned 0x1 [0077.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0077.025] GetFileType (hFile=0x2b8) returned 0x1 [0077.025] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x16ffa [0077.025] ReadFile (in: hFile=0x2b8, lpBuffer=0x12800560, nNumberOfBytesToRead=0x16ffa, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x12800560*, lpNumberOfBytesRead=0x1c9aea98*=0x16ffa, lpOverlapped=0x0) returned 1 [0077.025] CloseHandle (hObject=0x2b8) returned 1 [0077.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", lpFilePart=0x0) returned 0x3a [0077.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0077.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\u2vuzbob.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.042] GetFileType (hFile=0x2b8) returned 0x1 [0077.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0077.042] GetFileType (hFile=0x2b8) returned 0x1 [0077.042] WriteFile (in: hFile=0x2b8, lpBuffer=0x12873600*, nNumberOfBytesToWrite=0x17000, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x12873600*, lpNumberOfBytesWritten=0x1c9aeb28*=0x17000, lpOverlapped=0x0) returned 1 [0077.044] CloseHandle (hObject=0x2b8) returned 1 [0077.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", lpFilePart=0x0) returned 0x3a [0077.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", lpFilePart=0x0) returned 0x3a [0077.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\u2vuzbob.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.044] GetFileType (hFile=0x2b8) returned 0x1 [0077.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.044] GetFileType (hFile=0x2b8) returned 0x1 [0077.044] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x17000 [0077.044] WriteFile (in: hFile=0x2b8, lpBuffer=0x2910588*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2910588*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0077.044] CloseHandle (hObject=0x2b8) returned 1 [0077.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx", lpFilePart=0x0) returned 0x3a [0077.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\dTJWdXpib0IucHB0eA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\dTJWdXpib0IucHB0eA==", lpFilePart=0x0) returned 0x41 [0077.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0077.045] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\u2vuzbob.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723d5c50, ftCreationTime.dwHighDateTime=0x1d5def7, ftLastAccessTime.dwLowDateTime=0xf1a406c0, ftLastAccessTime.dwHighDateTime=0x1d5e1d5, ftLastWriteTime.dwLowDateTime=0xd5a2dda0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1700a)) returned 1 [0077.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0077.045] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\u2VuzboB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\u2vuzbob.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\dTJWdXpib0IucHB0eA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\dtjwdxpib0iuchb0ea==")) returned 1 [0077.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", lpFilePart=0x0) returned 0x3b [0077.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0077.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\xhvhmvgbtd.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.045] GetFileType (hFile=0x2b8) returned 0x1 [0077.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0077.045] GetFileType (hFile=0x2b8) returned 0x1 [0077.045] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x11a8b [0077.046] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=72321, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x11a81 [0077.046] ReadFile (in: hFile=0x2b8, lpBuffer=0x2911930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2911930*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0077.046] CloseHandle (hObject=0x2b8) returned 1 [0077.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11d28) returned 0x0 [0077.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", lpFilePart=0x0) returned 0x3b [0077.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0077.062] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\xhvhmvgbtd.jpg"), fInfoLevelId=0x0, lpFileInformation=0x27b0e90 | out: lpFileInformation=0x27b0e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24b33ca0, ftCreationTime.dwHighDateTime=0x1d5d805, ftLastAccessTime.dwLowDateTime=0x280532d0, ftLastAccessTime.dwHighDateTime=0x1d5e081, ftLastWriteTime.dwLowDateTime=0x280532d0, ftLastWriteTime.dwHighDateTime=0x1d5e081, nFileSizeHigh=0x0, nFileSizeLow=0x11a8b)) returned 1 [0077.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0077.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", lpFilePart=0x0) returned 0x3b [0077.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0077.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\xhvhmvgbtd.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.063] GetFileType (hFile=0x2b8) returned 0x1 [0077.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0077.063] GetFileType (hFile=0x2b8) returned 0x1 [0077.063] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x11a8b [0077.063] ReadFile (in: hFile=0x2b8, lpBuffer=0x27b1118, nNumberOfBytesToRead=0x11a8b, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27b1118*, lpNumberOfBytesRead=0x1c9aea98*=0x11a8b, lpOverlapped=0x0) returned 1 [0077.063] CloseHandle (hObject=0x2b8) returned 1 [0077.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", lpFilePart=0x0) returned 0x3b [0077.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0077.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\xhvhmvgbtd.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.105] GetFileType (hFile=0x2b8) returned 0x1 [0077.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0077.105] GetFileType (hFile=0x2b8) returned 0x1 [0077.105] WriteFile (in: hFile=0x2b8, lpBuffer=0x285ccc0*, nNumberOfBytesToWrite=0x11a90, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x285ccc0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x11a90, lpOverlapped=0x0) returned 1 [0077.107] CloseHandle (hObject=0x2b8) returned 1 [0077.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", lpFilePart=0x0) returned 0x3b [0077.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", lpFilePart=0x0) returned 0x3b [0077.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\xhvhmvgbtd.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.107] GetFileType (hFile=0x2b8) returned 0x1 [0077.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.107] GetFileType (hFile=0x2b8) returned 0x1 [0077.107] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x11a90 [0077.108] WriteFile (in: hFile=0x2b8, lpBuffer=0x286f668*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x286f668*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0077.108] CloseHandle (hObject=0x2b8) returned 1 [0077.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg", lpFilePart=0x0) returned 0x3b [0077.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\eEh2aG12Z2J0RC5qcGc=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\eEh2aG12Z2J0RC5qcGc=", lpFilePart=0x0) returned 0x41 [0077.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0077.108] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\xhvhmvgbtd.jpg"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24b33ca0, ftCreationTime.dwHighDateTime=0x1d5d805, ftLastAccessTime.dwLowDateTime=0x280532d0, ftLastAccessTime.dwHighDateTime=0x1d5e081, ftLastWriteTime.dwLowDateTime=0xd5ac6320, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x11a9a)) returned 1 [0077.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0077.108] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\xHvhmvgbtD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\xhvhmvgbtd.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\eEh2aG12Z2J0RC5qcGc=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\eeh2ag12z2j0rc5qcgc=")) returned 1 [0077.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", lpFilePart=0x0) returned 0x37 [0077.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0077.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\znc094.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.110] GetFileType (hFile=0x2b8) returned 0x1 [0077.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0077.110] GetFileType (hFile=0x2b8) returned 0x1 [0077.110] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x18dbe [0077.110] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=101812, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x18db4 [0077.110] ReadFile (in: hFile=0x2b8, lpBuffer=0x2870a00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2870a00*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0077.111] CloseHandle (hObject=0x2b8) returned 1 [0077.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11cd8) returned 0x0 [0077.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", lpFilePart=0x0) returned 0x37 [0077.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0077.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\znc094.rtf"), fInfoLevelId=0x0, lpFileInformation=0x28dd650 | out: lpFileInformation=0x28dd650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6971cf80, ftCreationTime.dwHighDateTime=0x1d5de1a, ftLastAccessTime.dwLowDateTime=0x22e14920, ftLastAccessTime.dwHighDateTime=0x1d5da31, ftLastWriteTime.dwLowDateTime=0x22e14920, ftLastWriteTime.dwHighDateTime=0x1d5da31, nFileSizeHigh=0x0, nFileSizeLow=0x18dbe)) returned 1 [0077.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0077.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", lpFilePart=0x0) returned 0x37 [0077.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0077.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\znc094.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.117] GetFileType (hFile=0x2b8) returned 0x1 [0077.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0077.117] GetFileType (hFile=0x2b8) returned 0x1 [0077.117] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x18dbe [0077.118] ReadFile (in: hFile=0x2b8, lpBuffer=0x128adb70, nNumberOfBytesToRead=0x18dbe, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x128adb70*, lpNumberOfBytesRead=0x1c9aea98*=0x18dbe, lpOverlapped=0x0) returned 1 [0077.118] CloseHandle (hObject=0x2b8) returned 1 [0077.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", lpFilePart=0x0) returned 0x37 [0077.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0077.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\znc094.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.135] GetFileType (hFile=0x2b8) returned 0x1 [0077.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0077.135] GetFileType (hFile=0x2b8) returned 0x1 [0077.135] WriteFile (in: hFile=0x2b8, lpBuffer=0x128f8538*, nNumberOfBytesToWrite=0x18dc0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x128f8538*, lpNumberOfBytesWritten=0x1c9aeb28*=0x18dc0, lpOverlapped=0x0) returned 1 [0077.137] CloseHandle (hObject=0x2b8) returned 1 [0077.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", lpFilePart=0x0) returned 0x37 [0077.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", lpFilePart=0x0) returned 0x37 [0077.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\znc094.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.137] GetFileType (hFile=0x2b8) returned 0x1 [0077.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.137] GetFileType (hFile=0x2b8) returned 0x1 [0077.137] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x18dc0 [0077.137] WriteFile (in: hFile=0x2b8, lpBuffer=0x29550b0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x29550b0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0077.138] CloseHandle (hObject=0x2b8) returned 1 [0077.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf", lpFilePart=0x0) returned 0x37 [0077.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\em5DMDk0LnJ0Zg==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\em5DMDk0LnJ0Zg==", lpFilePart=0x0) returned 0x3d [0077.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0077.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\znc094.rtf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6971cf80, ftCreationTime.dwHighDateTime=0x1d5de1a, ftLastAccessTime.dwLowDateTime=0x22e14920, ftLastAccessTime.dwHighDateTime=0x1d5da31, ftLastWriteTime.dwLowDateTime=0xd5b125e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x18dca)) returned 1 [0077.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0077.138] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\znC094.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\znc094.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\em5DMDk0LnJ0Zg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\em5dmdk0lnj0zg==")) returned 1 [0077.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\README_3728769.txt", lpFilePart=0x0) returned 0x3f [0077.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0077.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\V qilK\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v qilk\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0077.139] GetFileType (hFile=0x2b8) returned 0x1 [0077.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0077.139] GetFileType (hFile=0x2b8) returned 0x1 [0077.139] WriteFile (in: hFile=0x2b8, lpBuffer=0x2959340*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x2959340*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0077.140] CloseHandle (hObject=0x2b8) returned 1 [0077.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\README_3728769.txt", lpFilePart=0x0) returned 0x38 [0077.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0077.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0077.141] GetFileType (hFile=0x2b8) returned 0x1 [0077.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0077.141] GetFileType (hFile=0x2b8) returned 0x1 [0077.141] WriteFile (in: hFile=0x2b8, lpBuffer=0x295d3e8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x295d3e8*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0077.142] CloseHandle (hObject=0x2b8) returned 1 [0077.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0077.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0077.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0077.142] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8fe8900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd8fe8900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0077.142] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8fe8900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd8fe8900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.142] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa36c2bf0, ftCreationTime.dwHighDateTime=0x1d5e328, ftLastAccessTime.dwLowDateTime=0xf7b12e30, ftLastAccessTime.dwHighDateTime=0x1d5d7ee, ftLastWriteTime.dwLowDateTime=0xf7b12e30, ftLastWriteTime.dwHighDateTime=0x1d5d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="67aJ7_i p8_YV 3zvm", cAlternateFileName="67AJ7_~1")) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9492100, ftCreationTime.dwHighDateTime=0x1d5e625, ftLastAccessTime.dwLowDateTime=0xe5fcced0, ftLastAccessTime.dwHighDateTime=0x1d5d7c4, ftLastWriteTime.dwLowDateTime=0xe5fcced0, ftLastWriteTime.dwHighDateTime=0x1d5d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xe195, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Be8MZAyukKocsQc3.pdf", cAlternateFileName="7BE8MZ~1.PDF")) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33236a0, ftCreationTime.dwHighDateTime=0x1d5dd8a, ftLastAccessTime.dwLowDateTime=0x26ce4330, ftLastAccessTime.dwHighDateTime=0x1d5e594, ftLastWriteTime.dwLowDateTime=0x26ce4330, ftLastWriteTime.dwHighDateTime=0x1d5e594, nFileSizeHigh=0x0, nFileSizeLow=0x16b75, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ar6BV_.odp", cAlternateFileName="")) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e53770, ftCreationTime.dwHighDateTime=0x1d5ddda, ftLastAccessTime.dwLowDateTime=0x562b500, ftLastAccessTime.dwHighDateTime=0x1d58d51, ftLastWriteTime.dwLowDateTime=0x562b500, ftLastWriteTime.dwHighDateTime=0x1d58d51, nFileSizeHigh=0x0, nFileSizeLow=0x11999, dwReserved0=0x0, dwReserved1=0x0, cFileName="D1tNn0.xlsx", cAlternateFileName="D1TNN0~1.XLS")) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48c719c0, ftCreationTime.dwHighDateTime=0x1d5dfff, ftLastAccessTime.dwLowDateTime=0x749e1290, ftLastAccessTime.dwHighDateTime=0x1d5da6b, ftLastWriteTime.dwLowDateTime=0x749e1290, ftLastWriteTime.dwHighDateTime=0x1d5da6b, nFileSizeHigh=0x0, nFileSizeLow=0x17ba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDWxz0scPwwSZ5Khy.ppt", cAlternateFileName="EDWXZ0~1.PPT")) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe04e80, ftCreationTime.dwHighDateTime=0x1d57f4f, ftLastAccessTime.dwLowDateTime=0x29efbc30, ftLastAccessTime.dwHighDateTime=0x1d5d6a6, ftLastWriteTime.dwLowDateTime=0x29efbc30, ftLastWriteTime.dwHighDateTime=0x1d5d6a6, nFileSizeHigh=0x0, nFileSizeLow=0xd460, dwReserved0=0x0, dwReserved1=0x0, cFileName="eg FVX7.pptx", cAlternateFileName="EGFVX7~1.PPT")) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb916d1a0, ftCreationTime.dwHighDateTime=0x1d55e51, ftLastAccessTime.dwLowDateTime=0x4bd174c0, ftLastAccessTime.dwHighDateTime=0x1d5a581, ftLastWriteTime.dwLowDateTime=0x4bd174c0, ftLastWriteTime.dwHighDateTime=0x1d5a581, nFileSizeHigh=0x0, nFileSizeLow=0xe697, dwReserved0=0x0, dwReserved1=0x0, cFileName="gMrC2Frnx1sja2.pptx", cAlternateFileName="GMRC2F~1.PPT")) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fcdbbe0, ftCreationTime.dwHighDateTime=0x1d5ac27, ftLastAccessTime.dwLowDateTime=0x47ca2b20, ftLastAccessTime.dwHighDateTime=0x1d5a4c2, ftLastWriteTime.dwLowDateTime=0x47ca2b20, ftLastWriteTime.dwHighDateTime=0x1d5a4c2, nFileSizeHigh=0x0, nFileSizeLow=0x17fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IxtEWgJcoLZ3NJYYP5F1.docx", cAlternateFileName="IXTEWG~1.DOC")) returned 1 [0077.144] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cb1ae0, ftCreationTime.dwHighDateTime=0x1d5bc21, ftLastAccessTime.dwLowDateTime=0xd1dd46a0, ftLastAccessTime.dwHighDateTime=0x1d588dc, ftLastWriteTime.dwLowDateTime=0xd1dd46a0, ftLastWriteTime.dwHighDateTime=0x1d588dc, nFileSizeHigh=0x0, nFileSizeLow=0xddd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jc0hzL-EHl9Dfp56.xlsx", cAlternateFileName="JC0HZL~1.XLS")) returned 1 [0077.144] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7002b00, ftCreationTime.dwHighDateTime=0x1d58161, ftLastAccessTime.dwLowDateTime=0xd8208e00, ftLastAccessTime.dwHighDateTime=0x1d5c94b, ftLastWriteTime.dwLowDateTime=0xd8208e00, ftLastWriteTime.dwHighDateTime=0x1d5c94b, nFileSizeHigh=0x0, nFileSizeLow=0x14baa, dwReserved0=0x0, dwReserved1=0x0, cFileName="kTA9XoT0E.pptx", cAlternateFileName="KTA9XO~1.PPT")) returned 1 [0077.144] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1a2bd0, ftCreationTime.dwHighDateTime=0x1d5b5fe, ftLastAccessTime.dwLowDateTime=0xa8828ac0, ftLastAccessTime.dwHighDateTime=0x1d59018, ftLastWriteTime.dwLowDateTime=0xa8828ac0, ftLastWriteTime.dwHighDateTime=0x1d59018, nFileSizeHigh=0x0, nFileSizeLow=0x3826, dwReserved0=0x0, dwReserved1=0x0, cFileName="lPBXt40mEeaYb.docx", cAlternateFileName="LPBXT4~1.DOC")) returned 1 [0077.144] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0077.144] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0077.144] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0077.144] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0077.144] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5db70, ftCreationTime.dwHighDateTime=0x1d5df8b, ftLastAccessTime.dwLowDateTime=0x3adf2bb0, ftLastAccessTime.dwHighDateTime=0x1d5c4fa, ftLastWriteTime.dwLowDateTime=0x3adf2bb0, ftLastWriteTime.dwHighDateTime=0x1d5c4fa, nFileSizeHigh=0x0, nFileSizeLow=0x18cc9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M_jazGKJ2kHlz.docx", cAlternateFileName="M_JAZG~1.DOC")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc09680, ftCreationTime.dwHighDateTime=0x1d5cb34, ftLastAccessTime.dwLowDateTime=0x8e0d0a60, ftLastAccessTime.dwHighDateTime=0x1d56315, ftLastWriteTime.dwLowDateTime=0x8e0d0a60, ftLastWriteTime.dwHighDateTime=0x1d56315, nFileSizeHigh=0x0, nFileSizeLow=0xb7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NessWCu11L6WUh3.pptx", cAlternateFileName="NESSWC~1.PPT")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe6091e0, ftCreationTime.dwHighDateTime=0x1d5c801, ftLastAccessTime.dwLowDateTime=0xab81ded0, ftLastAccessTime.dwHighDateTime=0x1d56eec, ftLastWriteTime.dwLowDateTime=0xab81ded0, ftLastWriteTime.dwHighDateTime=0x1d56eec, nFileSizeHigh=0x0, nFileSizeLow=0x14762, dwReserved0=0x0, dwReserved1=0x0, cFileName="nTHTwicVY.xlsx", cAlternateFileName="NTHTWI~1.XLS")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78315bc0, ftCreationTime.dwHighDateTime=0x1d593fc, ftLastAccessTime.dwLowDateTime=0x1509c040, ftLastAccessTime.dwHighDateTime=0x1d5654f, ftLastWriteTime.dwLowDateTime=0x1509c040, ftLastWriteTime.dwHighDateTime=0x1d5654f, nFileSizeHigh=0x0, nFileSizeLow=0x5a8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="OAID4GlsrUr8xznELGK.xlsx", cAlternateFileName="OAID4G~1.XLS")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6494fee0, ftCreationTime.dwHighDateTime=0x1d5dff7, ftLastAccessTime.dwLowDateTime=0xfc0a7c60, ftLastAccessTime.dwHighDateTime=0x1d56512, ftLastWriteTime.dwLowDateTime=0xfc0a7c60, ftLastWriteTime.dwHighDateTime=0x1d56512, nFileSizeHigh=0x0, nFileSizeLow=0x11d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="oG2dBqt8X.docx", cAlternateFileName="OG2DBQ~1.DOC")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700f8040, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0x5deeea0, ftLastAccessTime.dwHighDateTime=0x1d5e59d, ftLastWriteTime.dwLowDateTime=0x5deeea0, ftLastWriteTime.dwHighDateTime=0x1d5e59d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="u2d2Dy3vGrCm", cAlternateFileName="U2D2DY~1")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24cf830, ftCreationTime.dwHighDateTime=0x1d5bbae, ftLastAccessTime.dwLowDateTime=0x406a4f20, ftLastAccessTime.dwHighDateTime=0x1d5b824, ftLastWriteTime.dwLowDateTime=0x406a4f20, ftLastWriteTime.dwHighDateTime=0x1d5b824, nFileSizeHigh=0x0, nFileSizeLow=0x15918, dwReserved0=0x0, dwReserved1=0x0, cFileName="X6gMSsHOHR.xlsx", cAlternateFileName="X6GMSS~1.XLS")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9342d5b0, ftCreationTime.dwHighDateTime=0x1d5b0f3, ftLastAccessTime.dwLowDateTime=0x9aab9b20, ftLastAccessTime.dwHighDateTime=0x1d56495, ftLastWriteTime.dwLowDateTime=0x9aab9b20, ftLastWriteTime.dwHighDateTime=0x1d56495, nFileSizeHigh=0x0, nFileSizeLow=0xcca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y3pqIF.pptx", cAlternateFileName="Y3PQIF~1.PPT")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ad9530, ftCreationTime.dwHighDateTime=0x1d5c0e8, ftLastAccessTime.dwLowDateTime=0x6877cc10, ftLastAccessTime.dwHighDateTime=0x1d5c9b6, ftLastWriteTime.dwLowDateTime=0x6877cc10, ftLastWriteTime.dwHighDateTime=0x1d5c9b6, nFileSizeHigh=0x0, nFileSizeLow=0x3476, dwReserved0=0x0, dwReserved1=0x0, cFileName="YCf DSnoP3iexATjiSm.docx", cAlternateFileName="YCFDSN~1.DOC")) returned 1 [0077.146] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.146] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0077.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0077.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0077.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0077.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0077.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0077.147] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8fe8900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd8fe8900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0077.147] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8fe8900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd8fe8900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.147] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa36c2bf0, ftCreationTime.dwHighDateTime=0x1d5e328, ftLastAccessTime.dwLowDateTime=0xf7b12e30, ftLastAccessTime.dwHighDateTime=0x1d5d7ee, ftLastWriteTime.dwLowDateTime=0xf7b12e30, ftLastWriteTime.dwHighDateTime=0x1d5d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="67aJ7_i p8_YV 3zvm", cAlternateFileName="67AJ7_~1")) returned 1 [0077.147] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9492100, ftCreationTime.dwHighDateTime=0x1d5e625, ftLastAccessTime.dwLowDateTime=0xe5fcced0, ftLastAccessTime.dwHighDateTime=0x1d5d7c4, ftLastWriteTime.dwLowDateTime=0xe5fcced0, ftLastWriteTime.dwHighDateTime=0x1d5d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xe195, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Be8MZAyukKocsQc3.pdf", cAlternateFileName="7BE8MZ~1.PDF")) returned 1 [0077.147] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33236a0, ftCreationTime.dwHighDateTime=0x1d5dd8a, ftLastAccessTime.dwLowDateTime=0x26ce4330, ftLastAccessTime.dwHighDateTime=0x1d5e594, ftLastWriteTime.dwLowDateTime=0x26ce4330, ftLastWriteTime.dwHighDateTime=0x1d5e594, nFileSizeHigh=0x0, nFileSizeLow=0x16b75, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ar6BV_.odp", cAlternateFileName="")) returned 1 [0077.147] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e53770, ftCreationTime.dwHighDateTime=0x1d5ddda, ftLastAccessTime.dwLowDateTime=0x562b500, ftLastAccessTime.dwHighDateTime=0x1d58d51, ftLastWriteTime.dwLowDateTime=0x562b500, ftLastWriteTime.dwHighDateTime=0x1d58d51, nFileSizeHigh=0x0, nFileSizeLow=0x11999, dwReserved0=0x0, dwReserved1=0x0, cFileName="D1tNn0.xlsx", cAlternateFileName="D1TNN0~1.XLS")) returned 1 [0077.147] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.147] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48c719c0, ftCreationTime.dwHighDateTime=0x1d5dfff, ftLastAccessTime.dwLowDateTime=0x749e1290, ftLastAccessTime.dwHighDateTime=0x1d5da6b, ftLastWriteTime.dwLowDateTime=0x749e1290, ftLastWriteTime.dwHighDateTime=0x1d5da6b, nFileSizeHigh=0x0, nFileSizeLow=0x17ba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDWxz0scPwwSZ5Khy.ppt", cAlternateFileName="EDWXZ0~1.PPT")) returned 1 [0077.147] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe04e80, ftCreationTime.dwHighDateTime=0x1d57f4f, ftLastAccessTime.dwLowDateTime=0x29efbc30, ftLastAccessTime.dwHighDateTime=0x1d5d6a6, ftLastWriteTime.dwLowDateTime=0x29efbc30, ftLastWriteTime.dwHighDateTime=0x1d5d6a6, nFileSizeHigh=0x0, nFileSizeLow=0xd460, dwReserved0=0x0, dwReserved1=0x0, cFileName="eg FVX7.pptx", cAlternateFileName="EGFVX7~1.PPT")) returned 1 [0077.148] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb916d1a0, ftCreationTime.dwHighDateTime=0x1d55e51, ftLastAccessTime.dwLowDateTime=0x4bd174c0, ftLastAccessTime.dwHighDateTime=0x1d5a581, ftLastWriteTime.dwLowDateTime=0x4bd174c0, ftLastWriteTime.dwHighDateTime=0x1d5a581, nFileSizeHigh=0x0, nFileSizeLow=0xe697, dwReserved0=0x0, dwReserved1=0x0, cFileName="gMrC2Frnx1sja2.pptx", cAlternateFileName="GMRC2F~1.PPT")) returned 1 [0077.148] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fcdbbe0, ftCreationTime.dwHighDateTime=0x1d5ac27, ftLastAccessTime.dwLowDateTime=0x47ca2b20, ftLastAccessTime.dwHighDateTime=0x1d5a4c2, ftLastWriteTime.dwLowDateTime=0x47ca2b20, ftLastWriteTime.dwHighDateTime=0x1d5a4c2, nFileSizeHigh=0x0, nFileSizeLow=0x17fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IxtEWgJcoLZ3NJYYP5F1.docx", cAlternateFileName="IXTEWG~1.DOC")) returned 1 [0077.148] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cb1ae0, ftCreationTime.dwHighDateTime=0x1d5bc21, ftLastAccessTime.dwLowDateTime=0xd1dd46a0, ftLastAccessTime.dwHighDateTime=0x1d588dc, ftLastWriteTime.dwLowDateTime=0xd1dd46a0, ftLastWriteTime.dwHighDateTime=0x1d588dc, nFileSizeHigh=0x0, nFileSizeLow=0xddd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jc0hzL-EHl9Dfp56.xlsx", cAlternateFileName="JC0HZL~1.XLS")) returned 1 [0077.148] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7002b00, ftCreationTime.dwHighDateTime=0x1d58161, ftLastAccessTime.dwLowDateTime=0xd8208e00, ftLastAccessTime.dwHighDateTime=0x1d5c94b, ftLastWriteTime.dwLowDateTime=0xd8208e00, ftLastWriteTime.dwHighDateTime=0x1d5c94b, nFileSizeHigh=0x0, nFileSizeLow=0x14baa, dwReserved0=0x0, dwReserved1=0x0, cFileName="kTA9XoT0E.pptx", cAlternateFileName="KTA9XO~1.PPT")) returned 1 [0077.148] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1a2bd0, ftCreationTime.dwHighDateTime=0x1d5b5fe, ftLastAccessTime.dwLowDateTime=0xa8828ac0, ftLastAccessTime.dwHighDateTime=0x1d59018, ftLastWriteTime.dwLowDateTime=0xa8828ac0, ftLastWriteTime.dwHighDateTime=0x1d59018, nFileSizeHigh=0x0, nFileSizeLow=0x3826, dwReserved0=0x0, dwReserved1=0x0, cFileName="lPBXt40mEeaYb.docx", cAlternateFileName="LPBXT4~1.DOC")) returned 1 [0077.148] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0077.148] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0077.148] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0077.148] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0077.149] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5db70, ftCreationTime.dwHighDateTime=0x1d5df8b, ftLastAccessTime.dwLowDateTime=0x3adf2bb0, ftLastAccessTime.dwHighDateTime=0x1d5c4fa, ftLastWriteTime.dwLowDateTime=0x3adf2bb0, ftLastWriteTime.dwHighDateTime=0x1d5c4fa, nFileSizeHigh=0x0, nFileSizeLow=0x18cc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="M_jazGKJ2kHlz.docx", cAlternateFileName="M_JAZG~1.DOC")) returned 1 [0077.149] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc09680, ftCreationTime.dwHighDateTime=0x1d5cb34, ftLastAccessTime.dwLowDateTime=0x8e0d0a60, ftLastAccessTime.dwHighDateTime=0x1d56315, ftLastWriteTime.dwLowDateTime=0x8e0d0a60, ftLastWriteTime.dwHighDateTime=0x1d56315, nFileSizeHigh=0x0, nFileSizeLow=0xb7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NessWCu11L6WUh3.pptx", cAlternateFileName="NESSWC~1.PPT")) returned 1 [0077.149] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe6091e0, ftCreationTime.dwHighDateTime=0x1d5c801, ftLastAccessTime.dwLowDateTime=0xab81ded0, ftLastAccessTime.dwHighDateTime=0x1d56eec, ftLastWriteTime.dwLowDateTime=0xab81ded0, ftLastWriteTime.dwHighDateTime=0x1d56eec, nFileSizeHigh=0x0, nFileSizeLow=0x14762, dwReserved0=0x0, dwReserved1=0x0, cFileName="nTHTwicVY.xlsx", cAlternateFileName="NTHTWI~1.XLS")) returned 1 [0077.149] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78315bc0, ftCreationTime.dwHighDateTime=0x1d593fc, ftLastAccessTime.dwLowDateTime=0x1509c040, ftLastAccessTime.dwHighDateTime=0x1d5654f, ftLastWriteTime.dwLowDateTime=0x1509c040, ftLastWriteTime.dwHighDateTime=0x1d5654f, nFileSizeHigh=0x0, nFileSizeLow=0x5a8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="OAID4GlsrUr8xznELGK.xlsx", cAlternateFileName="OAID4G~1.XLS")) returned 1 [0077.149] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6494fee0, ftCreationTime.dwHighDateTime=0x1d5dff7, ftLastAccessTime.dwLowDateTime=0xfc0a7c60, ftLastAccessTime.dwHighDateTime=0x1d56512, ftLastWriteTime.dwLowDateTime=0xfc0a7c60, ftLastWriteTime.dwHighDateTime=0x1d56512, nFileSizeHigh=0x0, nFileSizeLow=0x11d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="oG2dBqt8X.docx", cAlternateFileName="OG2DBQ~1.DOC")) returned 1 [0077.149] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0077.149] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700f8040, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0x5deeea0, ftLastAccessTime.dwHighDateTime=0x1d5e59d, ftLastWriteTime.dwLowDateTime=0x5deeea0, ftLastWriteTime.dwHighDateTime=0x1d5e59d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="u2d2Dy3vGrCm", cAlternateFileName="U2D2DY~1")) returned 1 [0077.149] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24cf830, ftCreationTime.dwHighDateTime=0x1d5bbae, ftLastAccessTime.dwLowDateTime=0x406a4f20, ftLastAccessTime.dwHighDateTime=0x1d5b824, ftLastWriteTime.dwLowDateTime=0x406a4f20, ftLastWriteTime.dwHighDateTime=0x1d5b824, nFileSizeHigh=0x0, nFileSizeLow=0x15918, dwReserved0=0x0, dwReserved1=0x0, cFileName="X6gMSsHOHR.xlsx", cAlternateFileName="X6GMSS~1.XLS")) returned 1 [0077.150] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9342d5b0, ftCreationTime.dwHighDateTime=0x1d5b0f3, ftLastAccessTime.dwLowDateTime=0x9aab9b20, ftLastAccessTime.dwHighDateTime=0x1d56495, ftLastWriteTime.dwLowDateTime=0x9aab9b20, ftLastWriteTime.dwHighDateTime=0x1d56495, nFileSizeHigh=0x0, nFileSizeLow=0xcca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y3pqIF.pptx", cAlternateFileName="Y3PQIF~1.PPT")) returned 1 [0077.150] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ad9530, ftCreationTime.dwHighDateTime=0x1d5c0e8, ftLastAccessTime.dwLowDateTime=0x6877cc10, ftLastAccessTime.dwHighDateTime=0x1d5c9b6, ftLastWriteTime.dwLowDateTime=0x6877cc10, ftLastWriteTime.dwHighDateTime=0x1d5c9b6, nFileSizeHigh=0x0, nFileSizeLow=0x3476, dwReserved0=0x0, dwReserved1=0x0, cFileName="YCf DSnoP3iexATjiSm.docx", cAlternateFileName="YCFDSN~1.DOC")) returned 1 [0077.150] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ad9530, ftCreationTime.dwHighDateTime=0x1d5c0e8, ftLastAccessTime.dwLowDateTime=0x6877cc10, ftLastAccessTime.dwHighDateTime=0x1d5c9b6, ftLastWriteTime.dwLowDateTime=0x6877cc10, ftLastWriteTime.dwHighDateTime=0x1d5c9b6, nFileSizeHigh=0x0, nFileSizeLow=0x3476, dwReserved0=0x0, dwReserved1=0x0, cFileName="YCf DSnoP3iexATjiSm.docx", cAlternateFileName="YCFDSN~1.DOC")) returned 0 [0077.150] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0077.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0077.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0077.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", lpFilePart=0x0) returned 0x3d [0077.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7be8mzayukkocsqc3.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.150] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xe195 [0077.150] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=57739, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xe18b [0077.150] ReadFile (in: hFile=0x2b8, lpBuffer=0x29666b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x29666b8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", lpFilePart=0x0) returned 0x3d [0077.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.165] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7be8mzayukkocsqc3.pdf"), fInfoLevelId=0x0, lpFileInformation=0x27feee0 | out: lpFileInformation=0x27feee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9492100, ftCreationTime.dwHighDateTime=0x1d5e625, ftLastAccessTime.dwLowDateTime=0xe5fcced0, ftLastAccessTime.dwHighDateTime=0x1d5d7c4, ftLastWriteTime.dwLowDateTime=0xe5fcced0, ftLastWriteTime.dwHighDateTime=0x1d5d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xe195)) returned 1 [0077.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", lpFilePart=0x0) returned 0x3d [0077.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7be8mzayukkocsqc3.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.165] GetFileType (hFile=0x2b8) returned 0x1 [0077.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.165] GetFileType (hFile=0x2b8) returned 0x1 [0077.165] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xe195 [0077.165] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ff198, nNumberOfBytesToRead=0xe195, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27ff198*, lpNumberOfBytesRead=0x1c9aeb38*=0xe195, lpOverlapped=0x0) returned 1 [0077.165] CloseHandle (hObject=0x2b8) returned 1 [0077.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", lpFilePart=0x0) returned 0x3d [0077.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7be8mzayukkocsqc3.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.209] GetFileType (hFile=0x2b8) returned 0x1 [0077.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.209] GetFileType (hFile=0x2b8) returned 0x1 [0077.209] WriteFile (in: hFile=0x2b8, lpBuffer=0x28a0468*, nNumberOfBytesToWrite=0xe1a0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x28a0468*, lpNumberOfBytesWritten=0x1c9aebc8*=0xe1a0, lpOverlapped=0x0) returned 1 [0077.211] CloseHandle (hObject=0x2b8) returned 1 [0077.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", lpFilePart=0x0) returned 0x3d [0077.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", lpFilePart=0x0) returned 0x3d [0077.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7be8mzayukkocsqc3.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.211] GetFileType (hFile=0x2b8) returned 0x1 [0077.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.211] GetFileType (hFile=0x2b8) returned 0x1 [0077.211] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xe1a0 [0077.211] WriteFile (in: hFile=0x2b8, lpBuffer=0x28af578*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28af578*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.211] CloseHandle (hObject=0x2b8) returned 1 [0077.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf", lpFilePart=0x0) returned 0x3d [0077.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0JlOE1aQXl1a0tvY3NRYzMucGRm", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0JlOE1aQXl1a0tvY3NRYzMucGRm", lpFilePart=0x0) returned 0x44 [0077.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7be8mzayukkocsqc3.pdf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9492100, ftCreationTime.dwHighDateTime=0x1d5e625, ftLastAccessTime.dwLowDateTime=0xe5fcced0, ftLastAccessTime.dwHighDateTime=0x1d5d7c4, ftLastWriteTime.dwLowDateTime=0xd5bd0cc0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe1aa)) returned 1 [0077.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.212] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Be8MZAyukKocsQc3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7be8mzayukkocsqc3.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0JlOE1aQXl1a0tvY3NRYzMucGRm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n0jloe1aqxl1a0tvy3nryzmucgrm")) returned 1 [0077.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", lpFilePart=0x0) returned 0x33 [0077.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ar6bv_.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.213] GetFileType (hFile=0x2b8) returned 0x1 [0077.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.213] GetFileType (hFile=0x2b8) returned 0x1 [0077.213] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x16b75 [0077.213] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=93035, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x16b6b [0077.213] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b0920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28b0920*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.214] CloseHandle (hObject=0x2b8) returned 1 [0077.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", lpFilePart=0x0) returned 0x33 [0077.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.220] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ar6bv_.odp"), fInfoLevelId=0x0, lpFileInformation=0x291d690 | out: lpFileInformation=0x291d690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33236a0, ftCreationTime.dwHighDateTime=0x1d5dd8a, ftLastAccessTime.dwLowDateTime=0x26ce4330, ftLastAccessTime.dwHighDateTime=0x1d5e594, ftLastWriteTime.dwLowDateTime=0x26ce4330, ftLastWriteTime.dwHighDateTime=0x1d5e594, nFileSizeHigh=0x0, nFileSizeLow=0x16b75)) returned 1 [0077.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", lpFilePart=0x0) returned 0x33 [0077.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ar6bv_.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.220] GetFileType (hFile=0x2b8) returned 0x1 [0077.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.220] GetFileType (hFile=0x2b8) returned 0x1 [0077.220] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x16b75 [0077.255] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x16b75, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb38*=0x16b75, lpOverlapped=0x0) returned 1 [0077.255] CloseHandle (hObject=0x2b8) returned 1 [0077.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", lpFilePart=0x0) returned 0x33 [0077.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ar6bv_.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.310] GetFileType (hFile=0x2b8) returned 0x1 [0077.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.310] GetFileType (hFile=0x2b8) returned 0x1 [0077.310] WriteFile (in: hFile=0x2b8, lpBuffer=0x126d3380*, nNumberOfBytesToWrite=0x16b80, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x126d3380*, lpNumberOfBytesWritten=0x1c9aebc8*=0x16b80, lpOverlapped=0x0) returned 1 [0077.313] CloseHandle (hObject=0x2b8) returned 1 [0077.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", lpFilePart=0x0) returned 0x33 [0077.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", lpFilePart=0x0) returned 0x33 [0077.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ar6bv_.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.313] GetFileType (hFile=0x2b8) returned 0x1 [0077.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.313] GetFileType (hFile=0x2b8) returned 0x1 [0077.313] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x16b80 [0077.313] WriteFile (in: hFile=0x2b8, lpBuffer=0x2733120*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2733120*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.316] CloseHandle (hObject=0x2b8) returned 1 [0077.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp", lpFilePart=0x0) returned 0x33 [0077.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OGFyNkJWXy5vZHA=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OGFyNkJWXy5vZHA=", lpFilePart=0x0) returned 0x38 [0077.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.316] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ar6bv_.odp"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33236a0, ftCreationTime.dwHighDateTime=0x1d5dd8a, ftLastAccessTime.dwLowDateTime=0x26ce4330, ftLastAccessTime.dwHighDateTime=0x1d5e594, ftLastWriteTime.dwLowDateTime=0xd5cdb660, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x16b8a)) returned 1 [0077.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.316] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8ar6BV_.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8ar6bv_.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OGFyNkJWXy5vZHA=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ogfynkjwxy5vzha=")) returned 1 [0077.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", lpFilePart=0x0) returned 0x33 [0077.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\d1tnn0.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.317] GetFileType (hFile=0x2b8) returned 0x1 [0077.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.317] GetFileType (hFile=0x2b8) returned 0x1 [0077.317] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x11999 [0077.317] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=72079, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1198f [0077.317] ReadFile (in: hFile=0x2b8, lpBuffer=0x2734480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2734480*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.318] CloseHandle (hObject=0x2b8) returned 1 [0077.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", lpFilePart=0x0) returned 0x33 [0077.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\d1tnn0.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x27a11f0 | out: lpFileInformation=0x27a11f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e53770, ftCreationTime.dwHighDateTime=0x1d5ddda, ftLastAccessTime.dwLowDateTime=0x562b500, ftLastAccessTime.dwHighDateTime=0x1d58d51, ftLastWriteTime.dwLowDateTime=0x562b500, ftLastWriteTime.dwHighDateTime=0x1d58d51, nFileSizeHigh=0x0, nFileSizeLow=0x11999)) returned 1 [0077.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", lpFilePart=0x0) returned 0x33 [0077.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\d1tnn0.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.324] GetFileType (hFile=0x2b8) returned 0x1 [0077.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.324] GetFileType (hFile=0x2b8) returned 0x1 [0077.324] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x11999 [0077.324] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a1448, nNumberOfBytesToRead=0x11999, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27a1448*, lpNumberOfBytesRead=0x1c9aeb38*=0x11999, lpOverlapped=0x0) returned 1 [0077.325] CloseHandle (hObject=0x2b8) returned 1 [0077.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", lpFilePart=0x0) returned 0x33 [0077.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\d1tnn0.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.340] GetFileType (hFile=0x2b8) returned 0x1 [0077.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.340] GetFileType (hFile=0x2b8) returned 0x1 [0077.340] WriteFile (in: hFile=0x2b8, lpBuffer=0x284ca88*, nNumberOfBytesToWrite=0x119a0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x284ca88*, lpNumberOfBytesWritten=0x1c9aebc8*=0x119a0, lpOverlapped=0x0) returned 1 [0077.342] CloseHandle (hObject=0x2b8) returned 1 [0077.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", lpFilePart=0x0) returned 0x33 [0077.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", lpFilePart=0x0) returned 0x33 [0077.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\d1tnn0.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.342] GetFileType (hFile=0x2b8) returned 0x1 [0077.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.342] GetFileType (hFile=0x2b8) returned 0x1 [0077.342] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x119a0 [0077.343] WriteFile (in: hFile=0x2b8, lpBuffer=0x285f2d0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x285f2d0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.343] CloseHandle (hObject=0x2b8) returned 1 [0077.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx", lpFilePart=0x0) returned 0x33 [0077.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RDF0Tm4wLnhsc3g=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RDF0Tm4wLnhsc3g=", lpFilePart=0x0) returned 0x38 [0077.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.343] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\d1tnn0.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e53770, ftCreationTime.dwHighDateTime=0x1d5ddda, ftLastAccessTime.dwLowDateTime=0x562b500, ftLastAccessTime.dwHighDateTime=0x1d58d51, ftLastWriteTime.dwLowDateTime=0xd5d27920, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x119aa)) returned 1 [0077.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.343] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\D1tNn0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\d1tnn0.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RDF0Tm4wLnhsc3g=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rdf0tm4wlnhsc3g=")) returned 1 [0077.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x33 [0077.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.344] GetFileType (hFile=0x2b8) returned 0x1 [0077.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.344] GetFileType (hFile=0x2b8) returned 0x1 [0077.344] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x192 [0077.344] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=392, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x188 [0077.344] ReadFile (in: hFile=0x2b8, lpBuffer=0x2860630, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2860630*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.345] CloseHandle (hObject=0x2b8) returned 1 [0077.345] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x33 [0077.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x26f7d50 | out: lpFileInformation=0x26f7d50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192)) returned 1 [0077.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x33 [0077.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.356] GetFileType (hFile=0x2b8) returned 0x1 [0077.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.356] GetFileType (hFile=0x2b8) returned 0x1 [0077.356] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x192 [0077.356] ReadFile (in: hFile=0x2b8, lpBuffer=0x26f8158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26f8158*, lpNumberOfBytesRead=0x1c9aeb38*=0x192, lpOverlapped=0x0) returned 1 [0077.356] CloseHandle (hObject=0x2b8) returned 1 [0077.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x33 [0077.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0077.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab3e0) returned 1 [0077.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", lpFilePart=0x0) returned 0x3d [0077.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edwxz0scpwwsz5khy.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.395] GetFileType (hFile=0x2b8) returned 0x1 [0077.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.396] GetFileType (hFile=0x2b8) returned 0x1 [0077.396] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x17ba9 [0077.396] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=97183, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x17b9f [0077.396] ReadFile (in: hFile=0x2b8, lpBuffer=0x2771350, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2771350*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.396] CloseHandle (hObject=0x2b8) returned 1 [0077.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", lpFilePart=0x0) returned 0x3d [0077.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edwxz0scpwwsz5khy.ppt"), fInfoLevelId=0x0, lpFileInformation=0x27de100 | out: lpFileInformation=0x27de100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48c719c0, ftCreationTime.dwHighDateTime=0x1d5dfff, ftLastAccessTime.dwLowDateTime=0x749e1290, ftLastAccessTime.dwHighDateTime=0x1d5da6b, ftLastWriteTime.dwLowDateTime=0x749e1290, ftLastWriteTime.dwHighDateTime=0x1d5da6b, nFileSizeHigh=0x0, nFileSizeLow=0x17ba9)) returned 1 [0077.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", lpFilePart=0x0) returned 0x3d [0077.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edwxz0scpwwsz5khy.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.403] GetFileType (hFile=0x2b8) returned 0x1 [0077.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.403] GetFileType (hFile=0x2b8) returned 0x1 [0077.403] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x17ba9 [0077.404] ReadFile (in: hFile=0x2b8, lpBuffer=0x1270d290, nNumberOfBytesToRead=0x17ba9, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x1270d290*, lpNumberOfBytesRead=0x1c9aeb38*=0x17ba9, lpOverlapped=0x0) returned 1 [0077.405] CloseHandle (hObject=0x2b8) returned 1 [0077.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", lpFilePart=0x0) returned 0x3d [0077.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edwxz0scpwwsz5khy.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.444] GetFileType (hFile=0x2b8) returned 0x1 [0077.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.444] GetFileType (hFile=0x2b8) returned 0x1 [0077.444] WriteFile (in: hFile=0x2b8, lpBuffer=0x12783da0*, nNumberOfBytesToWrite=0x17bb0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12783da0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x17bb0, lpOverlapped=0x0) returned 1 [0077.446] CloseHandle (hObject=0x2b8) returned 1 [0077.446] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", lpFilePart=0x0) returned 0x3d [0077.446] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", lpFilePart=0x0) returned 0x3d [0077.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edwxz0scpwwsz5khy.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.447] GetFileType (hFile=0x2b8) returned 0x1 [0077.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.447] GetFileType (hFile=0x2b8) returned 0x1 [0077.447] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x17bb0 [0077.447] WriteFile (in: hFile=0x2b8, lpBuffer=0x2855c48*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2855c48*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.447] CloseHandle (hObject=0x2b8) returned 1 [0077.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt", lpFilePart=0x0) returned 0x3d [0077.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RURXeHowc2NQd3dTWjVLaHkucHB0", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RURXeHowc2NQd3dTWjVLaHkucHB0", lpFilePart=0x0) returned 0x44 [0077.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.447] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edwxz0scpwwsz5khy.ppt"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48c719c0, ftCreationTime.dwHighDateTime=0x1d5dfff, ftLastAccessTime.dwLowDateTime=0x749e1290, ftLastAccessTime.dwHighDateTime=0x1d5da6b, ftLastWriteTime.dwLowDateTime=0xd5e0c160, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x17bba)) returned 1 [0077.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.447] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EDWxz0scPwwSZ5Khy.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edwxz0scpwwsz5khy.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RURXeHowc2NQd3dTWjVLaHkucHB0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rurxehowc2nqd3dtwjvlahkuchb0")) returned 1 [0077.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", lpFilePart=0x0) returned 0x34 [0077.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eg fvx7.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.448] GetFileType (hFile=0x2b8) returned 0x1 [0077.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.448] GetFileType (hFile=0x2b8) returned 0x1 [0077.448] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xd460 [0077.448] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=54358, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xd456 [0077.448] ReadFile (in: hFile=0x2b8, lpBuffer=0x2857000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2857000*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.449] CloseHandle (hObject=0x2b8) returned 1 [0077.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", lpFilePart=0x0) returned 0x34 [0077.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.456] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eg fvx7.pptx"), fInfoLevelId=0x0, lpFileInformation=0x28c3eb0 | out: lpFileInformation=0x28c3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe04e80, ftCreationTime.dwHighDateTime=0x1d57f4f, ftLastAccessTime.dwLowDateTime=0x29efbc30, ftLastAccessTime.dwHighDateTime=0x1d5d6a6, ftLastWriteTime.dwLowDateTime=0x29efbc30, ftLastWriteTime.dwHighDateTime=0x1d5d6a6, nFileSizeHigh=0x0, nFileSizeLow=0xd460)) returned 1 [0077.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", lpFilePart=0x0) returned 0x34 [0077.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eg fvx7.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.457] GetFileType (hFile=0x2b8) returned 0x1 [0077.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.457] GetFileType (hFile=0x2b8) returned 0x1 [0077.457] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xd460 [0077.457] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c4128, nNumberOfBytesToRead=0xd460, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28c4128*, lpNumberOfBytesRead=0x1c9aeb38*=0xd460, lpOverlapped=0x0) returned 1 [0077.458] CloseHandle (hObject=0x2b8) returned 1 [0077.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", lpFilePart=0x0) returned 0x34 [0077.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eg fvx7.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.508] GetFileType (hFile=0x2b8) returned 0x1 [0077.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.508] GetFileType (hFile=0x2b8) returned 0x1 [0077.508] WriteFile (in: hFile=0x2b8, lpBuffer=0x279a4e8*, nNumberOfBytesToWrite=0xd470, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x279a4e8*, lpNumberOfBytesWritten=0x1c9aebc8*=0xd470, lpOverlapped=0x0) returned 1 [0077.510] CloseHandle (hObject=0x2b8) returned 1 [0077.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", lpFilePart=0x0) returned 0x34 [0077.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", lpFilePart=0x0) returned 0x34 [0077.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eg fvx7.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.511] GetFileType (hFile=0x2b8) returned 0x1 [0077.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.511] GetFileType (hFile=0x2b8) returned 0x1 [0077.511] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xd470 [0077.511] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a8838*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27a8838*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.511] CloseHandle (hObject=0x2b8) returned 1 [0077.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx", lpFilePart=0x0) returned 0x34 [0077.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZWcgRlZYNy5wcHR4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZWcgRlZYNy5wcHR4", lpFilePart=0x0) returned 0x38 [0077.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.511] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eg fvx7.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe04e80, ftCreationTime.dwHighDateTime=0x1d57f4f, ftLastAccessTime.dwLowDateTime=0x29efbc30, ftLastAccessTime.dwHighDateTime=0x1d5d6a6, ftLastWriteTime.dwLowDateTime=0xd5ea46e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd47a)) returned 1 [0077.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.511] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eg FVX7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eg fvx7.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZWcgRlZYNy5wcHR4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwcgrlzyny5wchr4")) returned 1 [0077.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", lpFilePart=0x0) returned 0x3b [0077.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gmrc2frnx1sja2.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.512] GetFileType (hFile=0x2b8) returned 0x1 [0077.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.512] GetFileType (hFile=0x2b8) returned 0x1 [0077.512] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xe697 [0077.512] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=59021, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xe68d [0077.512] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a9bc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27a9bc0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.513] CloseHandle (hObject=0x2b8) returned 1 [0077.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", lpFilePart=0x0) returned 0x3b [0077.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gmrc2frnx1sja2.pptx"), fInfoLevelId=0x0, lpFileInformation=0x28169b0 | out: lpFileInformation=0x28169b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb916d1a0, ftCreationTime.dwHighDateTime=0x1d55e51, ftLastAccessTime.dwLowDateTime=0x4bd174c0, ftLastAccessTime.dwHighDateTime=0x1d5a581, ftLastWriteTime.dwLowDateTime=0x4bd174c0, ftLastWriteTime.dwHighDateTime=0x1d5a581, nFileSizeHigh=0x0, nFileSizeLow=0xe697)) returned 1 [0077.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", lpFilePart=0x0) returned 0x3b [0077.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gmrc2frnx1sja2.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.516] GetFileType (hFile=0x2b8) returned 0x1 [0077.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.516] GetFileType (hFile=0x2b8) returned 0x1 [0077.516] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xe697 [0077.516] ReadFile (in: hFile=0x2b8, lpBuffer=0x2816c48, nNumberOfBytesToRead=0xe697, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2816c48*, lpNumberOfBytesRead=0x1c9aeb38*=0xe697, lpOverlapped=0x0) returned 1 [0077.517] CloseHandle (hObject=0x2b8) returned 1 [0077.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", lpFilePart=0x0) returned 0x3b [0077.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gmrc2frnx1sja2.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.530] GetFileType (hFile=0x2b8) returned 0x1 [0077.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.531] GetFileType (hFile=0x2b8) returned 0x1 [0077.531] WriteFile (in: hFile=0x2b8, lpBuffer=0x28b8c20*, nNumberOfBytesToWrite=0xe6a0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x28b8c20*, lpNumberOfBytesWritten=0x1c9aebc8*=0xe6a0, lpOverlapped=0x0) returned 1 [0077.532] CloseHandle (hObject=0x2b8) returned 1 [0077.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", lpFilePart=0x0) returned 0x3b [0077.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", lpFilePart=0x0) returned 0x3b [0077.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gmrc2frnx1sja2.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.533] GetFileType (hFile=0x2b8) returned 0x1 [0077.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.533] GetFileType (hFile=0x2b8) returned 0x1 [0077.533] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xe6a0 [0077.533] WriteFile (in: hFile=0x2b8, lpBuffer=0x28c81f8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28c81f8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.533] CloseHandle (hObject=0x2b8) returned 1 [0077.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx", lpFilePart=0x0) returned 0x3b [0077.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z01yQzJGcm54MXNqYTIucHB0eA==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z01yQzJGcm54MXNqYTIucHB0eA==", lpFilePart=0x0) returned 0x44 [0077.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.533] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gmrc2frnx1sja2.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb916d1a0, ftCreationTime.dwHighDateTime=0x1d55e51, ftLastAccessTime.dwLowDateTime=0x4bd174c0, ftLastAccessTime.dwHighDateTime=0x1d5a581, ftLastWriteTime.dwLowDateTime=0xd5ef09a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe6aa)) returned 1 [0077.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.533] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gMrC2Frnx1sja2.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gmrc2frnx1sja2.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z01yQzJGcm54MXNqYTIucHB0eA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z01yqzjgcm54mxnqytiuchb0ea==")) returned 1 [0077.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", lpFilePart=0x0) returned 0x41 [0077.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixtewgjcolz3njyyp5f1.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.534] GetFileType (hFile=0x2b8) returned 0x1 [0077.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.534] GetFileType (hFile=0x2b8) returned 0x1 [0077.534] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x17fc4 [0077.535] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=98234, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x17fba [0077.535] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c95d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28c95d8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.535] CloseHandle (hObject=0x2b8) returned 1 [0077.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", lpFilePart=0x0) returned 0x41 [0077.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixtewgjcolz3njyyp5f1.docx"), fInfoLevelId=0x0, lpFileInformation=0x2760ed0 | out: lpFileInformation=0x2760ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fcdbbe0, ftCreationTime.dwHighDateTime=0x1d5ac27, ftLastAccessTime.dwLowDateTime=0x47ca2b20, ftLastAccessTime.dwHighDateTime=0x1d5a4c2, ftLastWriteTime.dwLowDateTime=0x47ca2b20, ftLastWriteTime.dwHighDateTime=0x1d5a4c2, nFileSizeHigh=0x0, nFileSizeLow=0x17fc4)) returned 1 [0077.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", lpFilePart=0x0) returned 0x41 [0077.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixtewgjcolz3njyyp5f1.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.548] GetFileType (hFile=0x2b8) returned 0x1 [0077.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.548] GetFileType (hFile=0x2b8) returned 0x1 [0077.549] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x17fc4 [0077.549] ReadFile (in: hFile=0x2b8, lpBuffer=0x127d2fd8, nNumberOfBytesToRead=0x17fc4, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x127d2fd8*, lpNumberOfBytesRead=0x1c9aeb38*=0x17fc4, lpOverlapped=0x0) returned 1 [0077.550] CloseHandle (hObject=0x2b8) returned 1 [0077.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", lpFilePart=0x0) returned 0x41 [0077.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixtewgjcolz3njyyp5f1.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.596] GetFileType (hFile=0x2b8) returned 0x1 [0077.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.596] GetFileType (hFile=0x2b8) returned 0x1 [0077.596] WriteFile (in: hFile=0x2b8, lpBuffer=0x1284af80*, nNumberOfBytesToWrite=0x17fd0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x1284af80*, lpNumberOfBytesWritten=0x1c9aebc8*=0x17fd0, lpOverlapped=0x0) returned 1 [0077.598] CloseHandle (hObject=0x2b8) returned 1 [0077.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", lpFilePart=0x0) returned 0x41 [0077.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", lpFilePart=0x0) returned 0x41 [0077.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixtewgjcolz3njyyp5f1.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.598] GetFileType (hFile=0x2b8) returned 0x1 [0077.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.598] GetFileType (hFile=0x2b8) returned 0x1 [0077.598] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x17fd0 [0077.598] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d8f20*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27d8f20*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.598] CloseHandle (hObject=0x2b8) returned 1 [0077.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx", lpFilePart=0x0) returned 0x41 [0077.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SXh0RVdnSmNvTFozTkpZWVA1RjEuZG9jeA==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SXh0RVdnSmNvTFozTkpZWVA1RjEuZG9jeA==", lpFilePart=0x0) returned 0x4c [0077.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixtewgjcolz3njyyp5f1.docx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fcdbbe0, ftCreationTime.dwHighDateTime=0x1d5ac27, ftLastAccessTime.dwLowDateTime=0x47ca2b20, ftLastAccessTime.dwHighDateTime=0x1d5a4c2, ftLastWriteTime.dwLowDateTime=0xd5f88f20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x17fda)) returned 1 [0077.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.599] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IxtEWgJcoLZ3NJYYP5F1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ixtewgjcolz3njyyp5f1.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SXh0RVdnSmNvTFozTkpZWVA1RjEuZG9jeA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sxh0rvdnsmnvtfoztkpzwva1rjeuzg9jea==")) returned 1 [0077.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", lpFilePart=0x0) returned 0x3d [0077.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jc0hzl-ehl9dfp56.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.600] GetFileType (hFile=0x2b8) returned 0x1 [0077.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.600] GetFileType (hFile=0x2b8) returned 0x1 [0077.600] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xddd4 [0077.600] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=56778, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xddca [0077.600] ReadFile (in: hFile=0x2b8, lpBuffer=0x27da320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27da320*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.601] CloseHandle (hObject=0x2b8) returned 1 [0077.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", lpFilePart=0x0) returned 0x3d [0077.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.606] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jc0hzl-ehl9dfp56.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2847090 | out: lpFileInformation=0x2847090*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cb1ae0, ftCreationTime.dwHighDateTime=0x1d5bc21, ftLastAccessTime.dwLowDateTime=0xd1dd46a0, ftLastAccessTime.dwHighDateTime=0x1d588dc, ftLastWriteTime.dwLowDateTime=0xd1dd46a0, ftLastWriteTime.dwHighDateTime=0x1d588dc, nFileSizeHigh=0x0, nFileSizeLow=0xddd4)) returned 1 [0077.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", lpFilePart=0x0) returned 0x3d [0077.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jc0hzl-ehl9dfp56.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.607] GetFileType (hFile=0x2b8) returned 0x1 [0077.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.607] GetFileType (hFile=0x2b8) returned 0x1 [0077.607] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xddd4 [0077.607] ReadFile (in: hFile=0x2b8, lpBuffer=0x2847348, nNumberOfBytesToRead=0xddd4, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2847348*, lpNumberOfBytesRead=0x1c9aeb38*=0xddd4, lpOverlapped=0x0) returned 1 [0077.607] CloseHandle (hObject=0x2b8) returned 1 [0077.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", lpFilePart=0x0) returned 0x3d [0077.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jc0hzl-ehl9dfp56.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.620] GetFileType (hFile=0x2b8) returned 0x1 [0077.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.620] GetFileType (hFile=0x2b8) returned 0x1 [0077.620] WriteFile (in: hFile=0x2b8, lpBuffer=0x28e7648*, nNumberOfBytesToWrite=0xdde0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x28e7648*, lpNumberOfBytesWritten=0x1c9aebc8*=0xdde0, lpOverlapped=0x0) returned 1 [0077.622] CloseHandle (hObject=0x2b8) returned 1 [0077.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", lpFilePart=0x0) returned 0x3d [0077.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", lpFilePart=0x0) returned 0x3d [0077.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jc0hzl-ehl9dfp56.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.622] GetFileType (hFile=0x2b8) returned 0x1 [0077.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.622] GetFileType (hFile=0x2b8) returned 0x1 [0077.622] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xdde0 [0077.622] WriteFile (in: hFile=0x2b8, lpBuffer=0x28f6398*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28f6398*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.622] CloseHandle (hObject=0x2b8) returned 1 [0077.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx", lpFilePart=0x0) returned 0x3d [0077.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SmMwaHpMLUVIbDlEZnA1Ni54bHN4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SmMwaHpMLUVIbDlEZnA1Ni54bHN4", lpFilePart=0x0) returned 0x44 [0077.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.623] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jc0hzl-ehl9dfp56.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cb1ae0, ftCreationTime.dwHighDateTime=0x1d5bc21, ftLastAccessTime.dwLowDateTime=0xd1dd46a0, ftLastAccessTime.dwHighDateTime=0x1d588dc, ftLastWriteTime.dwLowDateTime=0xd5faf080, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xddea)) returned 1 [0077.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.623] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jc0hzL-EHl9Dfp56.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jc0hzl-ehl9dfp56.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SmMwaHpMLUVIbDlEZnA1Ni54bHN4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\smmwahpmluvibdlezna1ni54bhn4")) returned 1 [0077.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", lpFilePart=0x0) returned 0x36 [0077.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kta9xot0e.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.653] GetFileType (hFile=0x2b8) returned 0x1 [0077.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.653] GetFileType (hFile=0x2b8) returned 0x1 [0077.653] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x14baa [0077.653] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=84896, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x14ba0 [0077.653] ReadFile (in: hFile=0x2b8, lpBuffer=0x28f7750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28f7750*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.654] CloseHandle (hObject=0x2b8) returned 1 [0077.654] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", lpFilePart=0x0) returned 0x36 [0077.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.666] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kta9xot0e.pptx"), fInfoLevelId=0x0, lpFileInformation=0x278f1d0 | out: lpFileInformation=0x278f1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7002b00, ftCreationTime.dwHighDateTime=0x1d58161, ftLastAccessTime.dwLowDateTime=0xd8208e00, ftLastAccessTime.dwHighDateTime=0x1d5c94b, ftLastWriteTime.dwLowDateTime=0xd8208e00, ftLastWriteTime.dwHighDateTime=0x1d5c94b, nFileSizeHigh=0x0, nFileSizeLow=0x14baa)) returned 1 [0077.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", lpFilePart=0x0) returned 0x36 [0077.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kta9xot0e.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.667] GetFileType (hFile=0x2b8) returned 0x1 [0077.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.667] GetFileType (hFile=0x2b8) returned 0x1 [0077.667] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x14baa [0077.667] ReadFile (in: hFile=0x2b8, lpBuffer=0x278f448, nNumberOfBytesToRead=0x14baa, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x278f448*, lpNumberOfBytesRead=0x1c9aeb38*=0x14baa, lpOverlapped=0x0) returned 1 [0077.667] CloseHandle (hObject=0x2b8) returned 1 [0077.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", lpFilePart=0x0) returned 0x36 [0077.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kta9xot0e.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.711] GetFileType (hFile=0x2b8) returned 0x1 [0077.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.711] GetFileType (hFile=0x2b8) returned 0x1 [0077.711] WriteFile (in: hFile=0x2b8, lpBuffer=0x2844548*, nNumberOfBytesToWrite=0x14bb0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2844548*, lpNumberOfBytesWritten=0x1c9aebc8*=0x14bb0, lpOverlapped=0x0) returned 1 [0077.713] CloseHandle (hObject=0x2b8) returned 1 [0077.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", lpFilePart=0x0) returned 0x36 [0077.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", lpFilePart=0x0) returned 0x36 [0077.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kta9xot0e.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.713] GetFileType (hFile=0x2b8) returned 0x1 [0077.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.713] GetFileType (hFile=0x2b8) returned 0x1 [0077.713] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x14bb0 [0077.713] WriteFile (in: hFile=0x2b8, lpBuffer=0x2859fe0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2859fe0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.713] CloseHandle (hObject=0x2b8) returned 1 [0077.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx", lpFilePart=0x0) returned 0x36 [0077.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\a1RBOVhvVDBFLnBwdHg=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\a1RBOVhvVDBFLnBwdHg=", lpFilePart=0x0) returned 0x3c [0077.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kta9xot0e.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7002b00, ftCreationTime.dwHighDateTime=0x1d58161, ftLastAccessTime.dwLowDateTime=0xd8208e00, ftLastAccessTime.dwHighDateTime=0x1d5c94b, ftLastWriteTime.dwLowDateTime=0xd60938c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x14bba)) returned 1 [0077.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.714] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kTA9XoT0E.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kta9xot0e.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\a1RBOVhvVDBFLnBwdHg=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a1rbovhvvdbflnbwdhg=")) returned 1 [0077.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", lpFilePart=0x0) returned 0x3a [0077.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lpbxt40meeayb.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.715] GetFileType (hFile=0x2b8) returned 0x1 [0077.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.715] GetFileType (hFile=0x2b8) returned 0x1 [0077.715] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x3826 [0077.715] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=14364, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x381c [0077.715] ReadFile (in: hFile=0x2b8, lpBuffer=0x285b378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x285b378*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.715] CloseHandle (hObject=0x2b8) returned 1 [0077.716] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", lpFilePart=0x0) returned 0x3a [0077.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lpbxt40meeayb.docx"), fInfoLevelId=0x0, lpFileInformation=0x28c8128 | out: lpFileInformation=0x28c8128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1a2bd0, ftCreationTime.dwHighDateTime=0x1d5b5fe, ftLastAccessTime.dwLowDateTime=0xa8828ac0, ftLastAccessTime.dwHighDateTime=0x1d59018, ftLastWriteTime.dwLowDateTime=0xa8828ac0, ftLastWriteTime.dwHighDateTime=0x1d59018, nFileSizeHigh=0x0, nFileSizeLow=0x3826)) returned 1 [0077.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", lpFilePart=0x0) returned 0x3a [0077.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lpbxt40meeayb.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.722] GetFileType (hFile=0x2b8) returned 0x1 [0077.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.722] GetFileType (hFile=0x2b8) returned 0x1 [0077.722] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x3826 [0077.722] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c83c0, nNumberOfBytesToRead=0x3826, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28c83c0*, lpNumberOfBytesRead=0x1c9aeb38*=0x3826, lpOverlapped=0x0) returned 1 [0077.722] CloseHandle (hObject=0x2b8) returned 1 [0077.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", lpFilePart=0x0) returned 0x3a [0077.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lpbxt40meeayb.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.734] GetFileType (hFile=0x2b8) returned 0x1 [0077.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.735] GetFileType (hFile=0x2b8) returned 0x1 [0077.735] WriteFile (in: hFile=0x2b8, lpBuffer=0x2950608*, nNumberOfBytesToWrite=0x3830, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2950608*, lpNumberOfBytesWritten=0x1c9aebc8*=0x3830, lpOverlapped=0x0) returned 1 [0077.736] CloseHandle (hObject=0x2b8) returned 1 [0077.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", lpFilePart=0x0) returned 0x3a [0077.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", lpFilePart=0x0) returned 0x3a [0077.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lpbxt40meeayb.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.736] GetFileType (hFile=0x2b8) returned 0x1 [0077.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.736] GetFileType (hFile=0x2b8) returned 0x1 [0077.736] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x3830 [0077.736] WriteFile (in: hFile=0x2b8, lpBuffer=0x2954d68*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2954d68*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.736] CloseHandle (hObject=0x2b8) returned 1 [0077.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx", lpFilePart=0x0) returned 0x3a [0077.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bFBCWHQ0MG1FZWFZYi5kb2N4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bFBCWHQ0MG1FZWFZYi5kb2N4", lpFilePart=0x0) returned 0x40 [0077.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.737] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lpbxt40meeayb.docx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1a2bd0, ftCreationTime.dwHighDateTime=0x1d5b5fe, ftLastAccessTime.dwLowDateTime=0xa8828ac0, ftLastAccessTime.dwHighDateTime=0x1d59018, ftLastWriteTime.dwLowDateTime=0xd60dfb80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x383a)) returned 1 [0077.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.737] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPBXt40mEeaYb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lpbxt40meeayb.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bFBCWHQ0MG1FZWFZYi5kb2N4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\bfbcwhq0mg1fzwfzyi5kb2n4")) returned 1 [0077.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", lpFilePart=0x0) returned 0x3a [0077.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\m_jazgkj2khlz.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.737] GetFileType (hFile=0x2b8) returned 0x1 [0077.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.738] GetFileType (hFile=0x2b8) returned 0x1 [0077.738] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x18cc9 [0077.738] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=101567, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x18cbf [0077.738] ReadFile (in: hFile=0x2b8, lpBuffer=0x2956118, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2956118*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.738] CloseHandle (hObject=0x2b8) returned 1 [0077.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", lpFilePart=0x0) returned 0x3a [0077.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\m_jazgkj2khlz.docx"), fInfoLevelId=0x0, lpFileInformation=0x2755710 | out: lpFileInformation=0x2755710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5db70, ftCreationTime.dwHighDateTime=0x1d5df8b, ftLastAccessTime.dwLowDateTime=0x3adf2bb0, ftLastAccessTime.dwHighDateTime=0x1d5c4fa, ftLastWriteTime.dwLowDateTime=0x3adf2bb0, ftLastWriteTime.dwHighDateTime=0x1d5c4fa, nFileSizeHigh=0x0, nFileSizeLow=0x18cc9)) returned 1 [0077.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", lpFilePart=0x0) returned 0x3a [0077.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\m_jazgkj2khlz.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.762] GetFileType (hFile=0x2b8) returned 0x1 [0077.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.762] GetFileType (hFile=0x2b8) returned 0x1 [0077.762] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x18cc9 [0077.763] ReadFile (in: hFile=0x2b8, lpBuffer=0x128a82d8, nNumberOfBytesToRead=0x18cc9, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x128a82d8*, lpNumberOfBytesRead=0x1c9aeb38*=0x18cc9, lpOverlapped=0x0) returned 1 [0077.764] CloseHandle (hObject=0x2b8) returned 1 [0077.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", lpFilePart=0x0) returned 0x3a [0077.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\m_jazgkj2khlz.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.810] GetFileType (hFile=0x2b8) returned 0x1 [0077.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.810] GetFileType (hFile=0x2b8) returned 0x1 [0077.810] WriteFile (in: hFile=0x2b8, lpBuffer=0x12924388*, nNumberOfBytesToWrite=0x18cd0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x12924388*, lpNumberOfBytesWritten=0x1c9aebc8*=0x18cd0, lpOverlapped=0x0) returned 1 [0077.812] CloseHandle (hObject=0x2b8) returned 1 [0077.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", lpFilePart=0x0) returned 0x3a [0077.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", lpFilePart=0x0) returned 0x3a [0077.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\m_jazgkj2khlz.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.812] GetFileType (hFile=0x2b8) returned 0x1 [0077.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.812] GetFileType (hFile=0x2b8) returned 0x1 [0077.812] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x18cd0 [0077.813] WriteFile (in: hFile=0x2b8, lpBuffer=0x27cd490*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27cd490*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.813] CloseHandle (hObject=0x2b8) returned 1 [0077.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx", lpFilePart=0x0) returned 0x3a [0077.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TV9qYXpHS0oya0hsei5kb2N4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TV9qYXpHS0oya0hsei5kb2N4", lpFilePart=0x0) returned 0x40 [0077.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.813] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\m_jazgkj2khlz.docx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5db70, ftCreationTime.dwHighDateTime=0x1d5df8b, ftLastAccessTime.dwLowDateTime=0x3adf2bb0, ftLastAccessTime.dwHighDateTime=0x1d5c4fa, ftLastWriteTime.dwLowDateTime=0xd619e260, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x18cda)) returned 1 [0077.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.813] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\M_jazGKJ2kHlz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\m_jazgkj2khlz.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TV9qYXpHS0oya0hsei5kb2N4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tv9qyxphs0oya0hsei5kb2n4")) returned 1 [0077.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", lpFilePart=0x0) returned 0x3c [0077.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nesswcu11l6wuh3.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.814] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xb7b8 [0077.814] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=47022, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xb7ae [0077.814] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ce850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27ce850*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", lpFilePart=0x0) returned 0x3c [0077.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nesswcu11l6wuh3.pptx"), fInfoLevelId=0x0, lpFileInformation=0x283b600 | out: lpFileInformation=0x283b600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc09680, ftCreationTime.dwHighDateTime=0x1d5cb34, ftLastAccessTime.dwLowDateTime=0x8e0d0a60, ftLastAccessTime.dwHighDateTime=0x1d56315, ftLastWriteTime.dwLowDateTime=0x8e0d0a60, ftLastWriteTime.dwHighDateTime=0x1d56315, nFileSizeHigh=0x0, nFileSizeLow=0xb7b8)) returned 1 [0077.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", lpFilePart=0x0) returned 0x3c [0077.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nesswcu11l6wuh3.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.817] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xb7b8 [0077.817] ReadFile (in: hFile=0x2b8, lpBuffer=0x283b8b8, nNumberOfBytesToRead=0xb7b8, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x283b8b8*, lpNumberOfBytesRead=0x1c9aeb38*=0xb7b8, lpOverlapped=0x0) returned 1 [0077.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", lpFilePart=0x0) returned 0x3c [0077.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nesswcu11l6wuh3.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", lpFilePart=0x0) returned 0x3c [0077.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", lpFilePart=0x0) returned 0x3c [0077.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nesswcu11l6wuh3.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.834] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xb7c0 [0077.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx", lpFilePart=0x0) returned 0x3c [0077.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TmVzc1dDdTExTDZXVWgzLnBwdHg=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TmVzc1dDdTExTDZXVWgzLnBwdHg=", lpFilePart=0x0) returned 0x44 [0077.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.835] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nesswcu11l6wuh3.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc09680, ftCreationTime.dwHighDateTime=0x1d5cb34, ftLastAccessTime.dwLowDateTime=0x8e0d0a60, ftLastAccessTime.dwHighDateTime=0x1d56315, ftLastWriteTime.dwLowDateTime=0xd61c43c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xb7ca)) returned 1 [0077.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.835] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NessWCu11L6WUh3.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nesswcu11l6wuh3.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TmVzc1dDdTExTDZXVWgzLnBwdHg=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tmvzc1dddtextdzxvwgzlnbwdhg=")) returned 1 [0077.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", lpFilePart=0x0) returned 0x36 [0077.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nthtwicvy.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.836] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x14762 [0077.836] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=83800, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x14758 [0077.836] ReadFile (in: hFile=0x2b8, lpBuffer=0x28e2438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28e2438*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", lpFilePart=0x0) returned 0x36 [0077.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.852] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nthtwicvy.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x277eb98 | out: lpFileInformation=0x277eb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe6091e0, ftCreationTime.dwHighDateTime=0x1d5c801, ftLastAccessTime.dwLowDateTime=0xab81ded0, ftLastAccessTime.dwHighDateTime=0x1d56eec, ftLastWriteTime.dwLowDateTime=0xab81ded0, ftLastWriteTime.dwHighDateTime=0x1d56eec, nFileSizeHigh=0x0, nFileSizeLow=0x14762)) returned 1 [0077.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", lpFilePart=0x0) returned 0x36 [0077.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nthtwicvy.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.852] GetFileType (hFile=0x2b8) returned 0x1 [0077.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.852] GetFileType (hFile=0x2b8) returned 0x1 [0077.852] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x14762 [0077.852] ReadFile (in: hFile=0x2b8, lpBuffer=0x277ee10, nNumberOfBytesToRead=0x14762, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x277ee10*, lpNumberOfBytesRead=0x1c9aeb38*=0x14762, lpOverlapped=0x0) returned 1 [0077.853] CloseHandle (hObject=0x2b8) returned 1 [0077.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", lpFilePart=0x0) returned 0x36 [0077.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nthtwicvy.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.899] GetFileType (hFile=0x2b8) returned 0x1 [0077.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.899] GetFileType (hFile=0x2b8) returned 0x1 [0077.899] WriteFile (in: hFile=0x2b8, lpBuffer=0x2833250*, nNumberOfBytesToWrite=0x14770, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2833250*, lpNumberOfBytesWritten=0x1c9aebc8*=0x14770, lpOverlapped=0x0) returned 1 [0077.902] CloseHandle (hObject=0x2b8) returned 1 [0077.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", lpFilePart=0x0) returned 0x36 [0077.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", lpFilePart=0x0) returned 0x36 [0077.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nthtwicvy.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.902] GetFileType (hFile=0x2b8) returned 0x1 [0077.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.902] GetFileType (hFile=0x2b8) returned 0x1 [0077.902] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x14770 [0077.902] WriteFile (in: hFile=0x2b8, lpBuffer=0x28488a8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28488a8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.903] CloseHandle (hObject=0x2b8) returned 1 [0077.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx", lpFilePart=0x0) returned 0x36 [0077.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blRIVHdpY1ZZLnhsc3g=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blRIVHdpY1ZZLnhsc3g=", lpFilePart=0x0) returned 0x3c [0077.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nthtwicvy.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe6091e0, ftCreationTime.dwHighDateTime=0x1d5c801, ftLastAccessTime.dwLowDateTime=0xab81ded0, ftLastAccessTime.dwHighDateTime=0x1d56eec, ftLastWriteTime.dwLowDateTime=0xd625c940, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1477a)) returned 1 [0077.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.903] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nTHTwicVY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nthtwicvy.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blRIVHdpY1ZZLnhsc3g=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\blrivhdpy1zzlnhsc3g=")) returned 1 [0077.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", lpFilePart=0x0) returned 0x40 [0077.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oaid4glsrur8xznelgk.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.904] GetFileType (hFile=0x2b8) returned 0x1 [0077.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.904] GetFileType (hFile=0x2b8) returned 0x1 [0077.904] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x5a8f [0077.904] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=23173, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x5a85 [0077.904] ReadFile (in: hFile=0x2b8, lpBuffer=0x2849c60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2849c60*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.905] CloseHandle (hObject=0x2b8) returned 1 [0077.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", lpFilePart=0x0) returned 0x40 [0077.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oaid4glsrur8xznelgk.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x28b69d0 | out: lpFileInformation=0x28b69d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78315bc0, ftCreationTime.dwHighDateTime=0x1d593fc, ftLastAccessTime.dwLowDateTime=0x1509c040, ftLastAccessTime.dwHighDateTime=0x1d5654f, ftLastWriteTime.dwLowDateTime=0x1509c040, ftLastWriteTime.dwHighDateTime=0x1d5654f, nFileSizeHigh=0x0, nFileSizeLow=0x5a8f)) returned 1 [0077.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", lpFilePart=0x0) returned 0x40 [0077.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oaid4glsrur8xznelgk.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.911] GetFileType (hFile=0x2b8) returned 0x1 [0077.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.912] GetFileType (hFile=0x2b8) returned 0x1 [0077.912] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x5a8f [0077.912] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b6ca8, nNumberOfBytesToRead=0x5a8f, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28b6ca8*, lpNumberOfBytesRead=0x1c9aeb38*=0x5a8f, lpOverlapped=0x0) returned 1 [0077.912] CloseHandle (hObject=0x2b8) returned 1 [0077.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", lpFilePart=0x0) returned 0x40 [0077.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0077.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oaid4glsrur8xznelgk.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.955] GetFileType (hFile=0x2b8) returned 0x1 [0077.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0077.955] GetFileType (hFile=0x2b8) returned 0x1 [0077.955] WriteFile (in: hFile=0x2b8, lpBuffer=0x26c2fb0*, nNumberOfBytesToWrite=0x5a90, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x26c2fb0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x5a90, lpOverlapped=0x0) returned 1 [0077.956] CloseHandle (hObject=0x2b8) returned 1 [0077.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", lpFilePart=0x0) returned 0x40 [0077.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", lpFilePart=0x0) returned 0x40 [0077.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0077.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oaid4glsrur8xznelgk.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.957] GetFileType (hFile=0x2b8) returned 0x1 [0077.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0077.957] GetFileType (hFile=0x2b8) returned 0x1 [0077.957] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x5a90 [0077.957] WriteFile (in: hFile=0x2b8, lpBuffer=0x26c99f0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26c99f0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0077.958] CloseHandle (hObject=0x2b8) returned 1 [0077.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx", lpFilePart=0x0) returned 0x40 [0077.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\T0FJRDRHbHNyVXI4eHpuRUxHSy54bHN4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\T0FJRDRHbHNyVXI4eHpuRUxHSy54bHN4", lpFilePart=0x0) returned 0x48 [0077.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0077.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oaid4glsrur8xznelgk.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78315bc0, ftCreationTime.dwHighDateTime=0x1d593fc, ftLastAccessTime.dwLowDateTime=0x1509c040, ftLastAccessTime.dwHighDateTime=0x1d5654f, ftLastWriteTime.dwLowDateTime=0xd62f4ec0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x5a9a)) returned 1 [0077.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0077.958] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OAID4GlsrUr8xznELGK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oaid4glsrur8xznelgk.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\T0FJRDRHbHNyVXI4eHpuRUxHSy54bHN4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\t0fjrdrhbhnyvxi4ehpuruxhsy54bhn4")) returned 1 [0077.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", lpFilePart=0x0) returned 0x36 [0077.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0077.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\og2dbqt8x.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.959] GetFileType (hFile=0x2b8) returned 0x1 [0077.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0077.959] GetFileType (hFile=0x2b8) returned 0x1 [0077.959] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x11d41 [0077.959] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=73015, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x11d37 [0077.959] ReadFile (in: hFile=0x2b8, lpBuffer=0x26cadc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x26cadc0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0077.960] CloseHandle (hObject=0x2b8) returned 1 [0077.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11cd8) returned 0x0 [0077.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", lpFilePart=0x0) returned 0x36 [0077.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0077.967] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\og2dbqt8x.docx"), fInfoLevelId=0x0, lpFileInformation=0x2737bf0 | out: lpFileInformation=0x2737bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6494fee0, ftCreationTime.dwHighDateTime=0x1d5dff7, ftLastAccessTime.dwLowDateTime=0xfc0a7c60, ftLastAccessTime.dwHighDateTime=0x1d56512, ftLastWriteTime.dwLowDateTime=0xfc0a7c60, ftLastWriteTime.dwHighDateTime=0x1d56512, nFileSizeHigh=0x0, nFileSizeLow=0x11d41)) returned 1 [0077.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0077.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", lpFilePart=0x0) returned 0x36 [0077.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0077.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\og2dbqt8x.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0077.967] GetFileType (hFile=0x2b8) returned 0x1 [0077.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0077.967] GetFileType (hFile=0x2b8) returned 0x1 [0077.967] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x11d41 [0077.968] ReadFile (in: hFile=0x2b8, lpBuffer=0x2737e68, nNumberOfBytesToRead=0x11d41, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2737e68*, lpNumberOfBytesRead=0x1c9aeb38*=0x11d41, lpOverlapped=0x0) returned 1 [0077.968] CloseHandle (hObject=0x2b8) returned 1 [0078.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", lpFilePart=0x0) returned 0x36 [0078.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0078.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\og2dbqt8x.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.004] GetFileType (hFile=0x2b8) returned 0x1 [0078.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0078.004] GetFileType (hFile=0x2b8) returned 0x1 [0078.004] WriteFile (in: hFile=0x2b8, lpBuffer=0x27e4250*, nNumberOfBytesToWrite=0x11d50, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27e4250*, lpNumberOfBytesWritten=0x1c9aebc8*=0x11d50, lpOverlapped=0x0) returned 1 [0078.007] CloseHandle (hObject=0x2b8) returned 1 [0078.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", lpFilePart=0x0) returned 0x36 [0078.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", lpFilePart=0x0) returned 0x36 [0078.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0078.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\og2dbqt8x.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.007] GetFileType (hFile=0x2b8) returned 0x1 [0078.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0078.007] GetFileType (hFile=0x2b8) returned 0x1 [0078.007] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x11d50 [0078.007] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f6e88*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27f6e88*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0078.007] CloseHandle (hObject=0x2b8) returned 1 [0078.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx", lpFilePart=0x0) returned 0x36 [0078.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b0cyZEJxdDhYLmRvY3g=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b0cyZEJxdDhYLmRvY3g=", lpFilePart=0x0) returned 0x3c [0078.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0078.008] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\og2dbqt8x.docx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6494fee0, ftCreationTime.dwHighDateTime=0x1d5dff7, ftLastAccessTime.dwLowDateTime=0xfc0a7c60, ftLastAccessTime.dwHighDateTime=0x1d56512, ftLastWriteTime.dwLowDateTime=0xd63672e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x11d5a)) returned 1 [0078.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0078.008] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oG2dBqt8X.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\og2dbqt8x.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b0cyZEJxdDhYLmRvY3g=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\b0cyzejxddhylmrvy3g=")) returned 1 [0078.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", lpFilePart=0x0) returned 0x37 [0078.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0078.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x6gmsshohr.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.009] GetFileType (hFile=0x2b8) returned 0x1 [0078.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0078.009] GetFileType (hFile=0x2b8) returned 0x1 [0078.009] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x15918 [0078.009] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=88334, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1590e [0078.009] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f8210, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27f8210*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0078.010] CloseHandle (hObject=0x2b8) returned 1 [0078.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11c38) returned 0x0 [0078.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", lpFilePart=0x0) returned 0x37 [0078.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0078.011] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x6gmsshohr.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2864e60 | out: lpFileInformation=0x2864e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24cf830, ftCreationTime.dwHighDateTime=0x1d5bbae, ftLastAccessTime.dwLowDateTime=0x406a4f20, ftLastAccessTime.dwHighDateTime=0x1d5b824, ftLastWriteTime.dwLowDateTime=0x406a4f20, ftLastWriteTime.dwHighDateTime=0x1d5b824, nFileSizeHigh=0x0, nFileSizeLow=0x15918)) returned 1 [0078.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0078.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", lpFilePart=0x0) returned 0x37 [0078.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x6gmsshohr.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.012] GetFileType (hFile=0x2b8) returned 0x1 [0078.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0078.012] GetFileType (hFile=0x2b8) returned 0x1 [0078.012] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x15918 [0078.012] ReadFile (in: hFile=0x2b8, lpBuffer=0x12685420, nNumberOfBytesToRead=0x15918, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12685420*, lpNumberOfBytesRead=0x1c9aeb38*=0x15918, lpOverlapped=0x0) returned 1 [0078.014] CloseHandle (hObject=0x2b8) returned 1 [0078.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", lpFilePart=0x0) returned 0x37 [0078.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0078.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x6gmsshohr.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.070] GetFileType (hFile=0x2b8) returned 0x1 [0078.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0078.070] GetFileType (hFile=0x2b8) returned 0x1 [0078.070] WriteFile (in: hFile=0x2b8, lpBuffer=0x126f1258*, nNumberOfBytesToWrite=0x15920, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x126f1258*, lpNumberOfBytesWritten=0x1c9aebc8*=0x15920, lpOverlapped=0x0) returned 1 [0078.072] CloseHandle (hObject=0x2b8) returned 1 [0078.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", lpFilePart=0x0) returned 0x37 [0078.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", lpFilePart=0x0) returned 0x37 [0078.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0078.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x6gmsshohr.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.073] GetFileType (hFile=0x2b8) returned 0x1 [0078.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0078.073] GetFileType (hFile=0x2b8) returned 0x1 [0078.073] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x15920 [0078.073] WriteFile (in: hFile=0x2b8, lpBuffer=0x2712410*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2712410*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0078.073] CloseHandle (hObject=0x2b8) returned 1 [0078.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx", lpFilePart=0x0) returned 0x37 [0078.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WDZnTVNzSE9IUi54bHN4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WDZnTVNzSE9IUi54bHN4", lpFilePart=0x0) returned 0x3c [0078.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0078.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x6gmsshohr.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24cf830, ftCreationTime.dwHighDateTime=0x1d5bbae, ftLastAccessTime.dwLowDateTime=0x406a4f20, ftLastAccessTime.dwHighDateTime=0x1d5b824, ftLastWriteTime.dwLowDateTime=0xd63ff860, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1592a)) returned 1 [0078.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0078.073] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X6gMSsHOHR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x6gmsshohr.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WDZnTVNzSE9IUi54bHN4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wdzntvnzse9iui54bhn4")) returned 1 [0078.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", lpFilePart=0x0) returned 0x33 [0078.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0078.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y3pqif.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.074] GetFileType (hFile=0x2b8) returned 0x1 [0078.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0078.074] GetFileType (hFile=0x2b8) returned 0x1 [0078.074] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xcca4 [0078.074] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=52378, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xcc9a [0078.074] ReadFile (in: hFile=0x2b8, lpBuffer=0x2713788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2713788*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0078.075] CloseHandle (hObject=0x2b8) returned 1 [0078.075] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11c38) returned 0x0 [0078.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", lpFilePart=0x0) returned 0x33 [0078.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0078.084] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y3pqif.pptx"), fInfoLevelId=0x0, lpFileInformation=0x27805d0 | out: lpFileInformation=0x27805d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9342d5b0, ftCreationTime.dwHighDateTime=0x1d5b0f3, ftLastAccessTime.dwLowDateTime=0x9aab9b20, ftLastAccessTime.dwHighDateTime=0x1d56495, ftLastWriteTime.dwLowDateTime=0x9aab9b20, ftLastWriteTime.dwHighDateTime=0x1d56495, nFileSizeHigh=0x0, nFileSizeLow=0xcca4)) returned 1 [0078.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0078.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", lpFilePart=0x0) returned 0x33 [0078.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y3pqif.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.084] GetFileType (hFile=0x2b8) returned 0x1 [0078.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0078.084] GetFileType (hFile=0x2b8) returned 0x1 [0078.084] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xcca4 [0078.084] ReadFile (in: hFile=0x2b8, lpBuffer=0x2780828, nNumberOfBytesToRead=0xcca4, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2780828*, lpNumberOfBytesRead=0x1c9aeb38*=0xcca4, lpOverlapped=0x0) returned 1 [0078.085] CloseHandle (hObject=0x2b8) returned 1 [0078.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", lpFilePart=0x0) returned 0x33 [0078.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0078.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y3pqif.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.097] GetFileType (hFile=0x2b8) returned 0x1 [0078.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0078.097] GetFileType (hFile=0x2b8) returned 0x1 [0078.097] WriteFile (in: hFile=0x2b8, lpBuffer=0x281da30*, nNumberOfBytesToWrite=0xccb0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x281da30*, lpNumberOfBytesWritten=0x1c9aebc8*=0xccb0, lpOverlapped=0x0) returned 1 [0078.099] CloseHandle (hObject=0x2b8) returned 1 [0078.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", lpFilePart=0x0) returned 0x33 [0078.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", lpFilePart=0x0) returned 0x33 [0078.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0078.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y3pqif.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.099] GetFileType (hFile=0x2b8) returned 0x1 [0078.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0078.099] GetFileType (hFile=0x2b8) returned 0x1 [0078.099] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xccb0 [0078.099] WriteFile (in: hFile=0x2b8, lpBuffer=0x282b588*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x282b588*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0078.100] CloseHandle (hObject=0x2b8) returned 1 [0078.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx", lpFilePart=0x0) returned 0x33 [0078.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WTNwcUlGLnBwdHg=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WTNwcUlGLnBwdHg=", lpFilePart=0x0) returned 0x38 [0078.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0078.100] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y3pqif.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9342d5b0, ftCreationTime.dwHighDateTime=0x1d5b0f3, ftLastAccessTime.dwLowDateTime=0x9aab9b20, ftLastAccessTime.dwHighDateTime=0x1d56495, ftLastWriteTime.dwLowDateTime=0xd644bb20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xccba)) returned 1 [0078.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0078.100] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y3pqIF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y3pqif.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WTNwcUlGLnBwdHg=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wtnwculglnbwdhg=")) returned 1 [0078.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", lpFilePart=0x0) returned 0x40 [0078.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0078.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ycf dsnop3iexatjism.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.101] GetFileType (hFile=0x2b8) returned 0x1 [0078.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0078.101] GetFileType (hFile=0x2b8) returned 0x1 [0078.101] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x3476 [0078.101] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=13420, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x346c [0078.101] ReadFile (in: hFile=0x2b8, lpBuffer=0x282c928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x282c928*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0078.102] CloseHandle (hObject=0x2b8) returned 1 [0078.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11be8) returned 0x0 [0078.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", lpFilePart=0x0) returned 0x40 [0078.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0078.103] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ycf dsnop3iexatjism.docx"), fInfoLevelId=0x0, lpFileInformation=0x2899568 | out: lpFileInformation=0x2899568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ad9530, ftCreationTime.dwHighDateTime=0x1d5c0e8, ftLastAccessTime.dwLowDateTime=0x6877cc10, ftLastAccessTime.dwHighDateTime=0x1d5c9b6, ftLastWriteTime.dwLowDateTime=0x6877cc10, ftLastWriteTime.dwHighDateTime=0x1d5c9b6, nFileSizeHigh=0x0, nFileSizeLow=0x3476)) returned 1 [0078.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0078.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", lpFilePart=0x0) returned 0x40 [0078.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ycf dsnop3iexatjism.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.104] GetFileType (hFile=0x2b8) returned 0x1 [0078.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0078.104] GetFileType (hFile=0x2b8) returned 0x1 [0078.104] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x3476 [0078.104] ReadFile (in: hFile=0x2b8, lpBuffer=0x2899840, nNumberOfBytesToRead=0x3476, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2899840*, lpNumberOfBytesRead=0x1c9aeb38*=0x3476, lpOverlapped=0x0) returned 1 [0078.104] CloseHandle (hObject=0x2b8) returned 1 [0078.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", lpFilePart=0x0) returned 0x40 [0078.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0078.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ycf dsnop3iexatjism.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.153] GetFileType (hFile=0x2b8) returned 0x1 [0078.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0078.153] GetFileType (hFile=0x2b8) returned 0x1 [0078.153] WriteFile (in: hFile=0x2b8, lpBuffer=0x274e430*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x274e430*, lpNumberOfBytesWritten=0x1c9aebc8*=0x3480, lpOverlapped=0x0) returned 1 [0078.154] CloseHandle (hObject=0x2b8) returned 1 [0078.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", lpFilePart=0x0) returned 0x40 [0078.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", lpFilePart=0x0) returned 0x40 [0078.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0078.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ycf dsnop3iexatjism.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.155] GetFileType (hFile=0x2b8) returned 0x1 [0078.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0078.155] GetFileType (hFile=0x2b8) returned 0x1 [0078.155] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x3480 [0078.155] WriteFile (in: hFile=0x2b8, lpBuffer=0x2752860*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2752860*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0078.155] CloseHandle (hObject=0x2b8) returned 1 [0078.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx", lpFilePart=0x0) returned 0x40 [0078.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WUNmIERTbm9QM2lleEFUamlTbS5kb2N4", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WUNmIERTbm9QM2lleEFUamlTbS5kb2N4", lpFilePart=0x0) returned 0x48 [0078.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0078.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ycf dsnop3iexatjism.docx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ad9530, ftCreationTime.dwHighDateTime=0x1d5c0e8, ftLastAccessTime.dwLowDateTime=0x6877cc10, ftLastAccessTime.dwHighDateTime=0x1d5c9b6, ftLastWriteTime.dwLowDateTime=0xd64e40a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x348a)) returned 1 [0078.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0078.155] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YCf DSnoP3iexATjiSm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ycf dsnop3iexatjism.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WUNmIERTbm9QM2lleEFUamlTbS5kb2N4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wunmiertbm9qm2lleefuamltbs5kb2n4")) returned 1 [0078.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0078.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm", lpFilePart=0x0) returned 0x3a [0078.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\", lpFilePart=0x0) returned 0x3b [0078.156] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa36c2bf0, ftCreationTime.dwHighDateTime=0x1d5e328, ftLastAccessTime.dwLowDateTime=0xf7b12e30, ftLastAccessTime.dwHighDateTime=0x1d5d7ee, ftLastWriteTime.dwLowDateTime=0xf7b12e30, ftLastWriteTime.dwHighDateTime=0x1d5d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0078.156] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa36c2bf0, ftCreationTime.dwHighDateTime=0x1d5e328, ftLastAccessTime.dwLowDateTime=0xf7b12e30, ftLastAccessTime.dwHighDateTime=0x1d5d7ee, ftLastWriteTime.dwLowDateTime=0xf7b12e30, ftLastWriteTime.dwHighDateTime=0x1d5d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.156] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13148170, ftCreationTime.dwHighDateTime=0x1d5e7dc, ftLastAccessTime.dwLowDateTime=0x339be280, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0x339be280, ftLastWriteTime.dwHighDateTime=0x1d5e02a, nFileSizeHigh=0x0, nFileSizeLow=0x18733, dwReserved0=0x0, dwReserved1=0x0, cFileName="71qkn8OtCF.odt", cAlternateFileName="71QKN8~1.ODT")) returned 1 [0078.157] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c2cc970, ftCreationTime.dwHighDateTime=0x1d5db10, ftLastAccessTime.dwLowDateTime=0x33c16530, ftLastAccessTime.dwHighDateTime=0x1d5dca3, ftLastWriteTime.dwLowDateTime=0x33c16530, ftLastWriteTime.dwHighDateTime=0x1d5dca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8r0dho1RTYstU", cAlternateFileName="A8R0DH~1")) returned 1 [0078.157] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c29cbd0, ftCreationTime.dwHighDateTime=0x1d5e64b, ftLastAccessTime.dwLowDateTime=0x8b444d0, ftLastAccessTime.dwHighDateTime=0x1d5e594, ftLastWriteTime.dwLowDateTime=0x8b444d0, ftLastWriteTime.dwHighDateTime=0x1d5e594, nFileSizeHigh=0x0, nFileSizeLow=0x117ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaRZ92qhuoEDC.xls", cAlternateFileName="TARZ92~1.XLS")) returned 1 [0078.157] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9353b950, ftCreationTime.dwHighDateTime=0x1d5e61f, ftLastAccessTime.dwLowDateTime=0xe51d19b0, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xe51d19b0, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x32cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="uGCqRliDr6LCvTN4ko.odt", cAlternateFileName="UGCQRL~1.ODT")) returned 1 [0078.157] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ecab0a0, ftCreationTime.dwHighDateTime=0x1d5e6f5, ftLastAccessTime.dwLowDateTime=0x85863c80, ftLastAccessTime.dwHighDateTime=0x1d5e502, ftLastWriteTime.dwLowDateTime=0x85863c80, ftLastWriteTime.dwHighDateTime=0x1d5e502, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w9FTMdQwSBRr", cAlternateFileName="W9FTMD~1")) returned 1 [0078.157] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948d1b90, ftCreationTime.dwHighDateTime=0x1d5e31d, ftLastAccessTime.dwLowDateTime=0xa96b2510, ftLastAccessTime.dwHighDateTime=0x1d5e693, ftLastWriteTime.dwLowDateTime=0xa96b2510, ftLastWriteTime.dwHighDateTime=0x1d5e693, nFileSizeHigh=0x0, nFileSizeLow=0x18357, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zqhs8.doc", cAlternateFileName="")) returned 1 [0078.157] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.157] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0078.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0078.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0078.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0078.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm", lpFilePart=0x0) returned 0x3a [0078.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\", lpFilePart=0x0) returned 0x3b [0078.158] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa36c2bf0, ftCreationTime.dwHighDateTime=0x1d5e328, ftLastAccessTime.dwLowDateTime=0xf7b12e30, ftLastAccessTime.dwHighDateTime=0x1d5d7ee, ftLastWriteTime.dwLowDateTime=0xf7b12e30, ftLastWriteTime.dwHighDateTime=0x1d5d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0078.158] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa36c2bf0, ftCreationTime.dwHighDateTime=0x1d5e328, ftLastAccessTime.dwLowDateTime=0xf7b12e30, ftLastAccessTime.dwHighDateTime=0x1d5d7ee, ftLastWriteTime.dwLowDateTime=0xf7b12e30, ftLastWriteTime.dwHighDateTime=0x1d5d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.158] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13148170, ftCreationTime.dwHighDateTime=0x1d5e7dc, ftLastAccessTime.dwLowDateTime=0x339be280, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0x339be280, ftLastWriteTime.dwHighDateTime=0x1d5e02a, nFileSizeHigh=0x0, nFileSizeLow=0x18733, dwReserved0=0x0, dwReserved1=0x0, cFileName="71qkn8OtCF.odt", cAlternateFileName="71QKN8~1.ODT")) returned 1 [0078.158] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c2cc970, ftCreationTime.dwHighDateTime=0x1d5db10, ftLastAccessTime.dwLowDateTime=0x33c16530, ftLastAccessTime.dwHighDateTime=0x1d5dca3, ftLastWriteTime.dwLowDateTime=0x33c16530, ftLastWriteTime.dwHighDateTime=0x1d5dca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8r0dho1RTYstU", cAlternateFileName="A8R0DH~1")) returned 1 [0078.158] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c29cbd0, ftCreationTime.dwHighDateTime=0x1d5e64b, ftLastAccessTime.dwLowDateTime=0x8b444d0, ftLastAccessTime.dwHighDateTime=0x1d5e594, ftLastWriteTime.dwLowDateTime=0x8b444d0, ftLastWriteTime.dwHighDateTime=0x1d5e594, nFileSizeHigh=0x0, nFileSizeLow=0x117ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaRZ92qhuoEDC.xls", cAlternateFileName="TARZ92~1.XLS")) returned 1 [0078.159] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9353b950, ftCreationTime.dwHighDateTime=0x1d5e61f, ftLastAccessTime.dwLowDateTime=0xe51d19b0, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xe51d19b0, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x32cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="uGCqRliDr6LCvTN4ko.odt", cAlternateFileName="UGCQRL~1.ODT")) returned 1 [0078.159] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ecab0a0, ftCreationTime.dwHighDateTime=0x1d5e6f5, ftLastAccessTime.dwLowDateTime=0x85863c80, ftLastAccessTime.dwHighDateTime=0x1d5e502, ftLastWriteTime.dwLowDateTime=0x85863c80, ftLastWriteTime.dwHighDateTime=0x1d5e502, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w9FTMdQwSBRr", cAlternateFileName="W9FTMD~1")) returned 1 [0078.159] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948d1b90, ftCreationTime.dwHighDateTime=0x1d5e31d, ftLastAccessTime.dwLowDateTime=0xa96b2510, ftLastAccessTime.dwHighDateTime=0x1d5e693, ftLastWriteTime.dwLowDateTime=0xa96b2510, ftLastWriteTime.dwHighDateTime=0x1d5e693, nFileSizeHigh=0x0, nFileSizeLow=0x18357, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zqhs8.doc", cAlternateFileName="")) returned 1 [0078.159] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948d1b90, ftCreationTime.dwHighDateTime=0x1d5e31d, ftLastAccessTime.dwLowDateTime=0xa96b2510, ftLastAccessTime.dwHighDateTime=0x1d5e693, ftLastWriteTime.dwLowDateTime=0xa96b2510, ftLastWriteTime.dwHighDateTime=0x1d5e693, nFileSizeHigh=0x0, nFileSizeLow=0x18357, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zqhs8.doc", cAlternateFileName="")) returned 0 [0078.159] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0078.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0078.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0078.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", lpFilePart=0x0) returned 0x49 [0078.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0078.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\71qkn8otcf.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.159] GetFileType (hFile=0x2b8) returned 0x1 [0078.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0078.160] GetFileType (hFile=0x2b8) returned 0x1 [0078.160] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x18733 [0078.160] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=100137, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x18729 [0078.160] ReadFile (in: hFile=0x2b8, lpBuffer=0x27577c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27577c0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0078.160] CloseHandle (hObject=0x2b8) returned 1 [0078.161] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11be8) returned 0x0 [0078.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", lpFilePart=0x0) returned 0x49 [0078.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0078.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\71qkn8otcf.odt"), fInfoLevelId=0x0, lpFileInformation=0x27c4380 | out: lpFileInformation=0x27c4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13148170, ftCreationTime.dwHighDateTime=0x1d5e7dc, ftLastAccessTime.dwLowDateTime=0x339be280, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0x339be280, ftLastWriteTime.dwHighDateTime=0x1d5e02a, nFileSizeHigh=0x0, nFileSizeLow=0x18733)) returned 1 [0078.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0078.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", lpFilePart=0x0) returned 0x49 [0078.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0078.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\71qkn8otcf.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.166] GetFileType (hFile=0x2b8) returned 0x1 [0078.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0078.166] GetFileType (hFile=0x2b8) returned 0x1 [0078.167] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x18733 [0078.167] ReadFile (in: hFile=0x2b8, lpBuffer=0x12720528, nNumberOfBytesToRead=0x18733, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x12720528*, lpNumberOfBytesRead=0x1c9aea98*=0x18733, lpOverlapped=0x0) returned 1 [0078.168] CloseHandle (hObject=0x2b8) returned 1 [0078.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", lpFilePart=0x0) returned 0x49 [0078.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\71qkn8otcf.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.210] GetFileType (hFile=0x2b8) returned 0x1 [0078.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.210] GetFileType (hFile=0x2b8) returned 0x1 [0078.210] WriteFile (in: hFile=0x2b8, lpBuffer=0x1279aa00*, nNumberOfBytesToWrite=0x18740, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x1279aa00*, lpNumberOfBytesWritten=0x1c9aeb28*=0x18740, lpOverlapped=0x0) returned 1 [0078.212] CloseHandle (hObject=0x2b8) returned 1 [0078.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", lpFilePart=0x0) returned 0x49 [0078.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", lpFilePart=0x0) returned 0x49 [0078.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0078.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\71qkn8otcf.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.213] GetFileType (hFile=0x2b8) returned 0x1 [0078.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0078.213] GetFileType (hFile=0x2b8) returned 0x1 [0078.213] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x18740 [0078.213] WriteFile (in: hFile=0x2b8, lpBuffer=0x283c1b8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x283c1b8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0078.213] CloseHandle (hObject=0x2b8) returned 1 [0078.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt", lpFilePart=0x0) returned 0x49 [0078.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\NzFxa244T3RDRi5vZHQ=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\NzFxa244T3RDRi5vZHQ=", lpFilePart=0x0) returned 0x4f [0078.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0078.214] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\71qkn8otcf.odt"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13148170, ftCreationTime.dwHighDateTime=0x1d5e7dc, ftLastAccessTime.dwLowDateTime=0x339be280, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0xd65564c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1874a)) returned 1 [0078.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0078.214] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\71qkn8OtCF.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\71qkn8otcf.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\NzFxa244T3RDRi5vZHQ=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\nzfxa244t3rdri5vzhq=")) returned 1 [0078.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", lpFilePart=0x0) returned 0x4c [0078.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0078.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\tarz92qhuoedc.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.214] GetFileType (hFile=0x2b8) returned 0x1 [0078.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0078.214] GetFileType (hFile=0x2b8) returned 0x1 [0078.214] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x117ba [0078.214] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=71600, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x117b0 [0078.215] ReadFile (in: hFile=0x2b8, lpBuffer=0x283d5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x283d5e0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0078.215] CloseHandle (hObject=0x2b8) returned 1 [0078.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11be8) returned 0x0 [0078.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", lpFilePart=0x0) returned 0x4c [0078.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0078.219] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\tarz92qhuoedc.xls"), fInfoLevelId=0x0, lpFileInformation=0x28aa1e0 | out: lpFileInformation=0x28aa1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c29cbd0, ftCreationTime.dwHighDateTime=0x1d5e64b, ftLastAccessTime.dwLowDateTime=0x8b444d0, ftLastAccessTime.dwHighDateTime=0x1d5e594, ftLastWriteTime.dwLowDateTime=0x8b444d0, ftLastWriteTime.dwHighDateTime=0x1d5e594, nFileSizeHigh=0x0, nFileSizeLow=0x117ba)) returned 1 [0078.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0078.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", lpFilePart=0x0) returned 0x4c [0078.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0078.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\tarz92qhuoedc.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.219] GetFileType (hFile=0x2b8) returned 0x1 [0078.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0078.219] GetFileType (hFile=0x2b8) returned 0x1 [0078.219] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x117ba [0078.220] ReadFile (in: hFile=0x2b8, lpBuffer=0x28aa4c8, nNumberOfBytesToRead=0x117ba, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28aa4c8*, lpNumberOfBytesRead=0x1c9aea98*=0x117ba, lpOverlapped=0x0) returned 1 [0078.220] CloseHandle (hObject=0x2b8) returned 1 [0078.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", lpFilePart=0x0) returned 0x4c [0078.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\tarz92qhuoedc.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.284] GetFileType (hFile=0x2b8) returned 0x1 [0078.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.284] GetFileType (hFile=0x2b8) returned 0x1 [0078.284] WriteFile (in: hFile=0x2b8, lpBuffer=0x2798390*, nNumberOfBytesToWrite=0x117c0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2798390*, lpNumberOfBytesWritten=0x1c9aeb28*=0x117c0, lpOverlapped=0x0) returned 1 [0078.286] CloseHandle (hObject=0x2b8) returned 1 [0078.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", lpFilePart=0x0) returned 0x4c [0078.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", lpFilePart=0x0) returned 0x4c [0078.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0078.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\tarz92qhuoedc.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.286] GetFileType (hFile=0x2b8) returned 0x1 [0078.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0078.286] GetFileType (hFile=0x2b8) returned 0x1 [0078.286] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x117c0 [0078.287] WriteFile (in: hFile=0x2b8, lpBuffer=0x27aab48*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27aab48*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0078.287] CloseHandle (hObject=0x2b8) returned 1 [0078.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls", lpFilePart=0x0) returned 0x4c [0078.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\VGFSWjkycWh1b0VEQy54bHM=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\VGFSWjkycWh1b0VEQy54bHM=", lpFilePart=0x0) returned 0x53 [0078.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0078.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\tarz92qhuoedc.xls"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c29cbd0, ftCreationTime.dwHighDateTime=0x1d5e64b, ftLastAccessTime.dwLowDateTime=0x8b444d0, ftLastAccessTime.dwHighDateTime=0x1d5e594, ftLastWriteTime.dwLowDateTime=0xd6614ba0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x117ca)) returned 1 [0078.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0078.287] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\TaRZ92qhuoEDC.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\tarz92qhuoedc.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\VGFSWjkycWh1b0VEQy54bHM=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\vgfswjkycwh1b0veqy54bhm=")) returned 1 [0078.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", lpFilePart=0x0) returned 0x51 [0078.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0078.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\ugcqrlidr6lcvtn4ko.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.288] GetFileType (hFile=0x2b8) returned 0x1 [0078.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0078.288] GetFileType (hFile=0x2b8) returned 0x1 [0078.288] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x32cd [0078.288] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=12995, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x32c3 [0078.288] ReadFile (in: hFile=0x2b8, lpBuffer=0x27abf98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27abf98*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0078.289] CloseHandle (hObject=0x2b8) returned 1 [0078.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11be8) returned 0x0 [0078.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", lpFilePart=0x0) returned 0x51 [0078.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0078.290] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\ugcqrlidr6lcvtn4ko.odt"), fInfoLevelId=0x0, lpFileInformation=0x2818b58 | out: lpFileInformation=0x2818b58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9353b950, ftCreationTime.dwHighDateTime=0x1d5e61f, ftLastAccessTime.dwLowDateTime=0xe51d19b0, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xe51d19b0, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x32cd)) returned 1 [0078.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0078.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", lpFilePart=0x0) returned 0x51 [0078.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0078.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\ugcqrlidr6lcvtn4ko.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.291] GetFileType (hFile=0x2b8) returned 0x1 [0078.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0078.291] GetFileType (hFile=0x2b8) returned 0x1 [0078.291] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x32cd [0078.291] ReadFile (in: hFile=0x2b8, lpBuffer=0x2818e60, nNumberOfBytesToRead=0x32cd, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2818e60*, lpNumberOfBytesRead=0x1c9aea98*=0x32cd, lpOverlapped=0x0) returned 1 [0078.291] CloseHandle (hObject=0x2b8) returned 1 [0078.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", lpFilePart=0x0) returned 0x51 [0078.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\ugcqrlidr6lcvtn4ko.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.303] GetFileType (hFile=0x2b8) returned 0x1 [0078.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.303] GetFileType (hFile=0x2b8) returned 0x1 [0078.303] WriteFile (in: hFile=0x2b8, lpBuffer=0x289f860*, nNumberOfBytesToWrite=0x32d0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x289f860*, lpNumberOfBytesWritten=0x1c9aeb28*=0x32d0, lpOverlapped=0x0) returned 1 [0078.304] CloseHandle (hObject=0x2b8) returned 1 [0078.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", lpFilePart=0x0) returned 0x51 [0078.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", lpFilePart=0x0) returned 0x51 [0078.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0078.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\ugcqrlidr6lcvtn4ko.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.305] GetFileType (hFile=0x2b8) returned 0x1 [0078.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0078.305] GetFileType (hFile=0x2b8) returned 0x1 [0078.305] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x32d0 [0078.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt", lpFilePart=0x0) returned 0x51 [0078.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\dUdDcVJsaURyNkxDdlRONGtvLm9kdA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\dUdDcVJsaURyNkxDdlRONGtvLm9kdA==", lpFilePart=0x0) returned 0x5b [0078.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0078.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\ugcqrlidr6lcvtn4ko.odt"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9353b950, ftCreationTime.dwHighDateTime=0x1d5e61f, ftLastAccessTime.dwLowDateTime=0xe51d19b0, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xd663ad00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x32da)) returned 1 [0078.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0078.307] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\uGCqRliDr6LCvTN4ko.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\ugcqrlidr6lcvtn4ko.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\dUdDcVJsaURyNkxDdlRONGtvLm9kdA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\duddcvjsaurynkxddlrongtvlm9kda==")) returned 1 [0078.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", lpFilePart=0x0) returned 0x44 [0078.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0078.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\zqhs8.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.307] GetFileType (hFile=0x2b8) returned 0x1 [0078.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0078.307] GetFileType (hFile=0x2b8) returned 0x1 [0078.307] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x18357 [0078.307] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=99149, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x1834d [0078.307] ReadFile (in: hFile=0x2b8, lpBuffer=0x28a4fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28a4fb8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0078.308] CloseHandle (hObject=0x2b8) returned 1 [0078.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", lpFilePart=0x0) returned 0x44 [0078.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0078.310] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\zqhs8.doc"), fInfoLevelId=0x0, lpFileInformation=0x2911b78 | out: lpFileInformation=0x2911b78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948d1b90, ftCreationTime.dwHighDateTime=0x1d5e31d, ftLastAccessTime.dwLowDateTime=0xa96b2510, ftLastAccessTime.dwHighDateTime=0x1d5e693, ftLastWriteTime.dwLowDateTime=0xa96b2510, ftLastWriteTime.dwHighDateTime=0x1d5e693, nFileSizeHigh=0x0, nFileSizeLow=0x18357)) returned 1 [0078.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0078.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", lpFilePart=0x0) returned 0x44 [0078.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0078.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\zqhs8.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.310] GetFileType (hFile=0x2b8) returned 0x1 [0078.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0078.311] GetFileType (hFile=0x2b8) returned 0x1 [0078.311] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x18357 [0078.311] ReadFile (in: hFile=0x2b8, lpBuffer=0x127d6110, nNumberOfBytesToRead=0x18357, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x127d6110*, lpNumberOfBytesRead=0x1c9aea98*=0x18357, lpOverlapped=0x0) returned 1 [0078.312] CloseHandle (hObject=0x2b8) returned 1 [0078.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", lpFilePart=0x0) returned 0x44 [0078.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\zqhs8.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.373] GetFileType (hFile=0x2b8) returned 0x1 [0078.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.373] GetFileType (hFile=0x2b8) returned 0x1 [0078.373] WriteFile (in: hFile=0x2b8, lpBuffer=0x1284f288*, nNumberOfBytesToWrite=0x18360, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x1284f288*, lpNumberOfBytesWritten=0x1c9aeb28*=0x18360, lpOverlapped=0x0) returned 1 [0078.375] CloseHandle (hObject=0x2b8) returned 1 [0078.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", lpFilePart=0x0) returned 0x44 [0078.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", lpFilePart=0x0) returned 0x44 [0078.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0078.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\zqhs8.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.376] GetFileType (hFile=0x2b8) returned 0x1 [0078.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0078.376] GetFileType (hFile=0x2b8) returned 0x1 [0078.376] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x18360 [0078.376] WriteFile (in: hFile=0x2b8, lpBuffer=0x26e43e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x26e43e8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0078.376] CloseHandle (hObject=0x2b8) returned 1 [0078.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc", lpFilePart=0x0) returned 0x44 [0078.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\WnFoczguZG9j", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\WnFoczguZG9j", lpFilePart=0x0) returned 0x47 [0078.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0078.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\zqhs8.doc"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948d1b90, ftCreationTime.dwHighDateTime=0x1d5e31d, ftLastAccessTime.dwLowDateTime=0xa96b2510, ftLastAccessTime.dwHighDateTime=0x1d5e693, ftLastWriteTime.dwLowDateTime=0xd66f93e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1836a)) returned 1 [0078.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0078.376] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\Zqhs8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\zqhs8.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\WnFoczguZG9j" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\wnfoczguzg9j")) returned 1 [0078.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0078.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU", lpFilePart=0x0) returned 0x49 [0078.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\", lpFilePart=0x0) returned 0x4a [0078.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c2cc970, ftCreationTime.dwHighDateTime=0x1d5db10, ftLastAccessTime.dwLowDateTime=0x33c16530, ftLastAccessTime.dwHighDateTime=0x1d5dca3, ftLastWriteTime.dwLowDateTime=0x33c16530, ftLastWriteTime.dwHighDateTime=0x1d5dca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0078.377] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c2cc970, ftCreationTime.dwHighDateTime=0x1d5db10, ftLastAccessTime.dwLowDateTime=0x33c16530, ftLastAccessTime.dwHighDateTime=0x1d5dca3, ftLastWriteTime.dwLowDateTime=0x33c16530, ftLastWriteTime.dwHighDateTime=0x1d5dca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.377] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc6c180, ftCreationTime.dwHighDateTime=0x1d5d88b, ftLastAccessTime.dwLowDateTime=0x9be254e0, ftLastAccessTime.dwHighDateTime=0x1d5d7ed, ftLastWriteTime.dwLowDateTime=0x9be254e0, ftLastWriteTime.dwHighDateTime=0x1d5d7ed, nFileSizeHigh=0x0, nFileSizeLow=0x3674, dwReserved0=0x0, dwReserved1=0x0, cFileName="1czKDhnb.odt", cAlternateFileName="")) returned 1 [0078.378] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8624550, ftCreationTime.dwHighDateTime=0x1d5e7be, ftLastAccessTime.dwLowDateTime=0x18cab4a0, ftLastAccessTime.dwHighDateTime=0x1d5db97, ftLastWriteTime.dwLowDateTime=0x18cab4a0, ftLastWriteTime.dwHighDateTime=0x1d5db97, nFileSizeHigh=0x0, nFileSizeLow=0xbeb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="3MTL8Z Tq3VwDx4ag.rtf", cAlternateFileName="3MTL8Z~1.RTF")) returned 1 [0078.378] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf48c99c0, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0xba34e920, ftLastAccessTime.dwHighDateTime=0x1d5e356, ftLastWriteTime.dwLowDateTime=0xba34e920, ftLastWriteTime.dwHighDateTime=0x1d5e356, nFileSizeHigh=0x0, nFileSizeLow=0x11f1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3vWJRQxkkaz9DGNyqJcC.rtf", cAlternateFileName="3VWJRQ~1.RTF")) returned 1 [0078.378] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bde250, ftCreationTime.dwHighDateTime=0x1d5df42, ftLastAccessTime.dwLowDateTime=0x48301330, ftLastAccessTime.dwHighDateTime=0x1d5e0aa, ftLastWriteTime.dwLowDateTime=0x48301330, ftLastWriteTime.dwHighDateTime=0x1d5e0aa, nFileSizeHigh=0x0, nFileSizeLow=0xad0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ayPnk1 Qj7XdFB4ZQ.pptx", cAlternateFileName="AYPNK1~1.PPT")) returned 1 [0078.378] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73231280, ftCreationTime.dwHighDateTime=0x1d5dcb4, ftLastAccessTime.dwLowDateTime=0xdc5ffb00, ftLastAccessTime.dwHighDateTime=0x1d5d926, ftLastWriteTime.dwLowDateTime=0xdc5ffb00, ftLastWriteTime.dwHighDateTime=0x1d5d926, nFileSizeHigh=0x0, nFileSizeLow=0x8d1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sKwo6.rtf", cAlternateFileName="")) returned 1 [0078.378] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.378] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0078.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0078.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0078.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0078.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU", lpFilePart=0x0) returned 0x49 [0078.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\", lpFilePart=0x0) returned 0x4a [0078.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c2cc970, ftCreationTime.dwHighDateTime=0x1d5db10, ftLastAccessTime.dwLowDateTime=0x33c16530, ftLastAccessTime.dwHighDateTime=0x1d5dca3, ftLastWriteTime.dwLowDateTime=0x33c16530, ftLastWriteTime.dwHighDateTime=0x1d5dca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0078.379] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c2cc970, ftCreationTime.dwHighDateTime=0x1d5db10, ftLastAccessTime.dwLowDateTime=0x33c16530, ftLastAccessTime.dwHighDateTime=0x1d5dca3, ftLastWriteTime.dwLowDateTime=0x33c16530, ftLastWriteTime.dwHighDateTime=0x1d5dca3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.379] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc6c180, ftCreationTime.dwHighDateTime=0x1d5d88b, ftLastAccessTime.dwLowDateTime=0x9be254e0, ftLastAccessTime.dwHighDateTime=0x1d5d7ed, ftLastWriteTime.dwLowDateTime=0x9be254e0, ftLastWriteTime.dwHighDateTime=0x1d5d7ed, nFileSizeHigh=0x0, nFileSizeLow=0x3674, dwReserved0=0x0, dwReserved1=0x0, cFileName="1czKDhnb.odt", cAlternateFileName="")) returned 1 [0078.379] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8624550, ftCreationTime.dwHighDateTime=0x1d5e7be, ftLastAccessTime.dwLowDateTime=0x18cab4a0, ftLastAccessTime.dwHighDateTime=0x1d5db97, ftLastWriteTime.dwLowDateTime=0x18cab4a0, ftLastWriteTime.dwHighDateTime=0x1d5db97, nFileSizeHigh=0x0, nFileSizeLow=0xbeb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="3MTL8Z Tq3VwDx4ag.rtf", cAlternateFileName="3MTL8Z~1.RTF")) returned 1 [0078.379] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf48c99c0, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0xba34e920, ftLastAccessTime.dwHighDateTime=0x1d5e356, ftLastWriteTime.dwLowDateTime=0xba34e920, ftLastWriteTime.dwHighDateTime=0x1d5e356, nFileSizeHigh=0x0, nFileSizeLow=0x11f1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3vWJRQxkkaz9DGNyqJcC.rtf", cAlternateFileName="3VWJRQ~1.RTF")) returned 1 [0078.379] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bde250, ftCreationTime.dwHighDateTime=0x1d5df42, ftLastAccessTime.dwLowDateTime=0x48301330, ftLastAccessTime.dwHighDateTime=0x1d5e0aa, ftLastWriteTime.dwLowDateTime=0x48301330, ftLastWriteTime.dwHighDateTime=0x1d5e0aa, nFileSizeHigh=0x0, nFileSizeLow=0xad0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ayPnk1 Qj7XdFB4ZQ.pptx", cAlternateFileName="AYPNK1~1.PPT")) returned 1 [0078.380] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73231280, ftCreationTime.dwHighDateTime=0x1d5dcb4, ftLastAccessTime.dwLowDateTime=0xdc5ffb00, ftLastAccessTime.dwHighDateTime=0x1d5d926, ftLastWriteTime.dwLowDateTime=0xdc5ffb00, ftLastWriteTime.dwHighDateTime=0x1d5d926, nFileSizeHigh=0x0, nFileSizeLow=0x8d1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sKwo6.rtf", cAlternateFileName="")) returned 1 [0078.380] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73231280, ftCreationTime.dwHighDateTime=0x1d5dcb4, ftLastAccessTime.dwLowDateTime=0xdc5ffb00, ftLastAccessTime.dwHighDateTime=0x1d5d926, ftLastWriteTime.dwLowDateTime=0xdc5ffb00, ftLastWriteTime.dwHighDateTime=0x1d5d926, nFileSizeHigh=0x0, nFileSizeLow=0x8d1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sKwo6.rtf", cAlternateFileName="")) returned 0 [0078.380] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0078.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0078.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0078.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", lpFilePart=0x0) returned 0x56 [0078.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\1czkdhnb.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.380] GetFileType (hFile=0x2b8) returned 0x1 [0078.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.380] GetFileType (hFile=0x2b8) returned 0x1 [0078.380] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x3674 [0078.380] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=13930, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x366a [0078.380] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e9490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x26e9490*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.381] CloseHandle (hObject=0x2b8) returned 1 [0078.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11be8) returned 0x0 [0078.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", lpFilePart=0x0) returned 0x56 [0078.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\1czkdhnb.odt"), fInfoLevelId=0x0, lpFileInformation=0x27560d0 | out: lpFileInformation=0x27560d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc6c180, ftCreationTime.dwHighDateTime=0x1d5d88b, ftLastAccessTime.dwLowDateTime=0x9be254e0, ftLastAccessTime.dwHighDateTime=0x1d5d7ed, ftLastWriteTime.dwLowDateTime=0x9be254e0, ftLastWriteTime.dwHighDateTime=0x1d5d7ed, nFileSizeHigh=0x0, nFileSizeLow=0x3674)) returned 1 [0078.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", lpFilePart=0x0) returned 0x56 [0078.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\1czkdhnb.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.387] GetFileType (hFile=0x2b8) returned 0x1 [0078.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.387] GetFileType (hFile=0x2b8) returned 0x1 [0078.388] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x3674 [0078.388] ReadFile (in: hFile=0x2b8, lpBuffer=0x27563c8, nNumberOfBytesToRead=0x3674, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x27563c8*, lpNumberOfBytesRead=0x1c9ae9f8*=0x3674, lpOverlapped=0x0) returned 1 [0078.388] CloseHandle (hObject=0x2b8) returned 1 [0078.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", lpFilePart=0x0) returned 0x56 [0078.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\1czkdhnb.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.422] GetFileType (hFile=0x2b8) returned 0x1 [0078.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.422] GetFileType (hFile=0x2b8) returned 0x1 [0078.422] WriteFile (in: hFile=0x2b8, lpBuffer=0x27de038*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x27de038*, lpNumberOfBytesWritten=0x1c9aea88*=0x3680, lpOverlapped=0x0) returned 1 [0078.423] CloseHandle (hObject=0x2b8) returned 1 [0078.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", lpFilePart=0x0) returned 0x56 [0078.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", lpFilePart=0x0) returned 0x56 [0078.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\1czkdhnb.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.424] GetFileType (hFile=0x2b8) returned 0x1 [0078.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.424] GetFileType (hFile=0x2b8) returned 0x1 [0078.424] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x3680 [0078.424] WriteFile (in: hFile=0x2b8, lpBuffer=0x27e26e0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x27e26e0*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.424] CloseHandle (hObject=0x2b8) returned 1 [0078.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt", lpFilePart=0x0) returned 0x56 [0078.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\MWN6S0RobmIub2R0", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\MWN6S0RobmIub2R0", lpFilePart=0x0) returned 0x5a [0078.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.424] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\1czkdhnb.odt"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc6c180, ftCreationTime.dwHighDateTime=0x1d5d88b, ftLastAccessTime.dwLowDateTime=0x9be254e0, ftLastAccessTime.dwHighDateTime=0x1d5d7ed, ftLastWriteTime.dwLowDateTime=0xd676b800, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x368a)) returned 1 [0078.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.424] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\1czKDhnb.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\1czkdhnb.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\MWN6S0RobmIub2R0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\mwn6s0robmiub2r0")) returned 1 [0078.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", lpFilePart=0x0) returned 0x5f [0078.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3mtl8z tq3vwdx4ag.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.425] GetFileType (hFile=0x2b8) returned 0x1 [0078.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.425] GetFileType (hFile=0x2b8) returned 0x1 [0078.425] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0xbeb9 [0078.425] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=48815, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0xbeaf [0078.425] ReadFile (in: hFile=0x2b8, lpBuffer=0x27e3b78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x27e3b78*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.426] CloseHandle (hObject=0x2b8) returned 1 [0078.426] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0078.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", lpFilePart=0x0) returned 0x5f [0078.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.428] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3mtl8z tq3vwdx4ag.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2850588 | out: lpFileInformation=0x2850588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8624550, ftCreationTime.dwHighDateTime=0x1d5e7be, ftLastAccessTime.dwLowDateTime=0x18cab4a0, ftLastAccessTime.dwHighDateTime=0x1d5db97, ftLastWriteTime.dwLowDateTime=0x18cab4a0, ftLastWriteTime.dwHighDateTime=0x1d5db97, nFileSizeHigh=0x0, nFileSizeLow=0xbeb9)) returned 1 [0078.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", lpFilePart=0x0) returned 0x5f [0078.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3mtl8z tq3vwdx4ag.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.428] GetFileType (hFile=0x2b8) returned 0x1 [0078.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.428] GetFileType (hFile=0x2b8) returned 0x1 [0078.428] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0xbeb9 [0078.428] ReadFile (in: hFile=0x2b8, lpBuffer=0x28508c0, nNumberOfBytesToRead=0xbeb9, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x28508c0*, lpNumberOfBytesRead=0x1c9ae9f8*=0xbeb9, lpOverlapped=0x0) returned 1 [0078.429] CloseHandle (hObject=0x2b8) returned 1 [0078.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", lpFilePart=0x0) returned 0x5f [0078.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3mtl8z tq3vwdx4ag.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.494] GetFileType (hFile=0x2b8) returned 0x1 [0078.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.494] GetFileType (hFile=0x2b8) returned 0x1 [0078.494] WriteFile (in: hFile=0x2b8, lpBuffer=0x2721830*, nNumberOfBytesToWrite=0xbec0, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x2721830*, lpNumberOfBytesWritten=0x1c9aea88*=0xbec0, lpOverlapped=0x0) returned 1 [0078.496] CloseHandle (hObject=0x2b8) returned 1 [0078.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", lpFilePart=0x0) returned 0x5f [0078.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", lpFilePart=0x0) returned 0x5f [0078.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3mtl8z tq3vwdx4ag.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.496] GetFileType (hFile=0x2b8) returned 0x1 [0078.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.496] GetFileType (hFile=0x2b8) returned 0x1 [0078.496] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0xbec0 [0078.496] WriteFile (in: hFile=0x2b8, lpBuffer=0x272e7a8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x272e7a8*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.497] CloseHandle (hObject=0x2b8) returned 1 [0078.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf", lpFilePart=0x0) returned 0x5f [0078.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\M01UTDhaIFRxM1Z3RHg0YWcucnRm", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\M01UTDhaIFRxM1Z3RHg0YWcucnRm", lpFilePart=0x0) returned 0x66 [0078.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.497] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3mtl8z tq3vwdx4ag.rtf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8624550, ftCreationTime.dwHighDateTime=0x1d5e7be, ftLastAccessTime.dwLowDateTime=0x18cab4a0, ftLastAccessTime.dwHighDateTime=0x1d5db97, ftLastWriteTime.dwLowDateTime=0xd6803d80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xbeca)) returned 1 [0078.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.497] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3MTL8Z Tq3VwDx4ag.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3mtl8z tq3vwdx4ag.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\M01UTDhaIFRxM1Z3RHg0YWcucnRm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\m01utdhaifrxm1z3rhg0ywcucnrm")) returned 1 [0078.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", lpFilePart=0x0) returned 0x62 [0078.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3vwjrqxkkaz9dgnyqjcc.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.498] GetFileType (hFile=0x2b8) returned 0x1 [0078.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.498] GetFileType (hFile=0x2b8) returned 0x1 [0078.498] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x11f1b [0078.498] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=73489, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x11f11 [0078.498] ReadFile (in: hFile=0x2b8, lpBuffer=0x272fc90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x272fc90*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.499] CloseHandle (hObject=0x2b8) returned 1 [0078.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0078.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", lpFilePart=0x0) returned 0x62 [0078.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3vwjrqxkkaz9dgnyqjcc.rtf"), fInfoLevelId=0x0, lpFileInformation=0x279c6a0 | out: lpFileInformation=0x279c6a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf48c99c0, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0xba34e920, ftLastAccessTime.dwHighDateTime=0x1d5e356, ftLastWriteTime.dwLowDateTime=0xba34e920, ftLastWriteTime.dwHighDateTime=0x1d5e356, nFileSizeHigh=0x0, nFileSizeLow=0x11f1b)) returned 1 [0078.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", lpFilePart=0x0) returned 0x62 [0078.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3vwjrqxkkaz9dgnyqjcc.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.505] GetFileType (hFile=0x2b8) returned 0x1 [0078.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.505] GetFileType (hFile=0x2b8) returned 0x1 [0078.505] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x11f1b [0078.505] ReadFile (in: hFile=0x2b8, lpBuffer=0x279c9f8, nNumberOfBytesToRead=0x11f1b, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x279c9f8*, lpNumberOfBytesRead=0x1c9ae9f8*=0x11f1b, lpOverlapped=0x0) returned 1 [0078.506] CloseHandle (hObject=0x2b8) returned 1 [0078.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", lpFilePart=0x0) returned 0x62 [0078.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3vwjrqxkkaz9dgnyqjcc.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.521] GetFileType (hFile=0x2b8) returned 0x1 [0078.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.521] GetFileType (hFile=0x2b8) returned 0x1 [0078.521] WriteFile (in: hFile=0x2b8, lpBuffer=0x2849548*, nNumberOfBytesToWrite=0x11f20, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x2849548*, lpNumberOfBytesWritten=0x1c9aea88*=0x11f20, lpOverlapped=0x0) returned 1 [0078.523] CloseHandle (hObject=0x2b8) returned 1 [0078.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", lpFilePart=0x0) returned 0x62 [0078.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", lpFilePart=0x0) returned 0x62 [0078.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3vwjrqxkkaz9dgnyqjcc.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.523] GetFileType (hFile=0x2b8) returned 0x1 [0078.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.523] GetFileType (hFile=0x2b8) returned 0x1 [0078.523] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x11f20 [0078.523] WriteFile (in: hFile=0x2b8, lpBuffer=0x285c560*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x285c560*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.524] CloseHandle (hObject=0x2b8) returned 1 [0078.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf", lpFilePart=0x0) returned 0x62 [0078.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\M3ZXSlJReGtrYXo5REdOeXFKY0MucnRm", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\M3ZXSlJReGtrYXo5REdOeXFKY0MucnRm", lpFilePart=0x0) returned 0x6a [0078.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.524] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3vwjrqxkkaz9dgnyqjcc.rtf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf48c99c0, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0xba34e920, ftLastAccessTime.dwHighDateTime=0x1d5e356, ftLastWriteTime.dwLowDateTime=0xd6850040, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x11f2a)) returned 1 [0078.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.524] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\3vWJRQxkkaz9DGNyqJcC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\3vwjrqxkkaz9dgnyqjcc.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\M3ZXSlJReGtrYXo5REdOeXFKY0MucnRm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\m3zxsljregtryxo5redoexfky0mucnrm")) returned 1 [0078.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", lpFilePart=0x0) returned 0x60 [0078.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\aypnk1 qj7xdfb4zq.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.525] GetFileType (hFile=0x2b8) returned 0x1 [0078.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.525] GetFileType (hFile=0x2b8) returned 0x1 [0078.525] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0xad0d [0078.525] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=44291, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0xad03 [0078.525] ReadFile (in: hFile=0x2b8, lpBuffer=0x285da58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x285da58*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.526] CloseHandle (hObject=0x2b8) returned 1 [0078.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0078.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", lpFilePart=0x0) returned 0x60 [0078.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.529] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\aypnk1 qj7xdfb4zq.pptx"), fInfoLevelId=0x0, lpFileInformation=0x28ca5c8 | out: lpFileInformation=0x28ca5c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bde250, ftCreationTime.dwHighDateTime=0x1d5df42, ftLastAccessTime.dwLowDateTime=0x48301330, ftLastAccessTime.dwHighDateTime=0x1d5e0aa, ftLastWriteTime.dwLowDateTime=0x48301330, ftLastWriteTime.dwHighDateTime=0x1d5e0aa, nFileSizeHigh=0x0, nFileSizeLow=0xad0d)) returned 1 [0078.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", lpFilePart=0x0) returned 0x60 [0078.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\aypnk1 qj7xdfb4zq.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.529] GetFileType (hFile=0x2b8) returned 0x1 [0078.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.529] GetFileType (hFile=0x2b8) returned 0x1 [0078.529] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0xad0d [0078.530] ReadFile (in: hFile=0x2b8, lpBuffer=0x28ca910, nNumberOfBytesToRead=0xad0d, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x28ca910*, lpNumberOfBytesRead=0x1c9ae9f8*=0xad0d, lpOverlapped=0x0) returned 1 [0078.530] CloseHandle (hObject=0x2b8) returned 1 [0078.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", lpFilePart=0x0) returned 0x60 [0078.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\aypnk1 qj7xdfb4zq.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.580] GetFileType (hFile=0x2b8) returned 0x1 [0078.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.580] GetFileType (hFile=0x2b8) returned 0x1 [0078.580] WriteFile (in: hFile=0x2b8, lpBuffer=0x2796de0*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x2796de0*, lpNumberOfBytesWritten=0x1c9aea88*=0xad10, lpOverlapped=0x0) returned 1 [0078.581] CloseHandle (hObject=0x2b8) returned 1 [0078.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", lpFilePart=0x0) returned 0x60 [0078.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", lpFilePart=0x0) returned 0x60 [0078.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\aypnk1 qj7xdfb4zq.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.582] GetFileType (hFile=0x2b8) returned 0x1 [0078.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.582] GetFileType (hFile=0x2b8) returned 0x1 [0078.582] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0xad10 [0078.582] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a2bd0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x27a2bd0*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.584] CloseHandle (hObject=0x2b8) returned 1 [0078.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx", lpFilePart=0x0) returned 0x60 [0078.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\YXlQbmsxIFFqN1hkRkI0WlEucHB0eA==", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\YXlQbmsxIFFqN1hkRkI0WlEucHB0eA==", lpFilePart=0x0) returned 0x6a [0078.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\aypnk1 qj7xdfb4zq.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bde250, ftCreationTime.dwHighDateTime=0x1d5df42, ftLastAccessTime.dwLowDateTime=0x48301330, ftLastAccessTime.dwHighDateTime=0x1d5e0aa, ftLastWriteTime.dwLowDateTime=0xd68e85c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xad1a)) returned 1 [0078.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.585] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\ayPnk1 Qj7XdFB4ZQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\aypnk1 qj7xdfb4zq.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\YXlQbmsxIFFqN1hkRkI0WlEucHB0eA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\yxlqbmsxiffqn1hkrki0wleuchb0ea==")) returned 1 [0078.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", lpFilePart=0x0) returned 0x53 [0078.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.585] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\skwo6.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.585] GetFileType (hFile=0x2b8) returned 0x1 [0078.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.586] GetFileType (hFile=0x2b8) returned 0x1 [0078.586] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x8d1e [0078.586] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=36116, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x8d14 [0078.586] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x27a4090*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.587] CloseHandle (hObject=0x2b8) returned 1 [0078.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0078.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", lpFilePart=0x0) returned 0x53 [0078.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.592] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\skwo6.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2810aa0 | out: lpFileInformation=0x2810aa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73231280, ftCreationTime.dwHighDateTime=0x1d5dcb4, ftLastAccessTime.dwLowDateTime=0xdc5ffb00, ftLastAccessTime.dwHighDateTime=0x1d5d926, ftLastWriteTime.dwLowDateTime=0xdc5ffb00, ftLastWriteTime.dwHighDateTime=0x1d5d926, nFileSizeHigh=0x0, nFileSizeLow=0x8d1e)) returned 1 [0078.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", lpFilePart=0x0) returned 0x53 [0078.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\skwo6.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.593] GetFileType (hFile=0x2b8) returned 0x1 [0078.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.593] GetFileType (hFile=0x2b8) returned 0x1 [0078.593] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x8d1e [0078.593] ReadFile (in: hFile=0x2b8, lpBuffer=0x2810d78, nNumberOfBytesToRead=0x8d1e, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2810d78*, lpNumberOfBytesRead=0x1c9ae9f8*=0x8d1e, lpOverlapped=0x0) returned 1 [0078.593] CloseHandle (hObject=0x2b8) returned 1 [0078.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", lpFilePart=0x0) returned 0x53 [0078.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\skwo6.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.604] GetFileType (hFile=0x2b8) returned 0x1 [0078.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.604] GetFileType (hFile=0x2b8) returned 0x1 [0078.604] WriteFile (in: hFile=0x2b8, lpBuffer=0x28b3b08*, nNumberOfBytesToWrite=0x8d20, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x28b3b08*, lpNumberOfBytesWritten=0x1c9aea88*=0x8d20, lpOverlapped=0x0) returned 1 [0078.606] CloseHandle (hObject=0x2b8) returned 1 [0078.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", lpFilePart=0x0) returned 0x53 [0078.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", lpFilePart=0x0) returned 0x53 [0078.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\skwo6.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.607] GetFileType (hFile=0x2b8) returned 0x1 [0078.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.607] GetFileType (hFile=0x2b8) returned 0x1 [0078.607] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x8d20 [0078.607] WriteFile (in: hFile=0x2b8, lpBuffer=0x28bd810*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x28bd810*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.608] CloseHandle (hObject=0x2b8) returned 1 [0078.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf", lpFilePart=0x0) returned 0x53 [0078.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\c0t3bzYucnRm", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\c0t3bzYucnRm", lpFilePart=0x0) returned 0x56 [0078.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\skwo6.rtf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73231280, ftCreationTime.dwHighDateTime=0x1d5dcb4, ftLastAccessTime.dwLowDateTime=0xdc5ffb00, ftLastAccessTime.dwHighDateTime=0x1d5d926, ftLastWriteTime.dwLowDateTime=0xd6934880, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x8d2a)) returned 1 [0078.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.608] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\sKwo6.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\skwo6.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\c0t3bzYucnRm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\c0t3bzyucnrm")) returned 1 [0078.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae490, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\README_3728769.txt", lpFilePart=0x0) returned 0x5c [0078.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae970) returned 1 [0078.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\A8r0dho1RTYstU\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\a8r0dho1rtystu\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0078.610] GetFileType (hFile=0x2b8) returned 0x1 [0078.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8e0) returned 1 [0078.610] GetFileType (hFile=0x2b8) returned 0x1 [0078.610] WriteFile (in: hFile=0x2b8, lpBuffer=0x28c1bb8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9ae9b8, lpOverlapped=0x0 | out: lpBuffer=0x28c1bb8*, lpNumberOfBytesWritten=0x1c9ae9b8*=0x5b3, lpOverlapped=0x0) returned 1 [0078.611] CloseHandle (hObject=0x2b8) returned 1 [0078.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0078.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr", lpFilePart=0x0) returned 0x47 [0078.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\", lpFilePart=0x0) returned 0x48 [0078.611] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ecab0a0, ftCreationTime.dwHighDateTime=0x1d5e6f5, ftLastAccessTime.dwLowDateTime=0x85863c80, ftLastAccessTime.dwHighDateTime=0x1d5e502, ftLastWriteTime.dwLowDateTime=0x85863c80, ftLastWriteTime.dwHighDateTime=0x1d5e502, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0078.611] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ecab0a0, ftCreationTime.dwHighDateTime=0x1d5e6f5, ftLastAccessTime.dwLowDateTime=0x85863c80, ftLastAccessTime.dwHighDateTime=0x1d5e502, ftLastWriteTime.dwLowDateTime=0x85863c80, ftLastWriteTime.dwHighDateTime=0x1d5e502, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.612] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb07e910, ftCreationTime.dwHighDateTime=0x1d5e4e1, ftLastAccessTime.dwLowDateTime=0x6faacfe0, ftLastAccessTime.dwHighDateTime=0x1d5e23f, ftLastWriteTime.dwLowDateTime=0x6faacfe0, ftLastWriteTime.dwHighDateTime=0x1d5e23f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="0qhoA10oXPny-cO.ods", cAlternateFileName="0QHOA1~1.ODS")) returned 1 [0078.612] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b52e30, ftCreationTime.dwHighDateTime=0x1d5df38, ftLastAccessTime.dwLowDateTime=0x19963cb0, ftLastAccessTime.dwHighDateTime=0x1d5d84f, ftLastWriteTime.dwLowDateTime=0x19963cb0, ftLastWriteTime.dwHighDateTime=0x1d5d84f, nFileSizeHigh=0x0, nFileSizeLow=0xffb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="5N_T.xlsx", cAlternateFileName="5N_T~1.XLS")) returned 1 [0078.612] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9505c9f0, ftCreationTime.dwHighDateTime=0x1d5e19c, ftLastAccessTime.dwLowDateTime=0xd9e83180, ftLastAccessTime.dwHighDateTime=0x1d5e0ab, ftLastWriteTime.dwLowDateTime=0xd9e83180, ftLastWriteTime.dwHighDateTime=0x1d5e0ab, nFileSizeHigh=0x0, nFileSizeLow=0xc315, dwReserved0=0x0, dwReserved1=0x0, cFileName="faUIAZbN7x.ots", cAlternateFileName="FAUIAZ~1.OTS")) returned 1 [0078.612] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60666930, ftCreationTime.dwHighDateTime=0x1d5ddae, ftLastAccessTime.dwLowDateTime=0xbdb3d270, ftLastAccessTime.dwHighDateTime=0x1d5d7ec, ftLastWriteTime.dwLowDateTime=0xbdb3d270, ftLastWriteTime.dwHighDateTime=0x1d5d7ec, nFileSizeHigh=0x0, nFileSizeLow=0xfbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="fjBqrB1 YiTvHd9.pptx", cAlternateFileName="FJBQRB~1.PPT")) returned 1 [0078.612] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615154a0, ftCreationTime.dwHighDateTime=0x1d5e5e1, ftLastAccessTime.dwLowDateTime=0x9dad3f40, ftLastAccessTime.dwHighDateTime=0x1d5dddf, ftLastWriteTime.dwLowDateTime=0x9dad3f40, ftLastWriteTime.dwHighDateTime=0x1d5dddf, nFileSizeHigh=0x0, nFileSizeLow=0x49c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRKCnyt.csv", cAlternateFileName="")) returned 1 [0078.612] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b8b9fe0, ftCreationTime.dwHighDateTime=0x1d5e4d9, ftLastAccessTime.dwLowDateTime=0x3defd700, ftLastAccessTime.dwHighDateTime=0x1d5e73c, ftLastWriteTime.dwLowDateTime=0x3defd700, ftLastWriteTime.dwHighDateTime=0x1d5e73c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQ1e0oCfshs9kdmuJ", cAlternateFileName="KQ1E0O~1")) returned 1 [0078.612] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b8b9fe0, ftCreationTime.dwHighDateTime=0x1d5e4d9, ftLastAccessTime.dwLowDateTime=0x3defd700, ftLastAccessTime.dwHighDateTime=0x1d5e73c, ftLastWriteTime.dwLowDateTime=0x3defd700, ftLastWriteTime.dwHighDateTime=0x1d5e73c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQ1e0oCfshs9kdmuJ", cAlternateFileName="KQ1E0O~1")) returned 0 [0078.612] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0078.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0078.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0078.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0078.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr", lpFilePart=0x0) returned 0x47 [0078.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\", lpFilePart=0x0) returned 0x48 [0078.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ecab0a0, ftCreationTime.dwHighDateTime=0x1d5e6f5, ftLastAccessTime.dwLowDateTime=0x85863c80, ftLastAccessTime.dwHighDateTime=0x1d5e502, ftLastWriteTime.dwLowDateTime=0x85863c80, ftLastWriteTime.dwHighDateTime=0x1d5e502, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0078.613] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ecab0a0, ftCreationTime.dwHighDateTime=0x1d5e6f5, ftLastAccessTime.dwLowDateTime=0x85863c80, ftLastAccessTime.dwHighDateTime=0x1d5e502, ftLastWriteTime.dwLowDateTime=0x85863c80, ftLastWriteTime.dwHighDateTime=0x1d5e502, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.614] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb07e910, ftCreationTime.dwHighDateTime=0x1d5e4e1, ftLastAccessTime.dwLowDateTime=0x6faacfe0, ftLastAccessTime.dwHighDateTime=0x1d5e23f, ftLastWriteTime.dwLowDateTime=0x6faacfe0, ftLastWriteTime.dwHighDateTime=0x1d5e23f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="0qhoA10oXPny-cO.ods", cAlternateFileName="0QHOA1~1.ODS")) returned 1 [0078.614] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b52e30, ftCreationTime.dwHighDateTime=0x1d5df38, ftLastAccessTime.dwLowDateTime=0x19963cb0, ftLastAccessTime.dwHighDateTime=0x1d5d84f, ftLastWriteTime.dwLowDateTime=0x19963cb0, ftLastWriteTime.dwHighDateTime=0x1d5d84f, nFileSizeHigh=0x0, nFileSizeLow=0xffb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="5N_T.xlsx", cAlternateFileName="5N_T~1.XLS")) returned 1 [0078.614] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9505c9f0, ftCreationTime.dwHighDateTime=0x1d5e19c, ftLastAccessTime.dwLowDateTime=0xd9e83180, ftLastAccessTime.dwHighDateTime=0x1d5e0ab, ftLastWriteTime.dwLowDateTime=0xd9e83180, ftLastWriteTime.dwHighDateTime=0x1d5e0ab, nFileSizeHigh=0x0, nFileSizeLow=0xc315, dwReserved0=0x0, dwReserved1=0x0, cFileName="faUIAZbN7x.ots", cAlternateFileName="FAUIAZ~1.OTS")) returned 1 [0078.614] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60666930, ftCreationTime.dwHighDateTime=0x1d5ddae, ftLastAccessTime.dwLowDateTime=0xbdb3d270, ftLastAccessTime.dwHighDateTime=0x1d5d7ec, ftLastWriteTime.dwLowDateTime=0xbdb3d270, ftLastWriteTime.dwHighDateTime=0x1d5d7ec, nFileSizeHigh=0x0, nFileSizeLow=0xfbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="fjBqrB1 YiTvHd9.pptx", cAlternateFileName="FJBQRB~1.PPT")) returned 1 [0078.614] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615154a0, ftCreationTime.dwHighDateTime=0x1d5e5e1, ftLastAccessTime.dwLowDateTime=0x9dad3f40, ftLastAccessTime.dwHighDateTime=0x1d5dddf, ftLastWriteTime.dwLowDateTime=0x9dad3f40, ftLastWriteTime.dwHighDateTime=0x1d5dddf, nFileSizeHigh=0x0, nFileSizeLow=0x49c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRKCnyt.csv", cAlternateFileName="")) returned 1 [0078.614] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b8b9fe0, ftCreationTime.dwHighDateTime=0x1d5e4d9, ftLastAccessTime.dwLowDateTime=0x3defd700, ftLastAccessTime.dwHighDateTime=0x1d5e73c, ftLastWriteTime.dwLowDateTime=0x3defd700, ftLastWriteTime.dwHighDateTime=0x1d5e73c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQ1e0oCfshs9kdmuJ", cAlternateFileName="KQ1E0O~1")) returned 1 [0078.615] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.615] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0078.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0078.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0078.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", lpFilePart=0x0) returned 0x5b [0078.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\0qhoa10oxpny-co.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.615] GetFileType (hFile=0x2b8) returned 0x1 [0078.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.615] GetFileType (hFile=0x2b8) returned 0x1 [0078.615] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0xdbe9 [0078.615] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=56287, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0xdbdf [0078.615] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c6ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x28c6ea8*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.616] CloseHandle (hObject=0x2b8) returned 1 [0078.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0078.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", lpFilePart=0x0) returned 0x5b [0078.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.632] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\0qhoa10oxpny-co.ods"), fInfoLevelId=0x0, lpFileInformation=0x26c8440 | out: lpFileInformation=0x26c8440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb07e910, ftCreationTime.dwHighDateTime=0x1d5e4e1, ftLastAccessTime.dwLowDateTime=0x6faacfe0, ftLastAccessTime.dwHighDateTime=0x1d5e23f, ftLastWriteTime.dwLowDateTime=0x6faacfe0, ftLastWriteTime.dwHighDateTime=0x1d5e23f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe9)) returned 1 [0078.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", lpFilePart=0x0) returned 0x5b [0078.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\0qhoa10oxpny-co.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.632] GetFileType (hFile=0x2b8) returned 0x1 [0078.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.632] GetFileType (hFile=0x2b8) returned 0x1 [0078.632] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0xdbe9 [0078.632] ReadFile (in: hFile=0x2b8, lpBuffer=0x26c8758, nNumberOfBytesToRead=0xdbe9, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x26c8758*, lpNumberOfBytesRead=0x1c9ae9f8*=0xdbe9, lpOverlapped=0x0) returned 1 [0078.633] CloseHandle (hObject=0x2b8) returned 1 [0078.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", lpFilePart=0x0) returned 0x5b [0078.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\0qhoa10oxpny-co.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.667] GetFileType (hFile=0x2b8) returned 0x1 [0078.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.667] GetFileType (hFile=0x2b8) returned 0x1 [0078.667] WriteFile (in: hFile=0x2b8, lpBuffer=0x2768720*, nNumberOfBytesToWrite=0xdbf0, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x2768720*, lpNumberOfBytesWritten=0x1c9aea88*=0xdbf0, lpOverlapped=0x0) returned 1 [0078.669] CloseHandle (hObject=0x2b8) returned 1 [0078.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", lpFilePart=0x0) returned 0x5b [0078.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", lpFilePart=0x0) returned 0x5b [0078.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\0qhoa10oxpny-co.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.670] GetFileType (hFile=0x2b8) returned 0x1 [0078.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.670] GetFileType (hFile=0x2b8) returned 0x1 [0078.670] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0xdbf0 [0078.670] WriteFile (in: hFile=0x2b8, lpBuffer=0x2777388*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x2777388*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.670] CloseHandle (hObject=0x2b8) returned 1 [0078.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods", lpFilePart=0x0) returned 0x5b [0078.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\MHFob0ExMG9YUG55LWNPLm9kcw==", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\MHFob0ExMG9YUG55LWNPLm9kcw==", lpFilePart=0x0) returned 0x64 [0078.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\0qhoa10oxpny-co.ods"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb07e910, ftCreationTime.dwHighDateTime=0x1d5e4e1, ftLastAccessTime.dwLowDateTime=0x6faacfe0, ftLastAccessTime.dwHighDateTime=0x1d5e23f, ftLastWriteTime.dwLowDateTime=0xd69cce00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xdbfa)) returned 1 [0078.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.670] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\0qhoA10oXPny-cO.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\0qhoa10oxpny-co.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\MHFob0ExMG9YUG55LWNPLm9kcw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\mhfob0exmg9yug55lwnplm9kcw==")) returned 1 [0078.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", lpFilePart=0x0) returned 0x51 [0078.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\5n_t.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.671] GetFileType (hFile=0x2b8) returned 0x1 [0078.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.671] GetFileType (hFile=0x2b8) returned 0x1 [0078.671] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0xffb8 [0078.671] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=65454, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0xffae [0078.671] ReadFile (in: hFile=0x2b8, lpBuffer=0x2778828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x2778828*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.672] CloseHandle (hObject=0x2b8) returned 1 [0078.672] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0078.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", lpFilePart=0x0) returned 0x51 [0078.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.678] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\5n_t.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x27e5398 | out: lpFileInformation=0x27e5398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b52e30, ftCreationTime.dwHighDateTime=0x1d5df38, ftLastAccessTime.dwLowDateTime=0x19963cb0, ftLastAccessTime.dwHighDateTime=0x1d5d84f, ftLastWriteTime.dwLowDateTime=0x19963cb0, ftLastWriteTime.dwHighDateTime=0x1d5d84f, nFileSizeHigh=0x0, nFileSizeLow=0xffb8)) returned 1 [0078.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", lpFilePart=0x0) returned 0x51 [0078.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\5n_t.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.678] GetFileType (hFile=0x2b8) returned 0x1 [0078.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.678] GetFileType (hFile=0x2b8) returned 0x1 [0078.678] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0xffb8 [0078.678] ReadFile (in: hFile=0x2b8, lpBuffer=0x27e5670, nNumberOfBytesToRead=0xffb8, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x27e5670*, lpNumberOfBytesRead=0x1c9ae9f8*=0xffb8, lpOverlapped=0x0) returned 1 [0078.679] CloseHandle (hObject=0x2b8) returned 1 [0078.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", lpFilePart=0x0) returned 0x51 [0078.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\5n_t.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.692] GetFileType (hFile=0x2b8) returned 0x1 [0078.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.692] GetFileType (hFile=0x2b8) returned 0x1 [0078.692] WriteFile (in: hFile=0x2b8, lpBuffer=0x288bf08*, nNumberOfBytesToWrite=0xffc0, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x288bf08*, lpNumberOfBytesWritten=0x1c9aea88*=0xffc0, lpOverlapped=0x0) returned 1 [0078.694] CloseHandle (hObject=0x2b8) returned 1 [0078.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", lpFilePart=0x0) returned 0x51 [0078.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", lpFilePart=0x0) returned 0x51 [0078.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\5n_t.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.694] GetFileType (hFile=0x2b8) returned 0x1 [0078.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.694] GetFileType (hFile=0x2b8) returned 0x1 [0078.694] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0xffc0 [0078.694] WriteFile (in: hFile=0x2b8, lpBuffer=0x289cea8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x289cea8*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.695] CloseHandle (hObject=0x2b8) returned 1 [0078.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx", lpFilePart=0x0) returned 0x51 [0078.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\NU5fVC54bHN4", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\NU5fVC54bHN4", lpFilePart=0x0) returned 0x54 [0078.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\5n_t.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b52e30, ftCreationTime.dwHighDateTime=0x1d5df38, ftLastAccessTime.dwLowDateTime=0x19963cb0, ftLastAccessTime.dwHighDateTime=0x1d5d84f, ftLastWriteTime.dwLowDateTime=0xd69f2f60, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xffca)) returned 1 [0078.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.695] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\5N_T.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\5n_t.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\NU5fVC54bHN4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\nu5fvc54bhn4")) returned 1 [0078.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", lpFilePart=0x0) returned 0x56 [0078.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fauiazbn7x.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.696] GetFileType (hFile=0x2b8) returned 0x1 [0078.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.696] GetFileType (hFile=0x2b8) returned 0x1 [0078.696] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0xc315 [0078.696] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=49931, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0xc30b [0078.696] ReadFile (in: hFile=0x2b8, lpBuffer=0x289e308, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x289e308*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.697] CloseHandle (hObject=0x2b8) returned 1 [0078.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0078.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", lpFilePart=0x0) returned 0x56 [0078.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fauiazbn7x.ots"), fInfoLevelId=0x0, lpFileInformation=0x2728110 | out: lpFileInformation=0x2728110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9505c9f0, ftCreationTime.dwHighDateTime=0x1d5e19c, ftLastAccessTime.dwLowDateTime=0xd9e83180, ftLastAccessTime.dwHighDateTime=0x1d5e0ab, ftLastWriteTime.dwLowDateTime=0xd9e83180, ftLastWriteTime.dwHighDateTime=0x1d5e0ab, nFileSizeHigh=0x0, nFileSizeLow=0xc315)) returned 1 [0078.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", lpFilePart=0x0) returned 0x56 [0078.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fauiazbn7x.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.719] GetFileType (hFile=0x2b8) returned 0x1 [0078.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.719] GetFileType (hFile=0x2b8) returned 0x1 [0078.719] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0xc315 [0078.719] ReadFile (in: hFile=0x2b8, lpBuffer=0x2728408, nNumberOfBytesToRead=0xc315, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2728408*, lpNumberOfBytesRead=0x1c9ae9f8*=0xc315, lpOverlapped=0x0) returned 1 [0078.720] CloseHandle (hObject=0x2b8) returned 1 [0078.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", lpFilePart=0x0) returned 0x56 [0078.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fauiazbn7x.ots"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.760] GetFileType (hFile=0x2b8) returned 0x1 [0078.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.760] GetFileType (hFile=0x2b8) returned 0x1 [0078.760] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c3b58*, nNumberOfBytesToWrite=0xc320, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x27c3b58*, lpNumberOfBytesWritten=0x1c9aea88*=0xc320, lpOverlapped=0x0) returned 1 [0078.762] CloseHandle (hObject=0x2b8) returned 1 [0078.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", lpFilePart=0x0) returned 0x56 [0078.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", lpFilePart=0x0) returned 0x56 [0078.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fauiazbn7x.ots"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.763] GetFileType (hFile=0x2b8) returned 0x1 [0078.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.763] GetFileType (hFile=0x2b8) returned 0x1 [0078.763] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0xc320 [0078.763] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d0ea0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x27d0ea0*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.763] CloseHandle (hObject=0x2b8) returned 1 [0078.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots", lpFilePart=0x0) returned 0x56 [0078.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\ZmFVSUFaYk43eC5vdHM=", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\ZmFVSUFaYk43eC5vdHM=", lpFilePart=0x0) returned 0x5c [0078.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.763] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fauiazbn7x.ots"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9505c9f0, ftCreationTime.dwHighDateTime=0x1d5e19c, ftLastAccessTime.dwLowDateTime=0xd9e83180, ftLastAccessTime.dwHighDateTime=0x1d5e0ab, ftLastWriteTime.dwLowDateTime=0xd6ab1640, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xc32a)) returned 1 [0078.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.763] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\faUIAZbN7x.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fauiazbn7x.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\ZmFVSUFaYk43eC5vdHM=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\zmfvsufayk43ec5vdhm=")) returned 1 [0078.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", lpFilePart=0x0) returned 0x5c [0078.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fjbqrb1 yitvhd9.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.764] GetFileType (hFile=0x2b8) returned 0x1 [0078.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.764] GetFileType (hFile=0x2b8) returned 0x1 [0078.764] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0xfbf3 [0078.764] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=64489, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0xfbe9 [0078.764] ReadFile (in: hFile=0x2b8, lpBuffer=0x27d2348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x27d2348*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.765] CloseHandle (hObject=0x2b8) returned 1 [0078.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0078.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", lpFilePart=0x0) returned 0x5c [0078.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fjbqrb1 yitvhd9.pptx"), fInfoLevelId=0x0, lpFileInformation=0x283eeb8 | out: lpFileInformation=0x283eeb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60666930, ftCreationTime.dwHighDateTime=0x1d5ddae, ftLastAccessTime.dwLowDateTime=0xbdb3d270, ftLastAccessTime.dwHighDateTime=0x1d5d7ec, ftLastWriteTime.dwLowDateTime=0xbdb3d270, ftLastWriteTime.dwHighDateTime=0x1d5d7ec, nFileSizeHigh=0x0, nFileSizeLow=0xfbf3)) returned 1 [0078.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", lpFilePart=0x0) returned 0x5c [0078.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.768] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fjbqrb1 yitvhd9.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.768] GetFileType (hFile=0x2b8) returned 0x1 [0078.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.768] GetFileType (hFile=0x2b8) returned 0x1 [0078.768] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0xfbf3 [0078.768] ReadFile (in: hFile=0x2b8, lpBuffer=0x283f1f0, nNumberOfBytesToRead=0xfbf3, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x283f1f0*, lpNumberOfBytesRead=0x1c9ae9f8*=0xfbf3, lpOverlapped=0x0) returned 1 [0078.768] CloseHandle (hObject=0x2b8) returned 1 [0078.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", lpFilePart=0x0) returned 0x5c [0078.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fjbqrb1 yitvhd9.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.796] GetFileType (hFile=0x2b8) returned 0x1 [0078.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.797] GetFileType (hFile=0x2b8) returned 0x1 [0078.797] WriteFile (in: hFile=0x2b8, lpBuffer=0x270d478*, nNumberOfBytesToWrite=0xfc00, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x270d478*, lpNumberOfBytesWritten=0x1c9aea88*=0xfc00, lpOverlapped=0x0) returned 1 [0078.798] CloseHandle (hObject=0x2b8) returned 1 [0078.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", lpFilePart=0x0) returned 0x5c [0078.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", lpFilePart=0x0) returned 0x5c [0078.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fjbqrb1 yitvhd9.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.799] GetFileType (hFile=0x2b8) returned 0x1 [0078.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.799] GetFileType (hFile=0x2b8) returned 0x1 [0078.800] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0xfc00 [0078.800] WriteFile (in: hFile=0x2b8, lpBuffer=0x271e128*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x271e128*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.800] CloseHandle (hObject=0x2b8) returned 1 [0078.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx", lpFilePart=0x0) returned 0x5c [0078.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\ZmpCcXJCMSBZaVR2SGQ5LnBwdHg=", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\ZmpCcXJCMSBZaVR2SGQ5LnBwdHg=", lpFilePart=0x0) returned 0x64 [0078.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fjbqrb1 yitvhd9.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60666930, ftCreationTime.dwHighDateTime=0x1d5ddae, ftLastAccessTime.dwLowDateTime=0xbdb3d270, ftLastAccessTime.dwHighDateTime=0x1d5d7ec, ftLastWriteTime.dwLowDateTime=0xd6afd900, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xfc0a)) returned 1 [0078.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.800] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\fjBqrB1 YiTvHd9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\fjbqrb1 yitvhd9.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\ZmpCcXJCMSBZaVR2SGQ5LnBwdHg=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\zmpccxjcmsbzavr2sgq5lnbwdhg=")) returned 1 [0078.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", lpFilePart=0x0) returned 0x53 [0078.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0078.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\grkcnyt.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.801] GetFileType (hFile=0x2b8) returned 0x1 [0078.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0078.801] GetFileType (hFile=0x2b8) returned 0x1 [0078.801] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x49c5 [0078.801] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=18875, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x49bb [0078.801] ReadFile (in: hFile=0x2b8, lpBuffer=0x271f5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x271f5d0*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0078.802] CloseHandle (hObject=0x2b8) returned 1 [0078.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0078.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", lpFilePart=0x0) returned 0x53 [0078.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.808] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\grkcnyt.csv"), fInfoLevelId=0x0, lpFileInformation=0x278c100 | out: lpFileInformation=0x278c100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615154a0, ftCreationTime.dwHighDateTime=0x1d5e5e1, ftLastAccessTime.dwLowDateTime=0x9dad3f40, ftLastAccessTime.dwHighDateTime=0x1d5dddf, ftLastWriteTime.dwLowDateTime=0x9dad3f40, ftLastWriteTime.dwHighDateTime=0x1d5dddf, nFileSizeHigh=0x0, nFileSizeLow=0x49c5)) returned 1 [0078.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0078.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", lpFilePart=0x0) returned 0x53 [0078.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0078.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\grkcnyt.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.808] GetFileType (hFile=0x2b8) returned 0x1 [0078.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0078.810] GetFileType (hFile=0x2b8) returned 0x1 [0078.810] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x49c5 [0078.810] ReadFile (in: hFile=0x2b8, lpBuffer=0x278c3d8, nNumberOfBytesToRead=0x49c5, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x278c3d8*, lpNumberOfBytesRead=0x1c9ae9f8*=0x49c5, lpOverlapped=0x0) returned 1 [0078.810] CloseHandle (hObject=0x2b8) returned 1 [0078.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", lpFilePart=0x0) returned 0x53 [0078.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\grkcnyt.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.843] GetFileType (hFile=0x2b8) returned 0x1 [0078.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.843] GetFileType (hFile=0x2b8) returned 0x1 [0078.843] WriteFile (in: hFile=0x2b8, lpBuffer=0x281a0d8*, nNumberOfBytesToWrite=0x49d0, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x281a0d8*, lpNumberOfBytesWritten=0x1c9aea88*=0x49d0, lpOverlapped=0x0) returned 1 [0078.844] CloseHandle (hObject=0x2b8) returned 1 [0078.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", lpFilePart=0x0) returned 0x53 [0078.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", lpFilePart=0x0) returned 0x53 [0078.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0078.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\grkcnyt.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.844] GetFileType (hFile=0x2b8) returned 0x1 [0078.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0078.844] GetFileType (hFile=0x2b8) returned 0x1 [0078.844] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x49d0 [0078.845] WriteFile (in: hFile=0x2b8, lpBuffer=0x281fa90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x281fa90*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0078.845] CloseHandle (hObject=0x2b8) returned 1 [0078.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv", lpFilePart=0x0) returned 0x53 [0078.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\R1JLQ255dC5jc3Y=", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\R1JLQ255dC5jc3Y=", lpFilePart=0x0) returned 0x58 [0078.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0078.845] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\grkcnyt.csv"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615154a0, ftCreationTime.dwHighDateTime=0x1d5e5e1, ftLastAccessTime.dwLowDateTime=0x9dad3f40, ftLastAccessTime.dwHighDateTime=0x1d5dddf, ftLastWriteTime.dwLowDateTime=0xd6b6fd20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x49da)) returned 1 [0078.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0078.845] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\GRKCnyt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\grkcnyt.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\R1JLQ255dC5jc3Y=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\r1jlq255dc5jc3y=")) returned 1 [0078.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ", nBufferLength=0x105, lpBuffer=0x1c9ae560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ", lpFilePart=0x0) returned 0x59 [0078.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\", lpFilePart=0x0) returned 0x5a [0078.846] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\*", lpFindFileData=0x1c9ae710 | out: lpFindFileData=0x1c9ae710*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b8b9fe0, ftCreationTime.dwHighDateTime=0x1d5e4d9, ftLastAccessTime.dwLowDateTime=0x3defd700, ftLastAccessTime.dwHighDateTime=0x1d5e73c, ftLastWriteTime.dwLowDateTime=0x3defd700, ftLastWriteTime.dwHighDateTime=0x1d5e73c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0078.846] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b8b9fe0, ftCreationTime.dwHighDateTime=0x1d5e4d9, ftLastAccessTime.dwLowDateTime=0x3defd700, ftLastAccessTime.dwHighDateTime=0x1d5e73c, ftLastWriteTime.dwLowDateTime=0x3defd700, ftLastWriteTime.dwHighDateTime=0x1d5e73c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.846] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9122370, ftCreationTime.dwHighDateTime=0x1d5d89a, ftLastAccessTime.dwLowDateTime=0xf15e1ae0, ftLastAccessTime.dwHighDateTime=0x1d5d913, ftLastWriteTime.dwLowDateTime=0xf15e1ae0, ftLastWriteTime.dwHighDateTime=0x1d5d913, nFileSizeHigh=0x0, nFileSizeLow=0x7d5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2WX21W1Fv2qeREFFV0.csv", cAlternateFileName="2WX21W~1.CSV")) returned 1 [0078.846] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89de4a80, ftCreationTime.dwHighDateTime=0x1d5def8, ftLastAccessTime.dwLowDateTime=0xc40aca0, ftLastAccessTime.dwHighDateTime=0x1d5e0c2, ftLastWriteTime.dwLowDateTime=0xc40aca0, ftLastWriteTime.dwHighDateTime=0x1d5e0c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4u79I0cYc3-Qd", cAlternateFileName="4U79I0~1")) returned 1 [0078.846] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2702aa0, ftCreationTime.dwHighDateTime=0x1d5e808, ftLastAccessTime.dwLowDateTime=0x3884f330, ftLastAccessTime.dwHighDateTime=0x1d5df81, ftLastWriteTime.dwLowDateTime=0x3884f330, ftLastWriteTime.dwHighDateTime=0x1d5df81, nFileSizeHigh=0x0, nFileSizeLow=0x304b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BKSYieZ1QK8.xls", cAlternateFileName="BKSYIE~1.XLS")) returned 1 [0078.847] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae072c00, ftCreationTime.dwHighDateTime=0x1d5d959, ftLastAccessTime.dwLowDateTime=0x31d9f4c0, ftLastAccessTime.dwHighDateTime=0x1d5e00a, ftLastWriteTime.dwLowDateTime=0x31d9f4c0, ftLastWriteTime.dwHighDateTime=0x1d5e00a, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KKj3Kj2D.xlsx", cAlternateFileName="KKJ3KJ~1.XLS")) returned 1 [0078.847] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d4b340, ftCreationTime.dwHighDateTime=0x1d5dada, ftLastAccessTime.dwLowDateTime=0x59062e60, ftLastAccessTime.dwHighDateTime=0x1d5d7fe, ftLastWriteTime.dwLowDateTime=0x59062e60, ftLastWriteTime.dwHighDateTime=0x1d5d7fe, nFileSizeHigh=0x0, nFileSizeLow=0x43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="RiIE_4xWUTul.pptx", cAlternateFileName="RIIE_4~1.PPT")) returned 1 [0078.847] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.847] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0078.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9c0) returned 1 [0078.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0078.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0078.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ", nBufferLength=0x105, lpBuffer=0x1c9ae560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ", lpFilePart=0x0) returned 0x59 [0078.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\", nBufferLength=0x105, lpBuffer=0x1c9ae500, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\", lpFilePart=0x0) returned 0x5a [0078.847] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\*", lpFindFileData=0x1c9ae710 | out: lpFindFileData=0x1c9ae710*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b8b9fe0, ftCreationTime.dwHighDateTime=0x1d5e4d9, ftLastAccessTime.dwLowDateTime=0x3defd700, ftLastAccessTime.dwHighDateTime=0x1d5e73c, ftLastWriteTime.dwLowDateTime=0x3defd700, ftLastWriteTime.dwHighDateTime=0x1d5e73c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0078.848] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b8b9fe0, ftCreationTime.dwHighDateTime=0x1d5e4d9, ftLastAccessTime.dwLowDateTime=0x3defd700, ftLastAccessTime.dwHighDateTime=0x1d5e73c, ftLastWriteTime.dwLowDateTime=0x3defd700, ftLastWriteTime.dwHighDateTime=0x1d5e73c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.848] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9122370, ftCreationTime.dwHighDateTime=0x1d5d89a, ftLastAccessTime.dwLowDateTime=0xf15e1ae0, ftLastAccessTime.dwHighDateTime=0x1d5d913, ftLastWriteTime.dwLowDateTime=0xf15e1ae0, ftLastWriteTime.dwHighDateTime=0x1d5d913, nFileSizeHigh=0x0, nFileSizeLow=0x7d5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2WX21W1Fv2qeREFFV0.csv", cAlternateFileName="2WX21W~1.CSV")) returned 1 [0078.848] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89de4a80, ftCreationTime.dwHighDateTime=0x1d5def8, ftLastAccessTime.dwLowDateTime=0xc40aca0, ftLastAccessTime.dwHighDateTime=0x1d5e0c2, ftLastWriteTime.dwLowDateTime=0xc40aca0, ftLastWriteTime.dwHighDateTime=0x1d5e0c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4u79I0cYc3-Qd", cAlternateFileName="4U79I0~1")) returned 1 [0078.848] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2702aa0, ftCreationTime.dwHighDateTime=0x1d5e808, ftLastAccessTime.dwLowDateTime=0x3884f330, ftLastAccessTime.dwHighDateTime=0x1d5df81, ftLastWriteTime.dwLowDateTime=0x3884f330, ftLastWriteTime.dwHighDateTime=0x1d5df81, nFileSizeHigh=0x0, nFileSizeLow=0x304b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BKSYieZ1QK8.xls", cAlternateFileName="BKSYIE~1.XLS")) returned 1 [0078.848] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae072c00, ftCreationTime.dwHighDateTime=0x1d5d959, ftLastAccessTime.dwLowDateTime=0x31d9f4c0, ftLastAccessTime.dwHighDateTime=0x1d5e00a, ftLastWriteTime.dwLowDateTime=0x31d9f4c0, ftLastWriteTime.dwHighDateTime=0x1d5e00a, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KKj3Kj2D.xlsx", cAlternateFileName="KKJ3KJ~1.XLS")) returned 1 [0078.848] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d4b340, ftCreationTime.dwHighDateTime=0x1d5dada, ftLastAccessTime.dwLowDateTime=0x59062e60, ftLastAccessTime.dwHighDateTime=0x1d5d7fe, ftLastWriteTime.dwLowDateTime=0x59062e60, ftLastWriteTime.dwHighDateTime=0x1d5d7fe, nFileSizeHigh=0x0, nFileSizeLow=0x43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="RiIE_4xWUTul.pptx", cAlternateFileName="RIIE_4~1.PPT")) returned 1 [0078.849] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae760 | out: lpFindFileData=0x1c9ae760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d4b340, ftCreationTime.dwHighDateTime=0x1d5dada, ftLastAccessTime.dwLowDateTime=0x59062e60, ftLastAccessTime.dwHighDateTime=0x1d5d7fe, ftLastWriteTime.dwLowDateTime=0x59062e60, ftLastWriteTime.dwHighDateTime=0x1d5d7fe, nFileSizeHigh=0x0, nFileSizeLow=0x43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="RiIE_4xWUTul.pptx", cAlternateFileName="RIIE_4~1.PPT")) returned 0 [0078.849] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0078.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9c0) returned 1 [0078.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0078.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", lpFilePart=0x0) returned 0x70 [0078.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9c0) returned 1 [0078.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\2wx21w1fv2qereffv0.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.849] GetFileType (hFile=0x2b8) returned 0x1 [0078.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae930) returned 1 [0078.849] GetFileType (hFile=0x2b8) returned 0x1 [0078.849] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb88 | out: lpFileSizeHigh=0x1c9aeb88*=0x0) returned 0x7d5b [0078.849] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=32081, lpDistanceToMoveHigh=0x1c9aeae8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeae8*=0) returned 0x7d51 [0078.849] ReadFile (in: hFile=0x2b8, lpBuffer=0x2825230, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeab8, lpOverlapped=0x0 | out: lpBuffer=0x2825230*, lpNumberOfBytesRead=0x1c9aeab8*=0xa, lpOverlapped=0x0) returned 1 [0078.850] CloseHandle (hObject=0x2b8) returned 1 [0078.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9ae9e0 | out: SystemInformation=0x12641930, ResultLength=0x1c9ae9e0*=0x11b98) returned 0x0 [0078.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", lpFilePart=0x0) returned 0x70 [0078.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0078.857] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\2wx21w1fv2qereffv0.csv"), fInfoLevelId=0x0, lpFileInformation=0x2891da0 | out: lpFileInformation=0x2891da0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9122370, ftCreationTime.dwHighDateTime=0x1d5d89a, ftLastAccessTime.dwLowDateTime=0xf15e1ae0, ftLastAccessTime.dwHighDateTime=0x1d5d913, ftLastWriteTime.dwLowDateTime=0xf15e1ae0, ftLastWriteTime.dwHighDateTime=0x1d5d913, nFileSizeHigh=0x0, nFileSizeLow=0x7d5b)) returned 1 [0078.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae990) returned 1 [0078.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", nBufferLength=0x105, lpBuffer=0x1c9ae3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", lpFilePart=0x0) returned 0x70 [0078.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae890) returned 1 [0078.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\2wx21w1fv2qereffv0.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.857] GetFileType (hFile=0x2b8) returned 0x1 [0078.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae800) returned 1 [0078.857] GetFileType (hFile=0x2b8) returned 0x1 [0078.857] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aea28 | out: lpFileSizeHigh=0x1c9aea28*=0x0) returned 0x7d5b [0078.857] ReadFile (in: hFile=0x2b8, lpBuffer=0x2892128, nNumberOfBytesToRead=0x7d5b, lpNumberOfBytesRead=0x1c9ae958, lpOverlapped=0x0 | out: lpBuffer=0x2892128*, lpNumberOfBytesRead=0x1c9ae958*=0x7d5b, lpOverlapped=0x0) returned 1 [0078.858] CloseHandle (hObject=0x2b8) returned 1 [0078.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", nBufferLength=0x105, lpBuffer=0x1c9ae3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", lpFilePart=0x0) returned 0x70 [0078.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae8c0) returned 1 [0078.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\2wx21w1fv2qereffv0.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.874] GetFileType (hFile=0x2b8) returned 0x1 [0078.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae830) returned 1 [0078.874] GetFileType (hFile=0x2b8) returned 0x1 [0078.874] WriteFile (in: hFile=0x2b8, lpBuffer=0x292fd60*, nNumberOfBytesToWrite=0x7d60, lpNumberOfBytesWritten=0x1c9ae9e8, lpOverlapped=0x0 | out: lpBuffer=0x292fd60*, lpNumberOfBytesWritten=0x1c9ae9e8*=0x7d60, lpOverlapped=0x0) returned 1 [0078.875] CloseHandle (hObject=0x2b8) returned 1 [0078.875] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", lpFilePart=0x0) returned 0x70 [0078.875] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", lpFilePart=0x0) returned 0x70 [0078.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\2wx21w1fv2qereffv0.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.876] GetFileType (hFile=0x2b8) returned 0x1 [0078.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.876] GetFileType (hFile=0x2b8) returned 0x1 [0078.876] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae948*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae948*=0) returned 0x7d60 [0078.876] WriteFile (in: hFile=0x2b8, lpBuffer=0x2938c40*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aea08, lpOverlapped=0x0 | out: lpBuffer=0x2938c40*, lpNumberOfBytesWritten=0x1c9aea08*=0xa, lpOverlapped=0x0) returned 1 [0078.876] CloseHandle (hObject=0x2b8) returned 1 [0078.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", nBufferLength=0x105, lpBuffer=0x1c9ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv", lpFilePart=0x0) returned 0x70 [0078.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\MldYMjFXMUZ2MnFlUkVGRlYwLmNzdg==", nBufferLength=0x105, lpBuffer=0x1c9ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\MldYMjFXMUZ2MnFlUkVGRlYwLmNzdg==", lpFilePart=0x0) returned 0x7a [0078.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae990) returned 1 [0078.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\2wx21w1fv2qereffv0.csv"), fInfoLevelId=0x0, lpFileInformation=0x1c9aea70 | out: lpFileInformation=0x1c9aea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9122370, ftCreationTime.dwHighDateTime=0x1d5d89a, ftLastAccessTime.dwLowDateTime=0xf15e1ae0, ftLastAccessTime.dwHighDateTime=0x1d5d913, ftLastWriteTime.dwLowDateTime=0xd6bbbfe0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x7d6a)) returned 1 [0078.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0078.876] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\2WX21W1Fv2qeREFFV0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\2wx21w1fv2qereffv0.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\MldYMjFXMUZ2MnFlUkVGRlYwLmNzdg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\mldymjfxmuz2mnflukvgrlywlmnzdg==")) returned 1 [0078.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", lpFilePart=0x0) returned 0x69 [0078.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9c0) returned 1 [0078.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\bksyiez1qk8.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.877] GetFileType (hFile=0x2b8) returned 0x1 [0078.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae930) returned 1 [0078.877] GetFileType (hFile=0x2b8) returned 0x1 [0078.877] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb88 | out: lpFileSizeHigh=0x1c9aeb88*=0x0) returned 0x304b [0078.877] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=12353, lpDistanceToMoveHigh=0x1c9aeae8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeae8*=0) returned 0x3041 [0078.877] ReadFile (in: hFile=0x2b8, lpBuffer=0x293a198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeab8, lpOverlapped=0x0 | out: lpBuffer=0x293a198*, lpNumberOfBytesRead=0x1c9aeab8*=0xa, lpOverlapped=0x0) returned 1 [0078.878] CloseHandle (hObject=0x2b8) returned 1 [0078.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9ae9e0 | out: SystemInformation=0x12641930, ResultLength=0x1c9ae9e0*=0x11b98) returned 0x0 [0078.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", lpFilePart=0x0) returned 0x69 [0078.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0078.912] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\bksyiez1qk8.xls"), fInfoLevelId=0x0, lpFileInformation=0x2732f20 | out: lpFileInformation=0x2732f20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2702aa0, ftCreationTime.dwHighDateTime=0x1d5e808, ftLastAccessTime.dwLowDateTime=0x3884f330, ftLastAccessTime.dwHighDateTime=0x1d5df81, ftLastWriteTime.dwLowDateTime=0x3884f330, ftLastWriteTime.dwHighDateTime=0x1d5df81, nFileSizeHigh=0x0, nFileSizeLow=0x304b)) returned 1 [0078.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae990) returned 1 [0078.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", nBufferLength=0x105, lpBuffer=0x1c9ae3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", lpFilePart=0x0) returned 0x69 [0078.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae890) returned 1 [0078.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\bksyiez1qk8.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.912] GetFileType (hFile=0x2b8) returned 0x1 [0078.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae800) returned 1 [0078.912] GetFileType (hFile=0x2b8) returned 0x1 [0078.912] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aea28 | out: lpFileSizeHigh=0x1c9aea28*=0x0) returned 0x304b [0078.912] ReadFile (in: hFile=0x2b8, lpBuffer=0x2733268, nNumberOfBytesToRead=0x304b, lpNumberOfBytesRead=0x1c9ae958, lpOverlapped=0x0 | out: lpBuffer=0x2733268*, lpNumberOfBytesRead=0x1c9ae958*=0x304b, lpOverlapped=0x0) returned 1 [0078.913] CloseHandle (hObject=0x2b8) returned 1 [0078.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", nBufferLength=0x105, lpBuffer=0x1c9ae3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", lpFilePart=0x0) returned 0x69 [0078.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae8c0) returned 1 [0078.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\bksyiez1qk8.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.946] GetFileType (hFile=0x2b8) returned 0x1 [0078.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae830) returned 1 [0078.946] GetFileType (hFile=0x2b8) returned 0x1 [0078.946] WriteFile (in: hFile=0x2b8, lpBuffer=0x27b8fe8*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x1c9ae9e8, lpOverlapped=0x0 | out: lpBuffer=0x27b8fe8*, lpNumberOfBytesWritten=0x1c9ae9e8*=0x3050, lpOverlapped=0x0) returned 1 [0078.947] CloseHandle (hObject=0x2b8) returned 1 [0078.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", lpFilePart=0x0) returned 0x69 [0078.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", lpFilePart=0x0) returned 0x69 [0078.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0078.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\bksyiez1qk8.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0078.948] GetFileType (hFile=0x2b8) returned 0x1 [0078.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0078.948] GetFileType (hFile=0x2b8) returned 0x1 [0078.948] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae948*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae948*=0) returned 0x3050 [0078.948] WriteFile (in: hFile=0x2b8, lpBuffer=0x27bd128*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aea08, lpOverlapped=0x0 | out: lpBuffer=0x27bd128*, lpNumberOfBytesWritten=0x1c9aea08*=0xa, lpOverlapped=0x0) returned 1 [0078.948] CloseHandle (hObject=0x2b8) returned 1 [0078.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", nBufferLength=0x105, lpBuffer=0x1c9ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls", lpFilePart=0x0) returned 0x69 [0078.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\QktTWWllWjFRSzgueGxz", nBufferLength=0x105, lpBuffer=0x1c9ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\QktTWWllWjFRSzgueGxz", lpFilePart=0x0) returned 0x6e [0078.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae990) returned 1 [0078.948] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\bksyiez1qk8.xls"), fInfoLevelId=0x0, lpFileInformation=0x1c9aea70 | out: lpFileInformation=0x1c9aea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2702aa0, ftCreationTime.dwHighDateTime=0x1d5e808, ftLastAccessTime.dwLowDateTime=0x3884f330, ftLastAccessTime.dwHighDateTime=0x1d5df81, ftLastWriteTime.dwLowDateTime=0xd6c54560, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x305a)) returned 1 [0078.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0078.949] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\BKSYieZ1QK8.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\bksyiez1qk8.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\QktTWWllWjFRSzgueGxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\qkttwwllwjfrszguegxz")) returned 1 [0078.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", lpFilePart=0x0) returned 0x67 [0078.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9c0) returned 1 [0078.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\kkj3kj2d.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.033] GetFileType (hFile=0x2b8) returned 0x1 [0079.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae930) returned 1 [0079.033] GetFileType (hFile=0x2b8) returned 0x1 [0079.033] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb88 | out: lpFileSizeHigh=0x1c9aeb88*=0x0) returned 0x85d0 [0079.033] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=34246, lpDistanceToMoveHigh=0x1c9aeae8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeae8*=0) returned 0x85c6 [0079.033] ReadFile (in: hFile=0x2b8, lpBuffer=0x27be830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeab8, lpOverlapped=0x0 | out: lpBuffer=0x27be830*, lpNumberOfBytesRead=0x1c9aeab8*=0xa, lpOverlapped=0x0) returned 1 [0079.034] CloseHandle (hObject=0x2b8) returned 1 [0079.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9ae9e0 | out: SystemInformation=0x12641930, ResultLength=0x1c9ae9e0*=0x11b98) returned 0x0 [0079.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", lpFilePart=0x0) returned 0x67 [0079.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.035] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\kkj3kj2d.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x282b420 | out: lpFileInformation=0x282b420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae072c00, ftCreationTime.dwHighDateTime=0x1d5d959, ftLastAccessTime.dwLowDateTime=0x31d9f4c0, ftLastAccessTime.dwHighDateTime=0x1d5e00a, ftLastWriteTime.dwLowDateTime=0x31d9f4c0, ftLastWriteTime.dwHighDateTime=0x1d5e00a, nFileSizeHigh=0x0, nFileSizeLow=0x85d0)) returned 1 [0079.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae990) returned 1 [0079.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", lpFilePart=0x0) returned 0x67 [0079.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae890) returned 1 [0079.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\kkj3kj2d.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.036] GetFileType (hFile=0x2b8) returned 0x1 [0079.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae800) returned 1 [0079.036] GetFileType (hFile=0x2b8) returned 0x1 [0079.036] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aea28 | out: lpFileSizeHigh=0x1c9aea28*=0x0) returned 0x85d0 [0079.036] ReadFile (in: hFile=0x2b8, lpBuffer=0x282b758, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x1c9ae958, lpOverlapped=0x0 | out: lpBuffer=0x282b758*, lpNumberOfBytesRead=0x1c9ae958*=0x85d0, lpOverlapped=0x0) returned 1 [0079.036] CloseHandle (hObject=0x2b8) returned 1 [0079.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", lpFilePart=0x0) returned 0x67 [0079.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae8c0) returned 1 [0079.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\kkj3kj2d.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.048] GetFileType (hFile=0x2b8) returned 0x1 [0079.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae830) returned 1 [0079.048] GetFileType (hFile=0x2b8) returned 0x1 [0079.048] WriteFile (in: hFile=0x2b8, lpBuffer=0x28cbe08*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x1c9ae9e8, lpOverlapped=0x0 | out: lpBuffer=0x28cbe08*, lpNumberOfBytesWritten=0x1c9ae9e8*=0x85e0, lpOverlapped=0x0) returned 1 [0079.049] CloseHandle (hObject=0x2b8) returned 1 [0079.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", lpFilePart=0x0) returned 0x67 [0079.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", lpFilePart=0x0) returned 0x67 [0079.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0079.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\kkj3kj2d.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.050] GetFileType (hFile=0x2b8) returned 0x1 [0079.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0079.050] GetFileType (hFile=0x2b8) returned 0x1 [0079.050] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae948*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae948*=0) returned 0x85e0 [0079.050] WriteFile (in: hFile=0x2b8, lpBuffer=0x28d54b8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aea08, lpOverlapped=0x0 | out: lpBuffer=0x28d54b8*, lpNumberOfBytesWritten=0x1c9aea08*=0xa, lpOverlapped=0x0) returned 1 [0079.050] CloseHandle (hObject=0x2b8) returned 1 [0079.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx", lpFilePart=0x0) returned 0x67 [0079.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\S0tqM0tqMkQueGxzeA==", nBufferLength=0x105, lpBuffer=0x1c9ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\S0tqM0tqMkQueGxzeA==", lpFilePart=0x0) returned 0x6e [0079.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae990) returned 1 [0079.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\kkj3kj2d.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aea70 | out: lpFileInformation=0x1c9aea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae072c00, ftCreationTime.dwHighDateTime=0x1d5d959, ftLastAccessTime.dwLowDateTime=0x31d9f4c0, ftLastAccessTime.dwHighDateTime=0x1d5e00a, ftLastWriteTime.dwLowDateTime=0xd6d5ef00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x85ea)) returned 1 [0079.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0079.050] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\KKj3Kj2D.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\kkj3kj2d.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\S0tqM0tqMkQueGxzeA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\s0tqm0tqmkquegxzea==")) returned 1 [0079.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", lpFilePart=0x0) returned 0x6b [0079.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9c0) returned 1 [0079.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\riie_4xwutul.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.051] GetFileType (hFile=0x2b8) returned 0x1 [0079.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae930) returned 1 [0079.051] GetFileType (hFile=0x2b8) returned 0x1 [0079.051] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb88 | out: lpFileSizeHigh=0x1c9aeb88*=0x0) returned 0x43ca [0079.051] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=17344, lpDistanceToMoveHigh=0x1c9aeae8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeae8*=0) returned 0x43c0 [0079.051] ReadFile (in: hFile=0x2b8, lpBuffer=0x28d69d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeab8, lpOverlapped=0x0 | out: lpBuffer=0x28d69d0*, lpNumberOfBytesRead=0x1c9aeab8*=0xa, lpOverlapped=0x0) returned 1 [0079.052] CloseHandle (hObject=0x2b8) returned 1 [0079.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9ae9e0 | out: SystemInformation=0x12641930, ResultLength=0x1c9ae9e0*=0x11b98) returned 0x0 [0079.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", lpFilePart=0x0) returned 0x6b [0079.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.057] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\riie_4xwutul.pptx"), fInfoLevelId=0x0, lpFileInformation=0x27443a8 | out: lpFileInformation=0x27443a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d4b340, ftCreationTime.dwHighDateTime=0x1d5dada, ftLastAccessTime.dwLowDateTime=0x59062e60, ftLastAccessTime.dwHighDateTime=0x1d5d7fe, ftLastWriteTime.dwLowDateTime=0x59062e60, ftLastWriteTime.dwHighDateTime=0x1d5d7fe, nFileSizeHigh=0x0, nFileSizeLow=0x43ca)) returned 1 [0079.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae990) returned 1 [0079.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", lpFilePart=0x0) returned 0x6b [0079.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae890) returned 1 [0079.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\riie_4xwutul.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.058] GetFileType (hFile=0x2b8) returned 0x1 [0079.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae800) returned 1 [0079.058] GetFileType (hFile=0x2b8) returned 0x1 [0079.058] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aea28 | out: lpFileSizeHigh=0x1c9aea28*=0x0) returned 0x43ca [0079.058] ReadFile (in: hFile=0x2b8, lpBuffer=0x2744700, nNumberOfBytesToRead=0x43ca, lpNumberOfBytesRead=0x1c9ae958, lpOverlapped=0x0 | out: lpBuffer=0x2744700*, lpNumberOfBytesRead=0x1c9ae958*=0x43ca, lpOverlapped=0x0) returned 1 [0079.058] CloseHandle (hObject=0x2b8) returned 1 [0079.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", lpFilePart=0x0) returned 0x6b [0079.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae8c0) returned 1 [0079.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\riie_4xwutul.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.097] GetFileType (hFile=0x2b8) returned 0x1 [0079.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae830) returned 1 [0079.097] GetFileType (hFile=0x2b8) returned 0x1 [0079.097] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d0600*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x1c9ae9e8, lpOverlapped=0x0 | out: lpBuffer=0x27d0600*, lpNumberOfBytesWritten=0x1c9ae9e8*=0x43d0, lpOverlapped=0x0) returned 1 [0079.098] CloseHandle (hObject=0x2b8) returned 1 [0079.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", lpFilePart=0x0) returned 0x6b [0079.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", lpFilePart=0x0) returned 0x6b [0079.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0079.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\riie_4xwutul.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.099] GetFileType (hFile=0x2b8) returned 0x1 [0079.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0079.099] GetFileType (hFile=0x2b8) returned 0x1 [0079.099] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae948*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae948*=0) returned 0x43d0 [0079.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx", lpFilePart=0x0) returned 0x6b [0079.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\UmlJRV80eFdVVHVsLnBwdHg=", nBufferLength=0x105, lpBuffer=0x1c9ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\UmlJRV80eFdVVHVsLnBwdHg=", lpFilePart=0x0) returned 0x72 [0079.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae990) returned 1 [0079.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\riie_4xwutul.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aea70 | out: lpFileInformation=0x1c9aea70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d4b340, ftCreationTime.dwHighDateTime=0x1d5dada, ftLastAccessTime.dwLowDateTime=0x59062e60, ftLastAccessTime.dwHighDateTime=0x1d5d7fe, ftLastWriteTime.dwLowDateTime=0xd6dd1320, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x43da)) returned 1 [0079.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae950) returned 1 [0079.101] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\RiIE_4xWUTul.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\riie_4xwutul.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\UmlJRV80eFdVVHVsLnBwdHg=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\umljrv80efdvvhvslnbwdhg=")) returned 1 [0079.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd", nBufferLength=0x105, lpBuffer=0x1c9ae4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd", lpFilePart=0x0) returned 0x67 [0079.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\", nBufferLength=0x105, lpBuffer=0x1c9ae460, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\", lpFilePart=0x0) returned 0x68 [0079.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\*", lpFindFileData=0x1c9ae670 | out: lpFindFileData=0x1c9ae670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89de4a80, ftCreationTime.dwHighDateTime=0x1d5def8, ftLastAccessTime.dwLowDateTime=0xc40aca0, ftLastAccessTime.dwHighDateTime=0x1d5e0c2, ftLastWriteTime.dwLowDateTime=0xc40aca0, ftLastWriteTime.dwHighDateTime=0x1d5e0c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.102] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae6c0 | out: lpFindFileData=0x1c9ae6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89de4a80, ftCreationTime.dwHighDateTime=0x1d5def8, ftLastAccessTime.dwLowDateTime=0xc40aca0, ftLastAccessTime.dwHighDateTime=0x1d5e0c2, ftLastWriteTime.dwLowDateTime=0xc40aca0, ftLastWriteTime.dwHighDateTime=0x1d5e0c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.102] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae6c0 | out: lpFindFileData=0x1c9ae6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d97cad0, ftCreationTime.dwHighDateTime=0x1d5da50, ftLastAccessTime.dwLowDateTime=0x71bfb770, ftLastAccessTime.dwHighDateTime=0x1d5ddb0, ftLastWriteTime.dwLowDateTime=0x71bfb770, ftLastWriteTime.dwHighDateTime=0x1d5ddb0, nFileSizeHigh=0x0, nFileSizeLow=0xcff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HhHPlEV6XR.xlsx", cAlternateFileName="HHHPLE~1.XLS")) returned 1 [0079.102] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae6c0 | out: lpFindFileData=0x1c9ae6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24e6dd0, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xaf73ba0, ftLastAccessTime.dwHighDateTime=0x1d5df20, ftLastWriteTime.dwLowDateTime=0xaf73ba0, ftLastWriteTime.dwHighDateTime=0x1d5df20, nFileSizeHigh=0x0, nFileSizeLow=0xe87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFf2V.rtf", cAlternateFileName="")) returned 1 [0079.102] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae6c0 | out: lpFindFileData=0x1c9ae6c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.102] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae920) returned 1 [0079.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8e0) returned 1 [0079.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd", nBufferLength=0x105, lpBuffer=0x1c9ae4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd", lpFilePart=0x0) returned 0x67 [0079.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\", nBufferLength=0x105, lpBuffer=0x1c9ae460, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\", lpFilePart=0x0) returned 0x68 [0079.102] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\*", lpFindFileData=0x1c9ae670 | out: lpFindFileData=0x1c9ae670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89de4a80, ftCreationTime.dwHighDateTime=0x1d5def8, ftLastAccessTime.dwLowDateTime=0xc40aca0, ftLastAccessTime.dwHighDateTime=0x1d5e0c2, ftLastWriteTime.dwLowDateTime=0xc40aca0, ftLastWriteTime.dwHighDateTime=0x1d5e0c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.103] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae6c0 | out: lpFindFileData=0x1c9ae6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89de4a80, ftCreationTime.dwHighDateTime=0x1d5def8, ftLastAccessTime.dwLowDateTime=0xc40aca0, ftLastAccessTime.dwHighDateTime=0x1d5e0c2, ftLastWriteTime.dwLowDateTime=0xc40aca0, ftLastWriteTime.dwHighDateTime=0x1d5e0c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.103] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae6c0 | out: lpFindFileData=0x1c9ae6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d97cad0, ftCreationTime.dwHighDateTime=0x1d5da50, ftLastAccessTime.dwLowDateTime=0x71bfb770, ftLastAccessTime.dwHighDateTime=0x1d5ddb0, ftLastWriteTime.dwLowDateTime=0x71bfb770, ftLastWriteTime.dwHighDateTime=0x1d5ddb0, nFileSizeHigh=0x0, nFileSizeLow=0xcff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HhHPlEV6XR.xlsx", cAlternateFileName="HHHPLE~1.XLS")) returned 1 [0079.103] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae6c0 | out: lpFindFileData=0x1c9ae6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24e6dd0, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xaf73ba0, ftLastAccessTime.dwHighDateTime=0x1d5df20, ftLastWriteTime.dwLowDateTime=0xaf73ba0, ftLastWriteTime.dwHighDateTime=0x1d5df20, nFileSizeHigh=0x0, nFileSizeLow=0xe87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFf2V.rtf", cAlternateFileName="")) returned 1 [0079.103] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae6c0 | out: lpFindFileData=0x1c9ae6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24e6dd0, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xaf73ba0, ftLastAccessTime.dwHighDateTime=0x1d5df20, ftLastWriteTime.dwLowDateTime=0xaf73ba0, ftLastWriteTime.dwHighDateTime=0x1d5df20, nFileSizeHigh=0x0, nFileSizeLow=0xe87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFf2V.rtf", cAlternateFileName="")) returned 0 [0079.103] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae920) returned 1 [0079.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8e0) returned 1 [0079.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", lpFilePart=0x0) returned 0x77 [0079.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae920) returned 1 [0079.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\hhhplev6xr.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae890) returned 1 [0079.103] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeae8 | out: lpFileSizeHigh=0x1c9aeae8*=0x0) returned 0xcff5 [0079.104] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=53227, lpDistanceToMoveHigh=0x1c9aea48*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aea48*=0) returned 0xcfeb [0079.104] ReadFile (in: hFile=0x2b8, lpBuffer=0x27da5b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea18, lpOverlapped=0x0 | out: lpBuffer=0x27da5b8*, lpNumberOfBytesRead=0x1c9aea18*=0xa, lpOverlapped=0x0) returned 1 [0079.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", lpFilePart=0x0) returned 0x77 [0079.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0079.106] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\hhhplev6xr.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2847128 | out: lpFileInformation=0x2847128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d97cad0, ftCreationTime.dwHighDateTime=0x1d5da50, ftLastAccessTime.dwLowDateTime=0x71bfb770, ftLastAccessTime.dwHighDateTime=0x1d5ddb0, ftLastWriteTime.dwLowDateTime=0x71bfb770, ftLastWriteTime.dwHighDateTime=0x1d5ddb0, nFileSizeHigh=0x0, nFileSizeLow=0xcff5)) returned 1 [0079.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8f0) returned 1 [0079.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", lpFilePart=0x0) returned 0x77 [0079.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae7f0) returned 1 [0079.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\hhhplev6xr.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae760) returned 1 [0079.107] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9ae988 | out: lpFileSizeHigh=0x1c9ae988*=0x0) returned 0xcff5 [0079.107] ReadFile (in: hFile=0x2b8, lpBuffer=0x28474a0, nNumberOfBytesToRead=0xcff5, lpNumberOfBytesRead=0x1c9ae8b8, lpOverlapped=0x0 | out: lpBuffer=0x28474a0*, lpNumberOfBytesRead=0x1c9ae8b8*=0xcff5, lpOverlapped=0x0) returned 1 [0079.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae340, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", lpFilePart=0x0) returned 0x77 [0079.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae820) returned 1 [0079.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\hhhplev6xr.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae790) returned 1 [0079.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", lpFilePart=0x0) returned 0x77 [0079.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", lpFilePart=0x0) returned 0x77 [0079.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae8c0) returned 1 [0079.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\hhhplev6xr.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae830) returned 1 [0079.122] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae8a8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae8a8*=0) returned 0xd000 [0079.122] WriteFile (in: hFile=0x2b8, lpBuffer=0x28f2f68*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9ae968, lpOverlapped=0x0 | out: lpBuffer=0x28f2f68*, lpNumberOfBytesWritten=0x1c9ae968*=0xa, lpOverlapped=0x0) returned 1 [0079.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", nBufferLength=0x105, lpBuffer=0x1c9ae4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx", lpFilePart=0x0) returned 0x77 [0079.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\SGhIUGxFVjZYUi54bHN4", nBufferLength=0x105, lpBuffer=0x1c9ae4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\SGhIUGxFVjZYUi54bHN4", lpFilePart=0x0) returned 0x7c [0079.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae8f0) returned 1 [0079.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\hhhplev6xr.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x1c9ae9d0 | out: lpFileInformation=0x1c9ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d97cad0, ftCreationTime.dwHighDateTime=0x1d5da50, ftLastAccessTime.dwLowDateTime=0x71bfb770, ftLastAccessTime.dwHighDateTime=0x1d5ddb0, ftLastWriteTime.dwLowDateTime=0xd6e1d5e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd00a)) returned 1 [0079.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8b0) returned 1 [0079.123] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\HhHPlEV6XR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\hhhplev6xr.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\SGhIUGxFVjZYUi54bHN4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\sghiugxfvjzyui54bhn4")) returned 1 [0079.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", lpFilePart=0x0) returned 0x71 [0079.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae920) returned 1 [0079.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\xff2v.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae890) returned 1 [0079.124] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeae8 | out: lpFileSizeHigh=0x1c9aeae8*=0x0) returned 0xe87b [0079.124] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=59505, lpDistanceToMoveHigh=0x1c9aea48*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aea48*=0) returned 0xe871 [0079.124] ReadFile (in: hFile=0x2b8, lpBuffer=0x28f44e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea18, lpOverlapped=0x0 | out: lpBuffer=0x28f44e0*, lpNumberOfBytesRead=0x1c9aea18*=0xa, lpOverlapped=0x0) returned 1 [0079.125] CloseHandle (hObject=0x2b8) returned 1 [0079.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", lpFilePart=0x0) returned 0x71 [0079.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0079.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\xff2v.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2960ef0 | out: lpFileInformation=0x2960ef0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24e6dd0, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xaf73ba0, ftLastAccessTime.dwHighDateTime=0x1d5df20, ftLastWriteTime.dwLowDateTime=0xaf73ba0, ftLastWriteTime.dwHighDateTime=0x1d5df20, nFileSizeHigh=0x0, nFileSizeLow=0xe87b)) returned 1 [0079.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8f0) returned 1 [0079.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", lpFilePart=0x0) returned 0x71 [0079.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae7f0) returned 1 [0079.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\xff2v.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae760) returned 1 [0079.136] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9ae988 | out: lpFileSizeHigh=0x1c9ae988*=0x0) returned 0xe87b [0079.137] ReadFile (in: hFile=0x2b8, lpBuffer=0x2961248, nNumberOfBytesToRead=0xe87b, lpNumberOfBytesRead=0x1c9ae8b8, lpOverlapped=0x0 | out: lpBuffer=0x2961248*, lpNumberOfBytesRead=0x1c9ae8b8*=0xe87b, lpOverlapped=0x0) returned 1 [0079.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae340, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", lpFilePart=0x0) returned 0x71 [0079.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae820) returned 1 [0079.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\xff2v.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.192] GetFileType (hFile=0x2b8) returned 0x1 [0079.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae790) returned 1 [0079.192] GetFileType (hFile=0x2b8) returned 0x1 [0079.192] WriteFile (in: hFile=0x2b8, lpBuffer=0x2766040*, nNumberOfBytesToWrite=0xe880, lpNumberOfBytesWritten=0x1c9ae948, lpOverlapped=0x0 | out: lpBuffer=0x2766040*, lpNumberOfBytesWritten=0x1c9ae948*=0xe880, lpOverlapped=0x0) returned 1 [0079.194] CloseHandle (hObject=0x2b8) returned 1 [0079.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", lpFilePart=0x0) returned 0x71 [0079.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae3e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", lpFilePart=0x0) returned 0x71 [0079.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae8c0) returned 1 [0079.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\xff2v.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.194] GetFileType (hFile=0x2b8) returned 0x1 [0079.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae830) returned 1 [0079.194] GetFileType (hFile=0x2b8) returned 0x1 [0079.194] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae8a8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae8a8*=0) returned 0xe880 [0079.194] WriteFile (in: hFile=0x2b8, lpBuffer=0x27759e0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9ae968, lpOverlapped=0x0 | out: lpBuffer=0x27759e0*, lpNumberOfBytesWritten=0x1c9ae968*=0xa, lpOverlapped=0x0) returned 1 [0079.194] CloseHandle (hObject=0x2b8) returned 1 [0079.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf", lpFilePart=0x0) returned 0x71 [0079.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\eEZmMlYucnRm", nBufferLength=0x105, lpBuffer=0x1c9ae4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\eEZmMlYucnRm", lpFilePart=0x0) returned 0x74 [0079.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae8f0) returned 1 [0079.195] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\xff2v.rtf"), fInfoLevelId=0x0, lpFileInformation=0x1c9ae9d0 | out: lpFileInformation=0x1c9ae9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24e6dd0, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xaf73ba0, ftLastAccessTime.dwHighDateTime=0x1d5df20, ftLastWriteTime.dwLowDateTime=0xd6eb5b60, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe88a)) returned 1 [0079.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8b0) returned 1 [0079.195] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\xFf2V.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\xff2v.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\eEZmMlYucnRm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\eezmmlyucnrm")) returned 1 [0079.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae350, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\README_3728769.txt", lpFilePart=0x0) returned 0x7a [0079.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae830) returned 1 [0079.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\4u79I0cYc3-Qd\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\4u79i0cyc3-qd\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.199] GetFileType (hFile=0x2b8) returned 0x1 [0079.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae7a0) returned 1 [0079.199] GetFileType (hFile=0x2b8) returned 0x1 [0079.199] WriteFile (in: hFile=0x2b8, lpBuffer=0x277a0b0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9ae878, lpOverlapped=0x0 | out: lpBuffer=0x277a0b0*, lpNumberOfBytesWritten=0x1c9ae878*=0x5b3, lpOverlapped=0x0) returned 1 [0079.200] CloseHandle (hObject=0x2b8) returned 1 [0079.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\README_3728769.txt", lpFilePart=0x0) returned 0x6c [0079.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae8d0) returned 1 [0079.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\kQ1e0oCfshs9kdmuJ\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\kq1e0ocfshs9kdmuj\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.201] GetFileType (hFile=0x2b8) returned 0x1 [0079.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae840) returned 1 [0079.201] GetFileType (hFile=0x2b8) returned 0x1 [0079.201] WriteFile (in: hFile=0x2b8, lpBuffer=0x277e228*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9ae918, lpOverlapped=0x0 | out: lpBuffer=0x277e228*, lpNumberOfBytesWritten=0x1c9ae918*=0x5b3, lpOverlapped=0x0) returned 1 [0079.202] CloseHandle (hObject=0x2b8) returned 1 [0079.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae490, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\README_3728769.txt", lpFilePart=0x0) returned 0x5a [0079.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae970) returned 1 [0079.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\w9FTMdQwSBRr\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\w9ftmdqwsbrr\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.202] GetFileType (hFile=0x2b8) returned 0x1 [0079.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8e0) returned 1 [0079.203] GetFileType (hFile=0x2b8) returned 0x1 [0079.203] WriteFile (in: hFile=0x2b8, lpBuffer=0x2782350*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9ae9b8, lpOverlapped=0x0 | out: lpBuffer=0x2782350*, lpNumberOfBytesWritten=0x1c9ae9b8*=0x5b3, lpOverlapped=0x0) returned 1 [0079.204] CloseHandle (hObject=0x2b8) returned 1 [0079.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\README_3728769.txt", lpFilePart=0x0) returned 0x4d [0079.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0079.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67aJ7_i p8_YV 3zvm\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67aj7_i p8_yv 3zvm\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.204] GetFileType (hFile=0x2b8) returned 0x1 [0079.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0079.204] GetFileType (hFile=0x2b8) returned 0x1 [0079.204] WriteFile (in: hFile=0x2b8, lpBuffer=0x2786448*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x2786448*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0079.205] CloseHandle (hObject=0x2b8) returned 1 [0079.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0079.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", lpFilePart=0x0) returned 0x31 [0079.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0079.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeae0) returned 1 [0079.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0079.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x34 [0079.208] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0079.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeae0) returned 1 [0079.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0079.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0079.211] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.211] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.212] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.212] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0079.212] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0079.212] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0079.212] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0079.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0079.213] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.213] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.213] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.213] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0079.214] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0079.214] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.214] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x3d [0079.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.215] GetFileType (hFile=0x2b8) returned 0x1 [0079.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.215] GetFileType (hFile=0x2b8) returned 0x1 [0079.215] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xd8 [0079.215] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=206, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xce [0079.215] ReadFile (in: hFile=0x2b8, lpBuffer=0x278bed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x278bed8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.216] CloseHandle (hObject=0x2b8) returned 1 [0079.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x3d [0079.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x27f88e8 | out: lpFileInformation=0x27f88e8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8)) returned 1 [0079.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x3d [0079.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.222] GetFileType (hFile=0x2b8) returned 0x1 [0079.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.222] GetFileType (hFile=0x2b8) returned 0x1 [0079.223] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xd8 [0079.223] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f8c60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27f8c60*, lpNumberOfBytesRead=0x1c9aea98*=0xd8, lpOverlapped=0x0) returned 1 [0079.223] CloseHandle (hObject=0x2b8) returned 1 [0079.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x3d [0079.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0079.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab340) returned 1 [0079.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", lpFilePart=0x0) returned 0x3f [0079.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.258] GetFileType (hFile=0x2b8) returned 0x1 [0079.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.258] GetFileType (hFile=0x2b8) returned 0x1 [0079.258] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x0 [0079.260] CloseHandle (hObject=0x2b8) returned 1 [0079.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0079.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0079.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.270] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.270] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0079.270] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.270] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0079.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0079.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0079.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0079.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.271] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.272] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0079.272] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0079.272] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0079.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0079.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0079.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0079.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.273] GetFileType (hFile=0x2b8) returned 0x1 [0079.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0079.273] GetFileType (hFile=0x2b8) returned 0x1 [0079.273] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x74e6 [0079.273] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=29916, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x74dc [0079.273] ReadFile (in: hFile=0x2b8, lpBuffer=0x2874288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x2874288*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0079.275] CloseHandle (hObject=0x2b8) returned 1 [0079.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0079.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0079.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0079.281] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), fInfoLevelId=0x0, lpFileInformation=0x28e0e78 | out: lpFileInformation=0x28e0e78*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6)) returned 1 [0079.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0079.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0079.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0079.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.281] GetFileType (hFile=0x2b8) returned 0x1 [0079.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0079.281] GetFileType (hFile=0x2b8) returned 0x1 [0079.281] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x74e6 [0079.281] ReadFile (in: hFile=0x2b8, lpBuffer=0x28e1120, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x28e1120*, lpNumberOfBytesRead=0x1c9ae9f8*=0x74e6, lpOverlapped=0x0) returned 1 [0079.282] CloseHandle (hObject=0x2b8) returned 1 [0079.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0079.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0079.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0079.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab2a0) returned 1 [0079.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae490, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\README_3728769.txt", lpFilePart=0x0) returned 0x4d [0079.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae970) returned 1 [0079.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.373] GetFileType (hFile=0x2b8) returned 0x1 [0079.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8e0) returned 1 [0079.373] GetFileType (hFile=0x2b8) returned 0x1 [0079.373] WriteFile (in: hFile=0x2b8, lpBuffer=0x2706d08*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9ae9b8, lpOverlapped=0x0 | out: lpBuffer=0x2706d08*, lpNumberOfBytesWritten=0x1c9ae9b8*=0x5b3, lpOverlapped=0x0) returned 1 [0079.374] CloseHandle (hObject=0x2b8) returned 1 [0079.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\README_3728769.txt", lpFilePart=0x0) returned 0x44 [0079.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0079.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.377] GetFileType (hFile=0x2b8) returned 0x1 [0079.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0079.377] GetFileType (hFile=0x2b8) returned 0x1 [0079.378] WriteFile (in: hFile=0x2b8, lpBuffer=0x270ade0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x270ade0*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0079.378] CloseHandle (hObject=0x2b8) returned 1 [0079.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0079.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x32 [0079.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0079.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeae0) returned 1 [0079.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0079.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0079.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.382] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.382] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0079.382] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.382] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0079.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0079.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.384] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.384] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0079.384] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0079.384] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0079.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.384] GetFileType (hFile=0x2b8) returned 0x1 [0079.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.385] GetFileType (hFile=0x2b8) returned 0x1 [0079.385] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x42400 [0079.385] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=271350, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x423f6 [0079.385] ReadFile (in: hFile=0x2b8, lpBuffer=0x270f440, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x270f440*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.386] CloseHandle (hObject=0x2b8) returned 1 [0079.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0079.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), fInfoLevelId=0x0, lpFileInformation=0x277be50 | out: lpFileInformation=0x277be50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400)) returned 1 [0079.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0079.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.392] GetFileType (hFile=0x2b8) returned 0x1 [0079.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.392] GetFileType (hFile=0x2b8) returned 0x1 [0079.392] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x42400 [0079.393] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aea98*=0x42400, lpOverlapped=0x0) returned 1 [0079.398] CloseHandle (hObject=0x2b8) returned 1 [0079.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0079.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.451] GetFileType (hFile=0x2b8) returned 0x1 [0079.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0079.451] GetFileType (hFile=0x2b8) returned 0x1 [0079.452] WriteFile (in: hFile=0x2b8, lpBuffer=0x127ace48*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x127ace48*, lpNumberOfBytesWritten=0x1c9aeb28*=0x42410, lpOverlapped=0x0) returned 1 [0079.457] CloseHandle (hObject=0x2b8) returned 1 [0079.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0079.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0079.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.457] GetFileType (hFile=0x2b8) returned 0x1 [0079.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0079.457] GetFileType (hFile=0x2b8) returned 0x1 [0079.457] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x42410 [0079.458] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f3f18*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27f3f18*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0079.458] CloseHandle (hObject=0x2b8) returned 1 [0079.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0079.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\dm9laW1kQGRqaHJldXUudWhkLnBzdA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\dm9laW1kQGRqaHJldXUudWhkLnBzdA==", lpFilePart=0x0) returned 0x56 [0079.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0079.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xd713d2c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4241a)) returned 1 [0079.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0079.458] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\dm9laW1kQGRqaHJldXUudWhkLnBzdA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\dm9law1kqgrqahjldxuudwhklnbzda==")) returned 1 [0079.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\README_3728769.txt", lpFilePart=0x0) returned 0x48 [0079.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0079.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.460] GetFileType (hFile=0x2b8) returned 0x1 [0079.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0079.460] GetFileType (hFile=0x2b8) returned 0x1 [0079.460] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f8268*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x27f8268*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0079.461] CloseHandle (hObject=0x2b8) returned 1 [0079.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm", lpFilePart=0x0) returned 0x34 [0079.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\", lpFilePart=0x0) returned 0x35 [0079.461] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700f8040, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0x5deeea0, ftLastAccessTime.dwHighDateTime=0x1d5e59d, ftLastWriteTime.dwLowDateTime=0x5deeea0, ftLastWriteTime.dwHighDateTime=0x1d5e59d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.461] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700f8040, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0x5deeea0, ftLastAccessTime.dwHighDateTime=0x1d5e59d, ftLastWriteTime.dwLowDateTime=0x5deeea0, ftLastWriteTime.dwHighDateTime=0x1d5e59d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.461] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514d49c0, ftCreationTime.dwHighDateTime=0x1d5dd66, ftLastAccessTime.dwLowDateTime=0xf195f0f0, ftLastAccessTime.dwHighDateTime=0x1d5e0ac, ftLastWriteTime.dwLowDateTime=0xf195f0f0, ftLastWriteTime.dwHighDateTime=0x1d5e0ac, nFileSizeHigh=0x0, nFileSizeLow=0x17064, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0pUzOTG3C90DJauv 1Z.doc", cAlternateFileName="F0PUZO~1.DOC")) returned 1 [0079.461] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bd2b6e0, ftCreationTime.dwHighDateTime=0x1d5e1d2, ftLastAccessTime.dwLowDateTime=0xe6fc34f0, ftLastAccessTime.dwHighDateTime=0x1d5e31e, ftLastWriteTime.dwLowDateTime=0xe6fc34f0, ftLastWriteTime.dwHighDateTime=0x1d5e31e, nFileSizeHigh=0x0, nFileSizeLow=0x108ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="I3PI.ods", cAlternateFileName="")) returned 1 [0079.462] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaed8b10, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x24e5ae90, ftLastAccessTime.dwHighDateTime=0x1d5da87, ftLastWriteTime.dwLowDateTime=0x24e5ae90, ftLastWriteTime.dwHighDateTime=0x1d5da87, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="pBnLFaCOF.pps", cAlternateFileName="PBNLFA~1.PPS")) returned 1 [0079.462] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f1c40, ftCreationTime.dwHighDateTime=0x1d5e17b, ftLastAccessTime.dwLowDateTime=0xda4730c0, ftLastAccessTime.dwHighDateTime=0x1d5db21, ftLastWriteTime.dwLowDateTime=0xda4730c0, ftLastWriteTime.dwHighDateTime=0x1d5db21, nFileSizeHigh=0x0, nFileSizeLow=0xb6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNHiDuLvgyB9zasT oED.pptx", cAlternateFileName="PNHIDU~1.PPT")) returned 1 [0079.462] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fdbd40, ftCreationTime.dwHighDateTime=0x1d5e6b5, ftLastAccessTime.dwLowDateTime=0x6ab37890, ftLastAccessTime.dwHighDateTime=0x1d5d7ca, ftLastWriteTime.dwLowDateTime=0x6ab37890, ftLastWriteTime.dwHighDateTime=0x1d5d7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3f0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="W7pm.rtf", cAlternateFileName="")) returned 1 [0079.462] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.462] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm", lpFilePart=0x0) returned 0x34 [0079.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\", lpFilePart=0x0) returned 0x35 [0079.463] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700f8040, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0x5deeea0, ftLastAccessTime.dwHighDateTime=0x1d5e59d, ftLastWriteTime.dwLowDateTime=0x5deeea0, ftLastWriteTime.dwHighDateTime=0x1d5e59d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.463] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700f8040, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0x5deeea0, ftLastAccessTime.dwHighDateTime=0x1d5e59d, ftLastWriteTime.dwLowDateTime=0x5deeea0, ftLastWriteTime.dwHighDateTime=0x1d5e59d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.463] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514d49c0, ftCreationTime.dwHighDateTime=0x1d5dd66, ftLastAccessTime.dwLowDateTime=0xf195f0f0, ftLastAccessTime.dwHighDateTime=0x1d5e0ac, ftLastWriteTime.dwLowDateTime=0xf195f0f0, ftLastWriteTime.dwHighDateTime=0x1d5e0ac, nFileSizeHigh=0x0, nFileSizeLow=0x17064, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0pUzOTG3C90DJauv 1Z.doc", cAlternateFileName="F0PUZO~1.DOC")) returned 1 [0079.463] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bd2b6e0, ftCreationTime.dwHighDateTime=0x1d5e1d2, ftLastAccessTime.dwLowDateTime=0xe6fc34f0, ftLastAccessTime.dwHighDateTime=0x1d5e31e, ftLastWriteTime.dwLowDateTime=0xe6fc34f0, ftLastWriteTime.dwHighDateTime=0x1d5e31e, nFileSizeHigh=0x0, nFileSizeLow=0x108ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="I3PI.ods", cAlternateFileName="")) returned 1 [0079.464] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaed8b10, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x24e5ae90, ftLastAccessTime.dwHighDateTime=0x1d5da87, ftLastWriteTime.dwLowDateTime=0x24e5ae90, ftLastWriteTime.dwHighDateTime=0x1d5da87, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="pBnLFaCOF.pps", cAlternateFileName="PBNLFA~1.PPS")) returned 1 [0079.464] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f1c40, ftCreationTime.dwHighDateTime=0x1d5e17b, ftLastAccessTime.dwLowDateTime=0xda4730c0, ftLastAccessTime.dwHighDateTime=0x1d5db21, ftLastWriteTime.dwLowDateTime=0xda4730c0, ftLastWriteTime.dwHighDateTime=0x1d5db21, nFileSizeHigh=0x0, nFileSizeLow=0xb6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNHiDuLvgyB9zasT oED.pptx", cAlternateFileName="PNHIDU~1.PPT")) returned 1 [0079.464] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fdbd40, ftCreationTime.dwHighDateTime=0x1d5e6b5, ftLastAccessTime.dwLowDateTime=0x6ab37890, ftLastAccessTime.dwHighDateTime=0x1d5d7ca, ftLastWriteTime.dwLowDateTime=0x6ab37890, ftLastWriteTime.dwHighDateTime=0x1d5d7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3f0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="W7pm.rtf", cAlternateFileName="")) returned 1 [0079.464] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fdbd40, ftCreationTime.dwHighDateTime=0x1d5e6b5, ftLastAccessTime.dwLowDateTime=0x6ab37890, ftLastAccessTime.dwHighDateTime=0x1d5d7ca, ftLastWriteTime.dwLowDateTime=0x6ab37890, ftLastWriteTime.dwHighDateTime=0x1d5d7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3f0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="W7pm.rtf", cAlternateFileName="")) returned 0 [0079.464] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", lpFilePart=0x0) returned 0x4d [0079.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.464] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\f0puzotg3c90djauv 1z.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.464] GetFileType (hFile=0x2b8) returned 0x1 [0079.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.464] GetFileType (hFile=0x2b8) returned 0x1 [0079.464] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x17064 [0079.465] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=94298, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x1705a [0079.465] ReadFile (in: hFile=0x2b8, lpBuffer=0x27fc930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27fc930*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.465] CloseHandle (hObject=0x2b8) returned 1 [0079.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", lpFilePart=0x0) returned 0x4d [0079.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.468] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\f0puzotg3c90djauv 1z.doc"), fInfoLevelId=0x0, lpFileInformation=0x28694a0 | out: lpFileInformation=0x28694a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514d49c0, ftCreationTime.dwHighDateTime=0x1d5dd66, ftLastAccessTime.dwLowDateTime=0xf195f0f0, ftLastAccessTime.dwHighDateTime=0x1d5e0ac, ftLastWriteTime.dwLowDateTime=0xf195f0f0, ftLastWriteTime.dwHighDateTime=0x1d5e0ac, nFileSizeHigh=0x0, nFileSizeLow=0x17064)) returned 1 [0079.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", lpFilePart=0x0) returned 0x4d [0079.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\f0puzotg3c90djauv 1z.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.468] GetFileType (hFile=0x2b8) returned 0x1 [0079.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.468] GetFileType (hFile=0x2b8) returned 0x1 [0079.468] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x17064 [0079.468] ReadFile (in: hFile=0x2b8, lpBuffer=0x127ef290, nNumberOfBytesToRead=0x17064, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x127ef290*, lpNumberOfBytesRead=0x1c9aea98*=0x17064, lpOverlapped=0x0) returned 1 [0079.470] CloseHandle (hObject=0x2b8) returned 1 [0079.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", lpFilePart=0x0) returned 0x4d [0079.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\f0puzotg3c90djauv 1z.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.535] GetFileType (hFile=0x2b8) returned 0x1 [0079.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0079.535] GetFileType (hFile=0x2b8) returned 0x1 [0079.535] WriteFile (in: hFile=0x2b8, lpBuffer=0x12862558*, nNumberOfBytesToWrite=0x17070, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x12862558*, lpNumberOfBytesWritten=0x1c9aeb28*=0x17070, lpOverlapped=0x0) returned 1 [0079.537] CloseHandle (hObject=0x2b8) returned 1 [0079.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", lpFilePart=0x0) returned 0x4d [0079.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", lpFilePart=0x0) returned 0x4d [0079.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\f0puzotg3c90djauv 1z.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.538] GetFileType (hFile=0x2b8) returned 0x1 [0079.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0079.538] GetFileType (hFile=0x2b8) returned 0x1 [0079.538] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x17070 [0079.538] WriteFile (in: hFile=0x2b8, lpBuffer=0x271a820*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x271a820*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0079.538] CloseHandle (hObject=0x2b8) returned 1 [0079.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc", lpFilePart=0x0) returned 0x4d [0079.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\RjBwVXpPVEczQzkwREphdXYgMVouZG9j", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\RjBwVXpPVEczQzkwREphdXYgMVouZG9j", lpFilePart=0x0) returned 0x55 [0079.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0079.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\f0puzotg3c90djauv 1z.doc"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514d49c0, ftCreationTime.dwHighDateTime=0x1d5dd66, ftLastAccessTime.dwLowDateTime=0xf195f0f0, ftLastAccessTime.dwHighDateTime=0x1d5e0ac, ftLastWriteTime.dwLowDateTime=0xd71fb9a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1707a)) returned 1 [0079.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0079.539] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\F0pUzOTG3C90DJauv 1Z.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\f0puzotg3c90djauv 1z.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\RjBwVXpPVEczQzkwREphdXYgMVouZG9j" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\rjbwvxppveczqzkwrephdxygmvouzg9j")) returned 1 [0079.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", lpFilePart=0x0) returned 0x3d [0079.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\i3pi.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.539] GetFileType (hFile=0x2b8) returned 0x1 [0079.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.539] GetFileType (hFile=0x2b8) returned 0x1 [0079.539] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x108ab [0079.539] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=67745, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x108a1 [0079.540] ReadFile (in: hFile=0x2b8, lpBuffer=0x271bc40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x271bc40*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.540] CloseHandle (hObject=0x2b8) returned 1 [0079.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", lpFilePart=0x0) returned 0x3d [0079.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.547] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\i3pi.ods"), fInfoLevelId=0x0, lpFileInformation=0x2788730 | out: lpFileInformation=0x2788730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bd2b6e0, ftCreationTime.dwHighDateTime=0x1d5e1d2, ftLastAccessTime.dwLowDateTime=0xe6fc34f0, ftLastAccessTime.dwHighDateTime=0x1d5e31e, ftLastWriteTime.dwLowDateTime=0xe6fc34f0, ftLastWriteTime.dwHighDateTime=0x1d5e31e, nFileSizeHigh=0x0, nFileSizeLow=0x108ab)) returned 1 [0079.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", lpFilePart=0x0) returned 0x3d [0079.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\i3pi.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.547] GetFileType (hFile=0x2b8) returned 0x1 [0079.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.547] GetFileType (hFile=0x2b8) returned 0x1 [0079.547] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x108ab [0079.547] ReadFile (in: hFile=0x2b8, lpBuffer=0x27889b8, nNumberOfBytesToRead=0x108ab, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27889b8*, lpNumberOfBytesRead=0x1c9aea98*=0x108ab, lpOverlapped=0x0) returned 1 [0079.548] CloseHandle (hObject=0x2b8) returned 1 [0079.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", lpFilePart=0x0) returned 0x3d [0079.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\i3pi.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.575] GetFileType (hFile=0x2b8) returned 0x1 [0079.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0079.575] GetFileType (hFile=0x2b8) returned 0x1 [0079.575] WriteFile (in: hFile=0x2b8, lpBuffer=0x2830fc0*, nNumberOfBytesToWrite=0x108b0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2830fc0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x108b0, lpOverlapped=0x0) returned 1 [0079.577] CloseHandle (hObject=0x2b8) returned 1 [0079.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", lpFilePart=0x0) returned 0x3d [0079.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", lpFilePart=0x0) returned 0x3d [0079.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\i3pi.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.577] GetFileType (hFile=0x2b8) returned 0x1 [0079.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0079.577] GetFileType (hFile=0x2b8) returned 0x1 [0079.577] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x108b0 [0079.577] WriteFile (in: hFile=0x2b8, lpBuffer=0x2842788*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2842788*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0079.578] CloseHandle (hObject=0x2b8) returned 1 [0079.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods", lpFilePart=0x0) returned 0x3d [0079.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\STNQSS5vZHM=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\STNQSS5vZHM=", lpFilePart=0x0) returned 0x41 [0079.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0079.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\i3pi.ods"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bd2b6e0, ftCreationTime.dwHighDateTime=0x1d5e1d2, ftLastAccessTime.dwLowDateTime=0xe6fc34f0, ftLastAccessTime.dwHighDateTime=0x1d5e31e, ftLastWriteTime.dwLowDateTime=0xd726ddc0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x108ba)) returned 1 [0079.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0079.578] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\I3PI.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\i3pi.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\STNQSS5vZHM=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\stnqss5vzhm=")) returned 1 [0079.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", lpFilePart=0x0) returned 0x42 [0079.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pbnlfacof.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.579] GetFileType (hFile=0x2b8) returned 0x1 [0079.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.579] GetFileType (hFile=0x2b8) returned 0x1 [0079.579] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x136d2 [0079.579] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=79560, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x136c8 [0079.579] ReadFile (in: hFile=0x2b8, lpBuffer=0x2843b48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2843b48*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.580] CloseHandle (hObject=0x2b8) returned 1 [0079.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", lpFilePart=0x0) returned 0x42 [0079.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pbnlfacof.pps"), fInfoLevelId=0x0, lpFileInformation=0x28b0678 | out: lpFileInformation=0x28b0678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaed8b10, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x24e5ae90, ftLastAccessTime.dwHighDateTime=0x1d5da87, ftLastWriteTime.dwLowDateTime=0x24e5ae90, ftLastWriteTime.dwHighDateTime=0x1d5da87, nFileSizeHigh=0x0, nFileSizeLow=0x136d2)) returned 1 [0079.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", lpFilePart=0x0) returned 0x42 [0079.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pbnlfacof.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.582] GetFileType (hFile=0x2b8) returned 0x1 [0079.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.582] GetFileType (hFile=0x2b8) returned 0x1 [0079.582] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x136d2 [0079.582] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b0920, nNumberOfBytesToRead=0x136d2, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28b0920*, lpNumberOfBytesRead=0x1c9aea98*=0x136d2, lpOverlapped=0x0) returned 1 [0079.583] CloseHandle (hObject=0x2b8) returned 1 [0079.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", lpFilePart=0x0) returned 0x42 [0079.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pbnlfacof.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.635] GetFileType (hFile=0x2b8) returned 0x1 [0079.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0079.635] GetFileType (hFile=0x2b8) returned 0x1 [0079.635] WriteFile (in: hFile=0x2b8, lpBuffer=0x279f5a0*, nNumberOfBytesToWrite=0x136e0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x279f5a0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x136e0, lpOverlapped=0x0) returned 1 [0079.637] CloseHandle (hObject=0x2b8) returned 1 [0079.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", lpFilePart=0x0) returned 0x42 [0079.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", lpFilePart=0x0) returned 0x42 [0079.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pbnlfacof.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.637] GetFileType (hFile=0x2b8) returned 0x1 [0079.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0079.638] GetFileType (hFile=0x2b8) returned 0x1 [0079.638] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x136e0 [0079.638] WriteFile (in: hFile=0x2b8, lpBuffer=0x27b3be8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27b3be8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0079.638] CloseHandle (hObject=0x2b8) returned 1 [0079.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps", lpFilePart=0x0) returned 0x42 [0079.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\cEJuTEZhQ09GLnBwcw==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\cEJuTEZhQ09GLnBwcw==", lpFilePart=0x0) returned 0x49 [0079.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0079.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pbnlfacof.pps"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaed8b10, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x24e5ae90, ftLastAccessTime.dwHighDateTime=0x1d5da87, ftLastWriteTime.dwLowDateTime=0xd7306340, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x136ea)) returned 1 [0079.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0079.638] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\pBnLFaCOF.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pbnlfacof.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\cEJuTEZhQ09GLnBwcw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\cejutezhq09glnbwcw==")) returned 1 [0079.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", lpFilePart=0x0) returned 0x4e [0079.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pnhidulvgyb9zast oed.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.639] GetFileType (hFile=0x2b8) returned 0x1 [0079.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.639] GetFileType (hFile=0x2b8) returned 0x1 [0079.639] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xb6cc [0079.639] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=46786, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xb6c2 [0079.639] ReadFile (in: hFile=0x2b8, lpBuffer=0x27b5000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27b5000*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.640] CloseHandle (hObject=0x2b8) returned 1 [0079.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", lpFilePart=0x0) returned 0x4e [0079.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.646] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pnhidulvgyb9zast oed.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2821b30 | out: lpFileInformation=0x2821b30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f1c40, ftCreationTime.dwHighDateTime=0x1d5e17b, ftLastAccessTime.dwLowDateTime=0xda4730c0, ftLastAccessTime.dwHighDateTime=0x1d5db21, ftLastWriteTime.dwLowDateTime=0xda4730c0, ftLastWriteTime.dwHighDateTime=0x1d5db21, nFileSizeHigh=0x0, nFileSizeLow=0xb6cc)) returned 1 [0079.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", lpFilePart=0x0) returned 0x4e [0079.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pnhidulvgyb9zast oed.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.646] GetFileType (hFile=0x2b8) returned 0x1 [0079.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.646] GetFileType (hFile=0x2b8) returned 0x1 [0079.646] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xb6cc [0079.646] ReadFile (in: hFile=0x2b8, lpBuffer=0x2821e38, nNumberOfBytesToRead=0xb6cc, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2821e38*, lpNumberOfBytesRead=0x1c9aea98*=0xb6cc, lpOverlapped=0x0) returned 1 [0079.647] CloseHandle (hObject=0x2b8) returned 1 [0079.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", lpFilePart=0x0) returned 0x4e [0079.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pnhidulvgyb9zast oed.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.660] GetFileType (hFile=0x2b8) returned 0x1 [0079.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0079.660] GetFileType (hFile=0x2b8) returned 0x1 [0079.660] WriteFile (in: hFile=0x2b8, lpBuffer=0x28baea0*, nNumberOfBytesToWrite=0xb6d0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x28baea0*, lpNumberOfBytesWritten=0x1c9aeb28*=0xb6d0, lpOverlapped=0x0) returned 1 [0079.662] CloseHandle (hObject=0x2b8) returned 1 [0079.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", lpFilePart=0x0) returned 0x4e [0079.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", lpFilePart=0x0) returned 0x4e [0079.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pnhidulvgyb9zast oed.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.662] GetFileType (hFile=0x2b8) returned 0x1 [0079.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0079.662] GetFileType (hFile=0x2b8) returned 0x1 [0079.662] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xb6d0 [0079.663] WriteFile (in: hFile=0x2b8, lpBuffer=0x28c75b0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x28c75b0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0079.663] CloseHandle (hObject=0x2b8) returned 1 [0079.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx", lpFilePart=0x0) returned 0x4e [0079.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\UE5IaUR1THZneUI5emFzVCBvRUQucHB0eA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\UE5IaUR1THZneUI5emFzVCBvRUQucHB0eA==", lpFilePart=0x0) returned 0x59 [0079.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0079.663] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pnhidulvgyb9zast oed.pptx"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f1c40, ftCreationTime.dwHighDateTime=0x1d5e17b, ftLastAccessTime.dwLowDateTime=0xda4730c0, ftLastAccessTime.dwHighDateTime=0x1d5db21, ftLastWriteTime.dwLowDateTime=0xd732c4a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xb6da)) returned 1 [0079.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0079.663] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\PNHiDuLvgyB9zasT oED.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\pnhidulvgyb9zast oed.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\UE5IaUR1THZneUI5emFzVCBvRUQucHB0eA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\ue5iaur1thzneui5emfzvcbvruquchb0ea==")) returned 1 [0079.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", lpFilePart=0x0) returned 0x3d [0079.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\w7pm.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.664] GetFileType (hFile=0x2b8) returned 0x1 [0079.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.664] GetFileType (hFile=0x2b8) returned 0x1 [0079.664] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x3f0d [0079.664] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=16131, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x3f03 [0079.664] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c89e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28c89e0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.665] CloseHandle (hObject=0x2b8) returned 1 [0079.665] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", lpFilePart=0x0) returned 0x3d [0079.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\w7pm.rtf"), fInfoLevelId=0x0, lpFileInformation=0x29353f0 | out: lpFileInformation=0x29353f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fdbd40, ftCreationTime.dwHighDateTime=0x1d5e6b5, ftLastAccessTime.dwLowDateTime=0x6ab37890, ftLastAccessTime.dwHighDateTime=0x1d5d7ca, ftLastWriteTime.dwLowDateTime=0x6ab37890, ftLastWriteTime.dwHighDateTime=0x1d5d7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3f0d)) returned 1 [0079.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", lpFilePart=0x0) returned 0x3d [0079.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\w7pm.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.670] GetFileType (hFile=0x2b8) returned 0x1 [0079.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.670] GetFileType (hFile=0x2b8) returned 0x1 [0079.670] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x3f0d [0079.670] ReadFile (in: hFile=0x2b8, lpBuffer=0x2935678, nNumberOfBytesToRead=0x3f0d, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2935678*, lpNumberOfBytesRead=0x1c9aea98*=0x3f0d, lpOverlapped=0x0) returned 1 [0079.671] CloseHandle (hObject=0x2b8) returned 1 [0079.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", lpFilePart=0x0) returned 0x3d [0079.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\w7pm.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.734] GetFileType (hFile=0x2b8) returned 0x1 [0079.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0079.734] GetFileType (hFile=0x2b8) returned 0x1 [0079.734] WriteFile (in: hFile=0x2b8, lpBuffer=0x27450e8*, nNumberOfBytesToWrite=0x3f10, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x27450e8*, lpNumberOfBytesWritten=0x1c9aeb28*=0x3f10, lpOverlapped=0x0) returned 1 [0079.735] CloseHandle (hObject=0x2b8) returned 1 [0079.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", lpFilePart=0x0) returned 0x3d [0079.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", lpFilePart=0x0) returned 0x3d [0079.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\w7pm.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.736] GetFileType (hFile=0x2b8) returned 0x1 [0079.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0079.736] GetFileType (hFile=0x2b8) returned 0x1 [0079.736] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x3f10 [0079.736] WriteFile (in: hFile=0x2b8, lpBuffer=0x2749f10*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2749f10*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0079.736] CloseHandle (hObject=0x2b8) returned 1 [0079.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf", lpFilePart=0x0) returned 0x3d [0079.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\VzdwbS5ydGY=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\VzdwbS5ydGY=", lpFilePart=0x0) returned 0x41 [0079.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0079.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\w7pm.rtf"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fdbd40, ftCreationTime.dwHighDateTime=0x1d5e6b5, ftLastAccessTime.dwLowDateTime=0x6ab37890, ftLastAccessTime.dwHighDateTime=0x1d5d7ca, ftLastWriteTime.dwLowDateTime=0xd73eab80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x3f1a)) returned 1 [0079.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0079.736] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\W7pm.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\w7pm.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\VzdwbS5ydGY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\vzdwbs5ydgy=")) returned 1 [0079.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\README_3728769.txt", lpFilePart=0x0) returned 0x47 [0079.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0079.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\u2d2Dy3vGrCm\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u2d2dy3vgrcm\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.740] GetFileType (hFile=0x2b8) returned 0x1 [0079.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0079.740] GetFileType (hFile=0x2b8) returned 0x1 [0079.740] WriteFile (in: hFile=0x2b8, lpBuffer=0x274e1e0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x274e1e0*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0079.741] CloseHandle (hObject=0x2b8) returned 1 [0079.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\README_3728769.txt", lpFilePart=0x0) returned 0x3a [0079.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0079.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.741] GetFileType (hFile=0x2b8) returned 0x1 [0079.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0079.741] GetFileType (hFile=0x2b8) returned 0x1 [0079.741] WriteFile (in: hFile=0x2b8, lpBuffer=0x2752288*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x2752288*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0079.742] CloseHandle (hObject=0x2b8) returned 1 [0079.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0079.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0079.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0079.743] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.743] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.743] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.743] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.743] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0079.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0079.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0079.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0079.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0079.744] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.744] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.744] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.744] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0079.744] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0079.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0079.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0079.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.745] GetFileType (hFile=0x2b8) returned 0x1 [0079.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0079.745] GetFileType (hFile=0x2b8) returned 0x1 [0079.745] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x11a [0079.745] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=272, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x110 [0079.747] ReadFile (in: hFile=0x2b8, lpBuffer=0x2755510, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2755510*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0079.748] CloseHandle (hObject=0x2b8) returned 1 [0079.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11b98) returned 0x0 [0079.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.753] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x27c1f20 | out: lpFileInformation=0x27c1f20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a)) returned 1 [0079.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0079.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0079.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.754] GetFileType (hFile=0x2b8) returned 0x1 [0079.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0079.754] GetFileType (hFile=0x2b8) returned 0x1 [0079.754] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x11a [0079.754] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c22b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27c22b0*, lpNumberOfBytesRead=0x1c9aeb38*=0x11a, lpOverlapped=0x0) returned 1 [0079.754] CloseHandle (hObject=0x2b8) returned 1 [0079.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0079.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab3e0) returned 1 [0079.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\README_3728769.txt", lpFilePart=0x0) returned 0x3a [0079.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0079.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.768] GetFileType (hFile=0x2b8) returned 0x1 [0079.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0079.768] GetFileType (hFile=0x2b8) returned 0x1 [0079.768] WriteFile (in: hFile=0x2b8, lpBuffer=0x283df00*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x283df00*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0079.769] CloseHandle (hObject=0x2b8) returned 1 [0079.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0079.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0079.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0079.769] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.769] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0079.770] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0079.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0079.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0079.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0079.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0079.771] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.771] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.772] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0079.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0079.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0079.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.773] GetFileType (hFile=0x2b8) returned 0x1 [0079.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0079.773] GetFileType (hFile=0x2b8) returned 0x1 [0079.773] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x192 [0079.773] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=392, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x188 [0079.773] ReadFile (in: hFile=0x2b8, lpBuffer=0x2841fc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2841fc8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0079.774] CloseHandle (hObject=0x2b8) returned 1 [0079.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11b98) returned 0x0 [0079.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x28ae9d8 | out: lpFileInformation=0x28ae9d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192)) returned 1 [0079.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0079.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0079.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.780] GetFileType (hFile=0x2b8) returned 0x1 [0079.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0079.780] GetFileType (hFile=0x2b8) returned 0x1 [0079.781] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x192 [0079.781] ReadFile (in: hFile=0x2b8, lpBuffer=0x28aede0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28aede0*, lpNumberOfBytesRead=0x1c9aeb38*=0x192, lpOverlapped=0x0) returned 1 [0079.781] CloseHandle (hObject=0x2b8) returned 1 [0079.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", lpFilePart=0x0) returned 0x33 [0079.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0079.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab3e0) returned 1 [0079.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0079.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e [0079.828] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.829] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.829] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.829] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0079.829] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0079.829] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.829] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0079.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e [0079.830] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.830] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.831] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.831] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0079.831] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0079.831] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0079.831] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", lpFilePart=0x0) returned 0x39 [0079.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.832] GetFileType (hFile=0x2b8) returned 0x1 [0079.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.832] GetFileType (hFile=0x2b8) returned 0x1 [0079.832] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x50 [0079.832] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=70, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x46 [0079.832] ReadFile (in: hFile=0x2b8, lpBuffer=0x275d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x275d190*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.833] CloseHandle (hObject=0x2b8) returned 1 [0079.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", lpFilePart=0x0) returned 0x39 [0079.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x27c9ba0 | out: lpFileInformation=0x27c9ba0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0079.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", lpFilePart=0x0) returned 0x39 [0079.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.839] GetFileType (hFile=0x2b8) returned 0x1 [0079.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.839] GetFileType (hFile=0x2b8) returned 0x1 [0079.839] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x50 [0079.840] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c9e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27c9e80*, lpNumberOfBytesRead=0x1c9aea98*=0x50, lpOverlapped=0x0) returned 1 [0079.840] CloseHandle (hObject=0x2b8) returned 1 [0079.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", lpFilePart=0x0) returned 0x39 [0079.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0079.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab340) returned 1 [0079.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", lpFilePart=0x0) returned 0x41 [0079.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.874] GetFileType (hFile=0x2b8) returned 0x1 [0079.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.874] GetFileType (hFile=0x2b8) returned 0x1 [0079.874] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xec [0079.874] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=226, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xe2 [0079.874] ReadFile (in: hFile=0x2b8, lpBuffer=0x2842858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2842858*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.875] CloseHandle (hObject=0x2b8) returned 1 [0079.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", lpFilePart=0x0) returned 0x41 [0079.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), fInfoLevelId=0x0, lpFileInformation=0x28af268 | out: lpFileInformation=0x28af268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec)) returned 1 [0079.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", lpFilePart=0x0) returned 0x41 [0079.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.881] GetFileType (hFile=0x2b8) returned 0x1 [0079.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.881] GetFileType (hFile=0x2b8) returned 0x1 [0079.881] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xec [0079.882] ReadFile (in: hFile=0x2b8, lpBuffer=0x28af628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28af628*, lpNumberOfBytesRead=0x1c9aea98*=0xec, lpOverlapped=0x0) returned 1 [0079.882] CloseHandle (hObject=0x2b8) returned 1 [0079.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", lpFilePart=0x0) returned 0x41 [0079.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.926] GetFileType (hFile=0x2b8) returned 0x1 [0079.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0079.926] GetFileType (hFile=0x2b8) returned 0x1 [0079.926] WriteFile (in: hFile=0x2b8, lpBuffer=0x2752298*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x2752298*, lpNumberOfBytesWritten=0x1c9ae9d8*=0xf0, lpOverlapped=0x0) returned 1 [0079.928] CloseHandle (hObject=0x2b8) returned 1 [0079.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", lpFilePart=0x0) returned 0x41 [0079.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", lpFilePart=0x0) returned 0x41 [0079.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.929] GetFileType (hFile=0x2b8) returned 0x1 [0079.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0079.929] GetFileType (hFile=0x2b8) returned 0x1 [0079.929] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xf0 [0079.929] WriteFile (in: hFile=0x2b8, lpBuffer=0x27540b8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27540b8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0079.929] CloseHandle (hObject=0x2b8) returned 1 [0079.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", lpFilePart=0x0) returned 0x41 [0079.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\U3VnZ2VzdGVkIFNpdGVzLnVybA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\U3VnZ2VzdGVkIFNpdGVzLnVybA==", lpFilePart=0x0) returned 0x4a [0079.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0079.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd75b3c00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xfa)) returned 1 [0079.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0079.930] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\U3VnZ2VzdGVkIFNpdGVzLnVybA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\u3vnz2vzdgvkifnpdgvzlnvyba==")) returned 1 [0079.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", lpFilePart=0x0) returned 0x43 [0079.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.933] GetFileType (hFile=0x2b8) returned 0x1 [0079.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.933] GetFileType (hFile=0x2b8) returned 0x1 [0079.933] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xe2 [0079.933] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=216, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xd8 [0079.933] ReadFile (in: hFile=0x2b8, lpBuffer=0x27554b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27554b0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.934] CloseHandle (hObject=0x2b8) returned 1 [0079.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", lpFilePart=0x0) returned 0x43 [0079.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.940] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x27c1ec0 | out: lpFileInformation=0x27c1ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2)) returned 1 [0079.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", lpFilePart=0x0) returned 0x43 [0079.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.940] GetFileType (hFile=0x2b8) returned 0x1 [0079.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.941] GetFileType (hFile=0x2b8) returned 0x1 [0079.941] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xe2 [0079.941] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c2288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27c2288*, lpNumberOfBytesRead=0x1c9aea98*=0xe2, lpOverlapped=0x0) returned 1 [0079.941] CloseHandle (hObject=0x2b8) returned 1 [0079.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", lpFilePart=0x0) returned 0x43 [0079.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0079.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.954] GetFileType (hFile=0x2b8) returned 0x1 [0079.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0079.954] GetFileType (hFile=0x2b8) returned 0x1 [0079.954] WriteFile (in: hFile=0x2b8, lpBuffer=0x283a300*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x283a300*, lpNumberOfBytesWritten=0x1c9ae9d8*=0xf0, lpOverlapped=0x0) returned 1 [0079.955] CloseHandle (hObject=0x2b8) returned 1 [0079.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", lpFilePart=0x0) returned 0x43 [0079.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", lpFilePart=0x0) returned 0x43 [0079.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0079.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.956] GetFileType (hFile=0x2b8) returned 0x1 [0079.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0079.956] GetFileType (hFile=0x2b8) returned 0x1 [0079.956] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xf0 [0079.956] WriteFile (in: hFile=0x2b8, lpBuffer=0x283c130*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x283c130*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0079.956] CloseHandle (hObject=0x2b8) returned 1 [0079.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", lpFilePart=0x0) returned 0x43 [0079.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\V2ViIFNsaWNlIEdhbGxlcnkudXJs", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\V2ViIFNsaWNlIEdhbGxlcnkudXJs", lpFilePart=0x0) returned 0x4a [0079.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0079.956] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd75ffec0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xfa)) returned 1 [0079.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0079.957] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\V2ViIFNsaWNlIEdhbGxlcnkudXJs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\v2viifnsawnliedhbgxlcnkudxjs")) returned 1 [0079.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\README_3728769.txt", lpFilePart=0x0) returned 0x40 [0079.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0079.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.962] GetFileType (hFile=0x2b8) returned 0x1 [0079.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0079.962] GetFileType (hFile=0x2b8) returned 0x1 [0079.962] WriteFile (in: hFile=0x2b8, lpBuffer=0x2840418*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x2840418*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0079.964] CloseHandle (hObject=0x2b8) returned 1 [0079.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0079.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b [0079.965] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.967] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.967] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0079.967] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0079.967] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0079.967] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0079.967] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0079.968] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.968] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0079.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b [0079.969] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.970] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.971] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0079.971] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0079.971] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0079.971] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0079.971] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0079.971] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0079.972] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\README_3728769.txt", lpFilePart=0x0) returned 0x4d [0079.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0079.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0079.975] GetFileType (hFile=0x2b8) returned 0x1 [0079.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0079.975] GetFileType (hFile=0x2b8) returned 0x1 [0079.975] WriteFile (in: hFile=0x2b8, lpBuffer=0x2847cd0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x2847cd0*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0079.976] CloseHandle (hObject=0x2b8) returned 1 [0079.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0079.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35 [0079.977] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.978] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.978] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0079.979] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0079.979] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0079.979] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0079.979] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0079.979] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0079.980] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.980] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0079.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0079.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35 [0079.981] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0079.982] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.982] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0079.982] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0079.983] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0079.983] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0079.983] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0079.983] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0079.983] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0079.983] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0079.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0079.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0079.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", lpFilePart=0x0) returned 0x42 [0079.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0079.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.987] GetFileType (hFile=0x2b8) returned 0x1 [0079.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0079.987] GetFileType (hFile=0x2b8) returned 0x1 [0079.987] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x85 [0079.988] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=123, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x7b [0079.988] ReadFile (in: hFile=0x2b8, lpBuffer=0x284c978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x284c978*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0079.988] CloseHandle (hObject=0x2b8) returned 1 [0079.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0079.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", lpFilePart=0x0) returned 0x42 [0079.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0079.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), fInfoLevelId=0x0, lpFileInformation=0x28b9388 | out: lpFileInformation=0x28b9388*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0079.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0079.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", lpFilePart=0x0) returned 0x42 [0079.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0079.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0079.996] GetFileType (hFile=0x2b8) returned 0x1 [0079.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0079.996] GetFileType (hFile=0x2b8) returned 0x1 [0079.996] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x85 [0079.996] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b96d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28b96d0*, lpNumberOfBytesRead=0x1c9aea98*=0x85, lpOverlapped=0x0) returned 1 [0079.996] CloseHandle (hObject=0x2b8) returned 1 [0080.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", lpFilePart=0x0) returned 0x42 [0080.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.048] GetFileType (hFile=0x2b8) returned 0x1 [0080.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.048] GetFileType (hFile=0x2b8) returned 0x1 [0080.048] WriteFile (in: hFile=0x2b8, lpBuffer=0x26d0578*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x26d0578*, lpNumberOfBytesWritten=0x1c9ae9d8*=0x90, lpOverlapped=0x0) returned 1 [0080.049] CloseHandle (hObject=0x2b8) returned 1 [0080.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", lpFilePart=0x0) returned 0x42 [0080.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", lpFilePart=0x0) returned 0x42 [0080.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.049] GetFileType (hFile=0x2b8) returned 0x1 [0080.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.049] GetFileType (hFile=0x2b8) returned 0x1 [0080.050] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x90 [0080.050] WriteFile (in: hFile=0x2b8, lpBuffer=0x26d2380*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x26d2380*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.050] CloseHandle (hObject=0x2b8) returned 1 [0080.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", lpFilePart=0x0) returned 0x42 [0080.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIEF1dG9zLnVybA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIEF1dG9zLnVybA==", lpFilePart=0x0) returned 0x49 [0080.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd76e4700, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x9a)) returned 1 [0080.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.050] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIEF1dG9zLnVybA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\tvnoief1dg9zlnvyba==")) returned 1 [0080.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFilePart=0x0) returned 0x4a [0080.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.052] GetFileType (hFile=0x2b8) returned 0x1 [0080.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.052] GetFileType (hFile=0x2b8) returned 0x1 [0080.052] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x85 [0080.052] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=123, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x7b [0080.052] ReadFile (in: hFile=0x2b8, lpBuffer=0x26d3788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x26d3788*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.053] CloseHandle (hObject=0x2b8) returned 1 [0080.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFilePart=0x0) returned 0x4a [0080.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.054] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), fInfoLevelId=0x0, lpFileInformation=0x2740198 | out: lpFileInformation=0x2740198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0080.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFilePart=0x0) returned 0x4a [0080.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.055] GetFileType (hFile=0x2b8) returned 0x1 [0080.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.055] GetFileType (hFile=0x2b8) returned 0x1 [0080.055] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x85 [0080.055] ReadFile (in: hFile=0x2b8, lpBuffer=0x2740520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2740520*, lpNumberOfBytesRead=0x1c9aea98*=0x85, lpOverlapped=0x0) returned 1 [0080.055] CloseHandle (hObject=0x2b8) returned 1 [0080.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFilePart=0x0) returned 0x4a [0080.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.065] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.065] GetFileType (hFile=0x2b8) returned 0x1 [0080.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.066] GetFileType (hFile=0x2b8) returned 0x1 [0080.066] WriteFile (in: hFile=0x2b8, lpBuffer=0x27b84e8*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x27b84e8*, lpNumberOfBytesWritten=0x1c9ae9d8*=0x90, lpOverlapped=0x0) returned 1 [0080.067] CloseHandle (hObject=0x2b8) returned 1 [0080.067] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFilePart=0x0) returned 0x4a [0080.067] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFilePart=0x0) returned 0x4a [0080.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.067] GetFileType (hFile=0x2b8) returned 0x1 [0080.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.067] GetFileType (hFile=0x2b8) returned 0x1 [0080.067] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x90 [0080.067] WriteFile (in: hFile=0x2b8, lpBuffer=0x27ba358*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27ba358*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.068] CloseHandle (hObject=0x2b8) returned 1 [0080.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFilePart=0x0) returned 0x4a [0080.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIEVudGVydGFpbm1lbnQudXJs", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIEVudGVydGFpbm1lbnQudXJs", lpFilePart=0x0) returned 0x51 [0080.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.068] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd770a860, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x9a)) returned 1 [0080.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.068] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIEVudGVydGFpbm1lbnQudXJs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\tvnoievudgvydgfpbm1lbnqudxjs")) returned 1 [0080.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", lpFilePart=0x0) returned 0x42 [0080.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.069] GetFileType (hFile=0x2b8) returned 0x1 [0080.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.069] GetFileType (hFile=0x2b8) returned 0x1 [0080.070] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x85 [0080.070] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=123, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x7b [0080.070] ReadFile (in: hFile=0x2b8, lpBuffer=0x27bb770, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27bb770*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.071] CloseHandle (hObject=0x2b8) returned 1 [0080.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", lpFilePart=0x0) returned 0x42 [0080.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.072] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), fInfoLevelId=0x0, lpFileInformation=0x2828180 | out: lpFileInformation=0x2828180*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0080.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", lpFilePart=0x0) returned 0x42 [0080.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.073] GetFileType (hFile=0x2b8) returned 0x1 [0080.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.073] GetFileType (hFile=0x2b8) returned 0x1 [0080.073] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x85 [0080.073] ReadFile (in: hFile=0x2b8, lpBuffer=0x28284c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28284c8*, lpNumberOfBytesRead=0x1c9aea98*=0x85, lpOverlapped=0x0) returned 1 [0080.073] CloseHandle (hObject=0x2b8) returned 1 [0080.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", lpFilePart=0x0) returned 0x42 [0080.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.085] GetFileType (hFile=0x2b8) returned 0x1 [0080.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.085] GetFileType (hFile=0x2b8) returned 0x1 [0080.085] WriteFile (in: hFile=0x2b8, lpBuffer=0x28a01d8*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x28a01d8*, lpNumberOfBytesWritten=0x1c9ae9d8*=0x90, lpOverlapped=0x0) returned 1 [0080.086] CloseHandle (hObject=0x2b8) returned 1 [0080.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", lpFilePart=0x0) returned 0x42 [0080.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", lpFilePart=0x0) returned 0x42 [0080.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.086] GetFileType (hFile=0x2b8) returned 0x1 [0080.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.087] GetFileType (hFile=0x2b8) returned 0x1 [0080.087] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x90 [0080.087] WriteFile (in: hFile=0x2b8, lpBuffer=0x28a1fe0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x28a1fe0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.087] CloseHandle (hObject=0x2b8) returned 1 [0080.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", lpFilePart=0x0) returned 0x42 [0080.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIE1vbmV5LnVybA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIE1vbmV5LnVybA==", lpFilePart=0x0) returned 0x49 [0080.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd77309c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x9a)) returned 1 [0080.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.087] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIE1vbmV5LnVybA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\tvnoie1vbmv5lnvyba==")) returned 1 [0080.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", lpFilePart=0x0) returned 0x43 [0080.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.089] GetFileType (hFile=0x2b8) returned 0x1 [0080.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.089] GetFileType (hFile=0x2b8) returned 0x1 [0080.089] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x85 [0080.089] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=123, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x7b [0080.089] ReadFile (in: hFile=0x2b8, lpBuffer=0x28a33c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28a33c8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.090] CloseHandle (hObject=0x2b8) returned 1 [0080.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", lpFilePart=0x0) returned 0x43 [0080.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.098] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), fInfoLevelId=0x0, lpFileInformation=0x2743bb8 | out: lpFileInformation=0x2743bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0080.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", lpFilePart=0x0) returned 0x43 [0080.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.099] GetFileType (hFile=0x2b8) returned 0x1 [0080.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.099] GetFileType (hFile=0x2b8) returned 0x1 [0080.099] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x85 [0080.099] ReadFile (in: hFile=0x2b8, lpBuffer=0x2743f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2743f00*, lpNumberOfBytesRead=0x1c9aea98*=0x85, lpOverlapped=0x0) returned 1 [0080.099] CloseHandle (hObject=0x2b8) returned 1 [0080.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", lpFilePart=0x0) returned 0x43 [0080.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.109] GetFileType (hFile=0x2b8) returned 0x1 [0080.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.109] GetFileType (hFile=0x2b8) returned 0x1 [0080.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", lpFilePart=0x0) returned 0x43 [0080.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", lpFilePart=0x0) returned 0x43 [0080.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.112] GetFileType (hFile=0x2b8) returned 0x1 [0080.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.112] GetFileType (hFile=0x2b8) returned 0x1 [0080.112] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x90 [0080.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", lpFilePart=0x0) returned 0x43 [0080.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIFNwb3J0cy51cmw=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIFNwb3J0cy51cmw=", lpFilePart=0x0) returned 0x49 [0080.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.112] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd777cc80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x9a)) returned 1 [0080.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.112] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOIFNwb3J0cy51cmw=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\tvnoifnwb3j0cy51cmw=")) returned 1 [0080.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", lpFilePart=0x0) returned 0x3c [0080.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.113] GetFileType (hFile=0x2b8) returned 0x1 [0080.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.113] GetFileType (hFile=0x2b8) returned 0x1 [0080.113] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x85 [0080.113] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=123, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x7b [0080.113] ReadFile (in: hFile=0x2b8, lpBuffer=0x27bf080, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27bf080*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.114] CloseHandle (hObject=0x2b8) returned 1 [0080.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", lpFilePart=0x0) returned 0x3c [0080.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), fInfoLevelId=0x0, lpFileInformation=0x282ba90 | out: lpFileInformation=0x282ba90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0080.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", lpFilePart=0x0) returned 0x3c [0080.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.116] GetFileType (hFile=0x2b8) returned 0x1 [0080.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.116] GetFileType (hFile=0x2b8) returned 0x1 [0080.116] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x85 [0080.116] ReadFile (in: hFile=0x2b8, lpBuffer=0x282bda8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x282bda8*, lpNumberOfBytesRead=0x1c9aea98*=0x85, lpOverlapped=0x0) returned 1 [0080.116] CloseHandle (hObject=0x2b8) returned 1 [0080.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", lpFilePart=0x0) returned 0x3c [0080.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.127] GetFileType (hFile=0x2b8) returned 0x1 [0080.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.127] GetFileType (hFile=0x2b8) returned 0x1 [0080.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", lpFilePart=0x0) returned 0x3c [0080.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", lpFilePart=0x0) returned 0x3c [0080.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.128] GetFileType (hFile=0x2b8) returned 0x1 [0080.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.128] GetFileType (hFile=0x2b8) returned 0x1 [0080.128] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x90 [0080.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", lpFilePart=0x0) returned 0x3c [0080.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOLnVybA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOLnVybA==", lpFilePart=0x0) returned 0x41 [0080.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.129] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd77a2de0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x9a)) returned 1 [0080.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.129] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOLnVybA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\tvnolnvyba==")) returned 1 [0080.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", lpFilePart=0x0) returned 0x43 [0080.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.133] GetFileType (hFile=0x2b8) returned 0x1 [0080.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.133] GetFileType (hFile=0x2b8) returned 0x1 [0080.133] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x85 [0080.133] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=123, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x7b [0080.133] ReadFile (in: hFile=0x2b8, lpBuffer=0x28a6e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28a6e10*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.134] CloseHandle (hObject=0x2b8) returned 1 [0080.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", lpFilePart=0x0) returned 0x43 [0080.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), fInfoLevelId=0x0, lpFileInformation=0x274c1b0 | out: lpFileInformation=0x274c1b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0080.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", lpFilePart=0x0) returned 0x43 [0080.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.143] GetFileType (hFile=0x2b8) returned 0x1 [0080.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.143] GetFileType (hFile=0x2b8) returned 0x1 [0080.143] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x85 [0080.143] ReadFile (in: hFile=0x2b8, lpBuffer=0x274c4f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x274c4f8*, lpNumberOfBytesRead=0x1c9aea98*=0x85, lpOverlapped=0x0) returned 1 [0080.143] CloseHandle (hObject=0x2b8) returned 1 [0080.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", lpFilePart=0x0) returned 0x43 [0080.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.178] GetFileType (hFile=0x2b8) returned 0x1 [0080.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.178] GetFileType (hFile=0x2b8) returned 0x1 [0080.178] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c44a0*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x27c44a0*, lpNumberOfBytesWritten=0x1c9ae9d8*=0x90, lpOverlapped=0x0) returned 1 [0080.179] CloseHandle (hObject=0x2b8) returned 1 [0080.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", lpFilePart=0x0) returned 0x43 [0080.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", lpFilePart=0x0) returned 0x43 [0080.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.180] GetFileType (hFile=0x2b8) returned 0x1 [0080.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.180] GetFileType (hFile=0x2b8) returned 0x1 [0080.180] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x90 [0080.180] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c62a8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27c62a8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.180] CloseHandle (hObject=0x2b8) returned 1 [0080.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", lpFilePart=0x0) returned 0x43 [0080.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOQkMgTmV3cy51cmw=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOQkMgTmV3cy51cmw=", lpFilePart=0x0) returned 0x49 [0080.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7815200, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x9a)) returned 1 [0080.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.181] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\TVNOQkMgTmV3cy51cmw=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\tvnoqkmgtmv3cy51cmw=")) returned 1 [0080.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\README_3728769.txt", lpFilePart=0x0) returned 0x47 [0080.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0080.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0080.182] GetFileType (hFile=0x2b8) returned 0x1 [0080.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0080.182] GetFileType (hFile=0x2b8) returned 0x1 [0080.182] WriteFile (in: hFile=0x2b8, lpBuffer=0x27ca5a0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x27ca5a0*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0080.183] CloseHandle (hObject=0x2b8) returned 1 [0080.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34 [0080.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x35 [0080.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.185] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.185] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0080.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0080.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34 [0080.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x35 [0080.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.187] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.187] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0080.188] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0080.188] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0080.188] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0080.188] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0080.188] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0080.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0080.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\README_3728769.txt", lpFilePart=0x0) returned 0x47 [0080.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0080.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0080.191] GetFileType (hFile=0x2b8) returned 0x1 [0080.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0080.191] GetFileType (hFile=0x2b8) returned 0x1 [0080.191] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d18a8*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x27d18a8*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0080.192] CloseHandle (hObject=0x2b8) returned 1 [0080.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\README_3728769.txt", lpFilePart=0x0) returned 0x3a [0080.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0080.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0080.192] GetFileType (hFile=0x2b8) returned 0x1 [0080.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0080.193] GetFileType (hFile=0x2b8) returned 0x1 [0080.193] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d5950*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x27d5950*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0080.194] CloseHandle (hObject=0x2b8) returned 1 [0080.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0080.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23 [0080.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24 [0080.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.194] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.194] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.194] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0080.194] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.195] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0080.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0080.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0080.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23 [0080.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24 [0080.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.195] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0080.196] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0080.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0080.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", lpFilePart=0x0) returned 0x2f [0080.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.197] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x244 [0080.197] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=570, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x23a [0080.197] ReadFile (in: hFile=0x2b8, lpBuffer=0x27d9550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27d9550*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", lpFilePart=0x0) returned 0x2f [0080.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.199] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x2845f60 | out: lpFileInformation=0x2845f60*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244)) returned 1 [0080.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0080.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", lpFilePart=0x0) returned 0x2f [0080.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0080.199] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x244 [0080.199] ReadFile (in: hFile=0x2b8, lpBuffer=0x2846408, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2846408*, lpNumberOfBytesRead=0x1c9aeb38*=0x244, lpOverlapped=0x0) returned 1 [0080.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", lpFilePart=0x0) returned 0x2f [0080.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0080.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab3e0) returned 1 [0080.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x2f [0080.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.212] GetFileType (hFile=0x2b8) returned 0x1 [0080.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.212] GetFileType (hFile=0x2b8) returned 0x1 [0080.212] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1e6 [0080.212] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=476, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1dc [0080.212] ReadFile (in: hFile=0x2b8, lpBuffer=0x28bf498, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28bf498*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.213] CloseHandle (hObject=0x2b8) returned 1 [0080.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x31 [0080.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.213] GetFileType (hFile=0x2b8) returned 0x1 [0080.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.213] GetFileType (hFile=0x2b8) returned 0x1 [0080.213] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x3a1 [0080.213] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=919, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x397 [0080.213] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c0750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28c0750*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.215] CloseHandle (hObject=0x2b8) returned 1 [0080.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x34 [0080.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.216] GetFileType (hFile=0x2b8) returned 0x1 [0080.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.216] GetFileType (hFile=0x2b8) returned 0x1 [0080.216] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x16b [0080.216] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=353, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x161 [0080.216] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c1a18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28c1a18*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.217] CloseHandle (hObject=0x2b8) returned 1 [0080.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\README_3728769.txt", lpFilePart=0x0) returned 0x36 [0080.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0080.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0080.219] GetFileType (hFile=0x2b8) returned 0x1 [0080.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0080.219] GetFileType (hFile=0x2b8) returned 0x1 [0080.219] WriteFile (in: hFile=0x2b8, lpBuffer=0x28c5ae0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x28c5ae0*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0080.220] CloseHandle (hObject=0x2b8) returned 1 [0080.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0080.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings", lpFilePart=0x0) returned 0x2c [0080.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\", lpFilePart=0x0) returned 0x2d [0080.220] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0080.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb80) returned 1 [0080.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0080.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0080.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0080.223] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9034bc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9034bc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.223] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9034bc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9034bc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f6d02e0, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0xaaa51880, ftLastAccessTime.dwHighDateTime=0x1d5dfec, ftLastWriteTime.dwLowDateTime=0xaaa51880, ftLastWriteTime.dwHighDateTime=0x1d5dfec, nFileSizeHigh=0x0, nFileSizeLow=0xc65b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2oBbX5SDdLUywM U.wav", cAlternateFileName="2OBBX5~1.WAV")) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a66000, ftCreationTime.dwHighDateTime=0x1d5d7e8, ftLastAccessTime.dwLowDateTime=0x2aa74d90, ftLastAccessTime.dwHighDateTime=0x1d5de13, ftLastWriteTime.dwLowDateTime=0x2aa74d90, ftLastWriteTime.dwHighDateTime=0x1d5de13, nFileSizeHigh=0x0, nFileSizeLow=0xe0a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="6tRlx6XwQ.wav", cAlternateFileName="6TRLX6~1.WAV")) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8a96a0, ftCreationTime.dwHighDateTime=0x1d5e217, ftLastAccessTime.dwLowDateTime=0x42d20c00, ftLastAccessTime.dwHighDateTime=0x1d5e284, ftLastWriteTime.dwLowDateTime=0x42d20c00, ftLastWriteTime.dwHighDateTime=0x1d5e284, nFileSizeHigh=0x0, nFileSizeLow=0x8f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="e0oxAuDL1d5B5WE8.mp3", cAlternateFileName="E0OXAU~1.MP3")) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca8a670, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x1fea20a0, ftLastAccessTime.dwHighDateTime=0x1d5e3de, ftLastWriteTime.dwLowDateTime=0x1fea20a0, ftLastWriteTime.dwHighDateTime=0x1d5e3de, nFileSizeHigh=0x0, nFileSizeLow=0xe9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="GNxqTolVqhW9oTpQM.mp3", cAlternateFileName="GNXQTO~1.MP3")) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc904a0, ftCreationTime.dwHighDateTime=0x1d5e7d2, ftLastAccessTime.dwLowDateTime=0x3590bcb0, ftLastAccessTime.dwHighDateTime=0x1d5e132, ftLastWriteTime.dwLowDateTime=0x3590bcb0, ftLastWriteTime.dwHighDateTime=0x1d5e132, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iksMYoBfEE2", cAlternateFileName="IKSMYO~1")) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4d2660, ftCreationTime.dwHighDateTime=0x1d5e6ae, ftLastAccessTime.dwLowDateTime=0xcb4fbc00, ftLastAccessTime.dwHighDateTime=0x1d5e6bf, ftLastWriteTime.dwLowDateTime=0xcb4fbc00, ftLastWriteTime.dwHighDateTime=0x1d5e6bf, nFileSizeHigh=0x0, nFileSizeLow=0xc223, dwReserved0=0x0, dwReserved1=0x0, cFileName="oNfR5k1coysg3.wav", cAlternateFileName="ONFR5K~1.WAV")) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4944c9f0, ftCreationTime.dwHighDateTime=0x1d5e44c, ftLastAccessTime.dwLowDateTime=0x9236b920, ftLastAccessTime.dwHighDateTime=0x1d5dee3, ftLastWriteTime.dwLowDateTime=0x9236b920, ftLastWriteTime.dwHighDateTime=0x1d5dee3, nFileSizeHigh=0x0, nFileSizeLow=0xcd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="SnQmH3PekKf.mp3", cAlternateFileName="SNQMH3~1.MP3")) returned 1 [0080.225] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf531d430, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xcf6b9640, ftLastAccessTime.dwHighDateTime=0x1d5de42, ftLastWriteTime.dwLowDateTime=0xcf6b9640, ftLastWriteTime.dwHighDateTime=0x1d5de42, nFileSizeHigh=0x0, nFileSizeLow=0x73af, dwReserved0=0x0, dwReserved1=0x0, cFileName="XWDbhYi2FLAjwi6Oo.m4a", cAlternateFileName="XWDBHY~1.M4A")) returned 1 [0080.225] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.225] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0080.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0080.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0080.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0080.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0080.226] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9034bc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9034bc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.226] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9034bc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9034bc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.226] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f6d02e0, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0xaaa51880, ftLastAccessTime.dwHighDateTime=0x1d5dfec, ftLastWriteTime.dwLowDateTime=0xaaa51880, ftLastWriteTime.dwHighDateTime=0x1d5dfec, nFileSizeHigh=0x0, nFileSizeLow=0xc65b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2oBbX5SDdLUywM U.wav", cAlternateFileName="2OBBX5~1.WAV")) returned 1 [0080.226] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a66000, ftCreationTime.dwHighDateTime=0x1d5d7e8, ftLastAccessTime.dwLowDateTime=0x2aa74d90, ftLastAccessTime.dwHighDateTime=0x1d5de13, ftLastWriteTime.dwLowDateTime=0x2aa74d90, ftLastWriteTime.dwHighDateTime=0x1d5de13, nFileSizeHigh=0x0, nFileSizeLow=0xe0a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="6tRlx6XwQ.wav", cAlternateFileName="6TRLX6~1.WAV")) returned 1 [0080.226] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.226] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8a96a0, ftCreationTime.dwHighDateTime=0x1d5e217, ftLastAccessTime.dwLowDateTime=0x42d20c00, ftLastAccessTime.dwHighDateTime=0x1d5e284, ftLastWriteTime.dwLowDateTime=0x42d20c00, ftLastWriteTime.dwHighDateTime=0x1d5e284, nFileSizeHigh=0x0, nFileSizeLow=0x8f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="e0oxAuDL1d5B5WE8.mp3", cAlternateFileName="E0OXAU~1.MP3")) returned 1 [0080.227] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca8a670, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x1fea20a0, ftLastAccessTime.dwHighDateTime=0x1d5e3de, ftLastWriteTime.dwLowDateTime=0x1fea20a0, ftLastWriteTime.dwHighDateTime=0x1d5e3de, nFileSizeHigh=0x0, nFileSizeLow=0xe9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="GNxqTolVqhW9oTpQM.mp3", cAlternateFileName="GNXQTO~1.MP3")) returned 1 [0080.227] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc904a0, ftCreationTime.dwHighDateTime=0x1d5e7d2, ftLastAccessTime.dwLowDateTime=0x3590bcb0, ftLastAccessTime.dwHighDateTime=0x1d5e132, ftLastWriteTime.dwLowDateTime=0x3590bcb0, ftLastWriteTime.dwHighDateTime=0x1d5e132, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iksMYoBfEE2", cAlternateFileName="IKSMYO~1")) returned 1 [0080.227] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4d2660, ftCreationTime.dwHighDateTime=0x1d5e6ae, ftLastAccessTime.dwLowDateTime=0xcb4fbc00, ftLastAccessTime.dwHighDateTime=0x1d5e6bf, ftLastWriteTime.dwLowDateTime=0xcb4fbc00, ftLastWriteTime.dwHighDateTime=0x1d5e6bf, nFileSizeHigh=0x0, nFileSizeLow=0xc223, dwReserved0=0x0, dwReserved1=0x0, cFileName="oNfR5k1coysg3.wav", cAlternateFileName="ONFR5K~1.WAV")) returned 1 [0080.227] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4944c9f0, ftCreationTime.dwHighDateTime=0x1d5e44c, ftLastAccessTime.dwLowDateTime=0x9236b920, ftLastAccessTime.dwHighDateTime=0x1d5dee3, ftLastWriteTime.dwLowDateTime=0x9236b920, ftLastWriteTime.dwHighDateTime=0x1d5dee3, nFileSizeHigh=0x0, nFileSizeLow=0xcd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="SnQmH3PekKf.mp3", cAlternateFileName="SNQMH3~1.MP3")) returned 1 [0080.227] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf531d430, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xcf6b9640, ftLastAccessTime.dwHighDateTime=0x1d5de42, ftLastWriteTime.dwLowDateTime=0xcf6b9640, ftLastWriteTime.dwHighDateTime=0x1d5de42, nFileSizeHigh=0x0, nFileSizeLow=0x73af, dwReserved0=0x0, dwReserved1=0x0, cFileName="XWDbhYi2FLAjwi6Oo.m4a", cAlternateFileName="XWDBHY~1.M4A")) returned 1 [0080.227] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf531d430, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xcf6b9640, ftLastAccessTime.dwHighDateTime=0x1d5de42, ftLastWriteTime.dwLowDateTime=0xcf6b9640, ftLastWriteTime.dwHighDateTime=0x1d5de42, nFileSizeHigh=0x0, nFileSizeLow=0x73af, dwReserved0=0x0, dwReserved1=0x0, cFileName="XWDbhYi2FLAjwi6Oo.m4a", cAlternateFileName="XWDBHY~1.M4A")) returned 0 [0080.227] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0080.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0080.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", lpFilePart=0x0) returned 0x38 [0080.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2obbx5sddluywm u.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.228] GetFileType (hFile=0x2b8) returned 0x1 [0080.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.228] GetFileType (hFile=0x2b8) returned 0x1 [0080.228] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xc65b [0080.228] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=50769, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xc651 [0080.228] ReadFile (in: hFile=0x2b8, lpBuffer=0x28cb9e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28cb9e8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.229] CloseHandle (hObject=0x2b8) returned 1 [0080.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11b98) returned 0x0 [0080.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", lpFilePart=0x0) returned 0x38 [0080.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.243] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2obbx5sddluywm u.wav"), fInfoLevelId=0x0, lpFileInformation=0x26e1158 | out: lpFileInformation=0x26e1158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f6d02e0, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0xaaa51880, ftLastAccessTime.dwHighDateTime=0x1d5dfec, ftLastWriteTime.dwLowDateTime=0xaaa51880, ftLastWriteTime.dwHighDateTime=0x1d5dfec, nFileSizeHigh=0x0, nFileSizeLow=0xc65b)) returned 1 [0080.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0080.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", lpFilePart=0x0) returned 0x38 [0080.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2obbx5sddluywm u.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.244] GetFileType (hFile=0x2b8) returned 0x1 [0080.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0080.244] GetFileType (hFile=0x2b8) returned 0x1 [0080.244] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xc65b [0080.244] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e1400, nNumberOfBytesToRead=0xc65b, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x26e1400*, lpNumberOfBytesRead=0x1c9aeb38*=0xc65b, lpOverlapped=0x0) returned 1 [0080.246] CloseHandle (hObject=0x2b8) returned 1 [0080.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", lpFilePart=0x0) returned 0x38 [0080.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2obbx5sddluywm u.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.294] GetFileType (hFile=0x2b8) returned 0x1 [0080.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.294] GetFileType (hFile=0x2b8) returned 0x1 [0080.294] WriteFile (in: hFile=0x2b8, lpBuffer=0x277d510*, nNumberOfBytesToWrite=0xc660, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x277d510*, lpNumberOfBytesWritten=0x1c9aebc8*=0xc660, lpOverlapped=0x0) returned 1 [0080.297] CloseHandle (hObject=0x2b8) returned 1 [0080.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", lpFilePart=0x0) returned 0x38 [0080.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", lpFilePart=0x0) returned 0x38 [0080.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0080.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2obbx5sddluywm u.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.297] GetFileType (hFile=0x2b8) returned 0x1 [0080.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0080.298] GetFileType (hFile=0x2b8) returned 0x1 [0080.298] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xc660 [0080.298] WriteFile (in: hFile=0x2b8, lpBuffer=0x278aab8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x278aab8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0080.298] CloseHandle (hObject=0x2b8) returned 1 [0080.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav", lpFilePart=0x0) returned 0x38 [0080.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Mm9CYlg1U0RkTFV5d00gVS53YXY=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Mm9CYlg1U0RkTFV5d00gVS53YXY=", lpFilePart=0x0) returned 0x40 [0080.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0080.298] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2obbx5sddluywm u.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f6d02e0, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0xaaa51880, ftLastAccessTime.dwHighDateTime=0x1d5dfec, ftLastWriteTime.dwLowDateTime=0xd7945d00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xc66a)) returned 1 [0080.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0080.298] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2oBbX5SDdLUywM U.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2obbx5sddluywm u.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Mm9CYlg1U0RkTFV5d00gVS53YXY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mm9cylg1u0rktfv5d00gvs53yxy=")) returned 1 [0080.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", lpFilePart=0x0) returned 0x31 [0080.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6trlx6xwq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.299] GetFileType (hFile=0x2b8) returned 0x1 [0080.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.299] GetFileType (hFile=0x2b8) returned 0x1 [0080.299] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xe0a4 [0080.299] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=57498, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xe09a [0080.299] ReadFile (in: hFile=0x2b8, lpBuffer=0x278be50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x278be50*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.300] CloseHandle (hObject=0x2b8) returned 1 [0080.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", lpFilePart=0x0) returned 0x31 [0080.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.302] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6trlx6xwq.wav"), fInfoLevelId=0x0, lpFileInformation=0x27f8a80 | out: lpFileInformation=0x27f8a80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a66000, ftCreationTime.dwHighDateTime=0x1d5d7e8, ftLastAccessTime.dwLowDateTime=0x2aa74d90, ftLastAccessTime.dwHighDateTime=0x1d5de13, ftLastWriteTime.dwLowDateTime=0x2aa74d90, ftLastWriteTime.dwHighDateTime=0x1d5de13, nFileSizeHigh=0x0, nFileSizeLow=0xe0a4)) returned 1 [0080.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0080.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", lpFilePart=0x0) returned 0x31 [0080.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6trlx6xwq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.302] GetFileType (hFile=0x2b8) returned 0x1 [0080.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0080.302] GetFileType (hFile=0x2b8) returned 0x1 [0080.302] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xe0a4 [0080.302] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f8ce8, nNumberOfBytesToRead=0xe0a4, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27f8ce8*, lpNumberOfBytesRead=0x1c9aeb38*=0xe0a4, lpOverlapped=0x0) returned 1 [0080.302] CloseHandle (hObject=0x2b8) returned 1 [0080.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", lpFilePart=0x0) returned 0x31 [0080.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6trlx6xwq.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.316] GetFileType (hFile=0x2b8) returned 0x1 [0080.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.316] GetFileType (hFile=0x2b8) returned 0x1 [0080.316] WriteFile (in: hFile=0x2b8, lpBuffer=0x2899858*, nNumberOfBytesToWrite=0xe0b0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2899858*, lpNumberOfBytesWritten=0x1c9aebc8*=0xe0b0, lpOverlapped=0x0) returned 1 [0080.317] CloseHandle (hObject=0x2b8) returned 1 [0080.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", lpFilePart=0x0) returned 0x31 [0080.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", lpFilePart=0x0) returned 0x31 [0080.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0080.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6trlx6xwq.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.318] GetFileType (hFile=0x2b8) returned 0x1 [0080.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0080.318] GetFileType (hFile=0x2b8) returned 0x1 [0080.318] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xe0b0 [0080.318] WriteFile (in: hFile=0x2b8, lpBuffer=0x28a87c8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28a87c8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0080.318] CloseHandle (hObject=0x2b8) returned 1 [0080.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav", lpFilePart=0x0) returned 0x31 [0080.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NnRSbHg2WHdRLndhdg==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NnRSbHg2WHdRLndhdg==", lpFilePart=0x0) returned 0x38 [0080.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0080.318] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6trlx6xwq.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a66000, ftCreationTime.dwHighDateTime=0x1d5d7e8, ftLastAccessTime.dwLowDateTime=0x2aa74d90, ftLastAccessTime.dwHighDateTime=0x1d5de13, ftLastWriteTime.dwLowDateTime=0xd796be60, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe0ba)) returned 1 [0080.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0080.318] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6tRlx6XwQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6trlx6xwq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NnRSbHg2WHdRLndhdg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nnrsbhg2whdrlndhdg==")) returned 1 [0080.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", lpFilePart=0x0) returned 0x2f [0080.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.319] GetFileType (hFile=0x2b8) returned 0x1 [0080.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.319] GetFileType (hFile=0x2b8) returned 0x1 [0080.319] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1f8 [0080.319] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=494, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1ee [0080.319] ReadFile (in: hFile=0x2b8, lpBuffer=0x28a9b20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28a9b20*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.320] CloseHandle (hObject=0x2b8) returned 1 [0080.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", lpFilePart=0x0) returned 0x2f [0080.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.325] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x273b898 | out: lpFileInformation=0x273b898*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1 [0080.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0080.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", lpFilePart=0x0) returned 0x2f [0080.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.326] GetFileType (hFile=0x2b8) returned 0x1 [0080.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0080.326] GetFileType (hFile=0x2b8) returned 0x1 [0080.326] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x1f8 [0080.326] ReadFile (in: hFile=0x2b8, lpBuffer=0x273bcf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x273bcf0*, lpNumberOfBytesRead=0x1c9aeb38*=0x1f8, lpOverlapped=0x0) returned 1 [0080.326] CloseHandle (hObject=0x2b8) returned 1 [0080.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", lpFilePart=0x0) returned 0x2f [0080.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0080.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab3e0) returned 1 [0080.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", lpFilePart=0x0) returned 0x38 [0080.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\e0oxaudl1d5b5we8.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.337] GetFileType (hFile=0x2b8) returned 0x1 [0080.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.337] GetFileType (hFile=0x2b8) returned 0x1 [0080.337] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x8f34 [0080.337] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=36650, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x8f2a [0080.337] ReadFile (in: hFile=0x2b8, lpBuffer=0x27b4eb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27b4eb0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.338] CloseHandle (hObject=0x2b8) returned 1 [0080.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11b98) returned 0x0 [0080.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", lpFilePart=0x0) returned 0x38 [0080.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\e0oxaudl1d5b5we8.mp3"), fInfoLevelId=0x0, lpFileInformation=0x28219a0 | out: lpFileInformation=0x28219a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8a96a0, ftCreationTime.dwHighDateTime=0x1d5e217, ftLastAccessTime.dwLowDateTime=0x42d20c00, ftLastAccessTime.dwHighDateTime=0x1d5e284, ftLastWriteTime.dwLowDateTime=0x42d20c00, ftLastWriteTime.dwHighDateTime=0x1d5e284, nFileSizeHigh=0x0, nFileSizeLow=0x8f34)) returned 1 [0080.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0080.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", lpFilePart=0x0) returned 0x38 [0080.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\e0oxaudl1d5b5we8.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.345] GetFileType (hFile=0x2b8) returned 0x1 [0080.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0080.345] GetFileType (hFile=0x2b8) returned 0x1 [0080.345] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x8f34 [0080.345] ReadFile (in: hFile=0x2b8, lpBuffer=0x2821c48, nNumberOfBytesToRead=0x8f34, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2821c48*, lpNumberOfBytesRead=0x1c9aeb38*=0x8f34, lpOverlapped=0x0) returned 1 [0080.345] CloseHandle (hObject=0x2b8) returned 1 [0080.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", lpFilePart=0x0) returned 0x38 [0080.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\e0oxaudl1d5b5we8.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.372] GetFileType (hFile=0x2b8) returned 0x1 [0080.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.372] GetFileType (hFile=0x2b8) returned 0x1 [0080.372] WriteFile (in: hFile=0x2b8, lpBuffer=0x28c51e0*, nNumberOfBytesToWrite=0x8f40, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x28c51e0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x8f40, lpOverlapped=0x0) returned 1 [0080.374] CloseHandle (hObject=0x2b8) returned 1 [0080.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", lpFilePart=0x0) returned 0x38 [0080.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", lpFilePart=0x0) returned 0x38 [0080.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0080.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\e0oxaudl1d5b5we8.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.375] GetFileType (hFile=0x2b8) returned 0x1 [0080.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0080.375] GetFileType (hFile=0x2b8) returned 0x1 [0080.375] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x8f40 [0080.375] WriteFile (in: hFile=0x2b8, lpBuffer=0x28cf068*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28cf068*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0080.375] CloseHandle (hObject=0x2b8) returned 1 [0080.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3", lpFilePart=0x0) returned 0x38 [0080.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZTBveEF1REwxZDVCNVdFOC5tcDM=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZTBveEF1REwxZDVCNVdFOC5tcDM=", lpFilePart=0x0) returned 0x40 [0080.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0080.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\e0oxaudl1d5b5we8.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8a96a0, ftCreationTime.dwHighDateTime=0x1d5e217, ftLastAccessTime.dwLowDateTime=0x42d20c00, ftLastAccessTime.dwHighDateTime=0x1d5e284, ftLastWriteTime.dwLowDateTime=0xd7a043e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x8f4a)) returned 1 [0080.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0080.376] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\e0oxAuDL1d5B5WE8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\e0oxaudl1d5b5we8.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZTBveEF1REwxZDVCNVdFOC5tcDM=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ztbveef1rewxzdvcnvdfoc5tcdm=")) returned 1 [0080.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", lpFilePart=0x0) returned 0x39 [0080.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gnxqtolvqhw9otpqm.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.376] GetFileType (hFile=0x2b8) returned 0x1 [0080.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.376] GetFileType (hFile=0x2b8) returned 0x1 [0080.376] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xe9e4 [0080.377] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=59866, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xe9da [0080.377] ReadFile (in: hFile=0x2b8, lpBuffer=0x28d0420, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28d0420*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.377] CloseHandle (hObject=0x2b8) returned 1 [0080.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11b98) returned 0x0 [0080.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", lpFilePart=0x0) returned 0x39 [0080.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.386] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gnxqtolvqhw9otpqm.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2768b98 | out: lpFileInformation=0x2768b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca8a670, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x1fea20a0, ftLastAccessTime.dwHighDateTime=0x1d5e3de, ftLastWriteTime.dwLowDateTime=0x1fea20a0, ftLastWriteTime.dwHighDateTime=0x1d5e3de, nFileSizeHigh=0x0, nFileSizeLow=0xe9e4)) returned 1 [0080.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0080.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", lpFilePart=0x0) returned 0x39 [0080.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gnxqtolvqhw9otpqm.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.386] GetFileType (hFile=0x2b8) returned 0x1 [0080.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0080.386] GetFileType (hFile=0x2b8) returned 0x1 [0080.386] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xe9e4 [0080.387] ReadFile (in: hFile=0x2b8, lpBuffer=0x2768e40, nNumberOfBytesToRead=0xe9e4, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2768e40*, lpNumberOfBytesRead=0x1c9aeb38*=0xe9e4, lpOverlapped=0x0) returned 1 [0080.387] CloseHandle (hObject=0x2b8) returned 1 [0080.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", lpFilePart=0x0) returned 0x39 [0080.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gnxqtolvqhw9otpqm.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.424] GetFileType (hFile=0x2b8) returned 0x1 [0080.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.424] GetFileType (hFile=0x2b8) returned 0x1 [0080.424] WriteFile (in: hFile=0x2b8, lpBuffer=0x280b808*, nNumberOfBytesToWrite=0xe9f0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x280b808*, lpNumberOfBytesWritten=0x1c9aebc8*=0xe9f0, lpOverlapped=0x0) returned 1 [0080.426] CloseHandle (hObject=0x2b8) returned 1 [0080.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", lpFilePart=0x0) returned 0x39 [0080.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", lpFilePart=0x0) returned 0x39 [0080.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0080.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gnxqtolvqhw9otpqm.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.426] GetFileType (hFile=0x2b8) returned 0x1 [0080.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0080.426] GetFileType (hFile=0x2b8) returned 0x1 [0080.426] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xe9f0 [0080.427] WriteFile (in: hFile=0x2b8, lpBuffer=0x281b140*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x281b140*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0080.427] CloseHandle (hObject=0x2b8) returned 1 [0080.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3", lpFilePart=0x0) returned 0x39 [0080.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\R054cVRvbFZxaFc5b1RwUU0ubXAz", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\R054cVRvbFZxaFc5b1RwUU0ubXAz", lpFilePart=0x0) returned 0x40 [0080.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0080.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gnxqtolvqhw9otpqm.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca8a670, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x1fea20a0, ftLastAccessTime.dwHighDateTime=0x1d5e3de, ftLastWriteTime.dwLowDateTime=0xd7a76800, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xe9fa)) returned 1 [0080.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0080.427] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GNxqTolVqhW9oTpQM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gnxqtolvqhw9otpqm.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\R054cVRvbFZxaFc5b1RwUU0ubXAz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r054cvrvbfzxafc5b1rwuu0ubxaz")) returned 1 [0080.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", lpFilePart=0x0) returned 0x35 [0080.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\onfr5k1coysg3.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.428] GetFileType (hFile=0x2b8) returned 0x1 [0080.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.428] GetFileType (hFile=0x2b8) returned 0x1 [0080.428] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xc223 [0080.428] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=49689, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xc219 [0080.428] ReadFile (in: hFile=0x2b8, lpBuffer=0x281c4e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x281c4e8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.429] CloseHandle (hObject=0x2b8) returned 1 [0080.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", lpFilePart=0x0) returned 0x35 [0080.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.430] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\onfr5k1coysg3.wav"), fInfoLevelId=0x0, lpFileInformation=0x2889018 | out: lpFileInformation=0x2889018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4d2660, ftCreationTime.dwHighDateTime=0x1d5e6ae, ftLastAccessTime.dwLowDateTime=0xcb4fbc00, ftLastAccessTime.dwHighDateTime=0x1d5e6bf, ftLastWriteTime.dwLowDateTime=0xcb4fbc00, ftLastWriteTime.dwHighDateTime=0x1d5e6bf, nFileSizeHigh=0x0, nFileSizeLow=0xc223)) returned 1 [0080.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0080.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", lpFilePart=0x0) returned 0x35 [0080.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\onfr5k1coysg3.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.430] GetFileType (hFile=0x2b8) returned 0x1 [0080.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0080.431] GetFileType (hFile=0x2b8) returned 0x1 [0080.431] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xc223 [0080.431] ReadFile (in: hFile=0x2b8, lpBuffer=0x28892a0, nNumberOfBytesToRead=0xc223, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28892a0*, lpNumberOfBytesRead=0x1c9aeb38*=0xc223, lpOverlapped=0x0) returned 1 [0080.431] CloseHandle (hObject=0x2b8) returned 1 [0080.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", lpFilePart=0x0) returned 0x35 [0080.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\onfr5k1coysg3.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.450] GetFileType (hFile=0x2b8) returned 0x1 [0080.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.450] GetFileType (hFile=0x2b8) returned 0x1 [0080.450] WriteFile (in: hFile=0x2b8, lpBuffer=0x26f2430*, nNumberOfBytesToWrite=0xc230, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x26f2430*, lpNumberOfBytesWritten=0x1c9aebc8*=0xc230, lpOverlapped=0x0) returned 1 [0080.452] CloseHandle (hObject=0x2b8) returned 1 [0080.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", lpFilePart=0x0) returned 0x35 [0080.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", lpFilePart=0x0) returned 0x35 [0080.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0080.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\onfr5k1coysg3.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.453] GetFileType (hFile=0x2b8) returned 0x1 [0080.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0080.453] GetFileType (hFile=0x2b8) returned 0x1 [0080.453] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xc230 [0080.453] WriteFile (in: hFile=0x2b8, lpBuffer=0x26ff568*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x26ff568*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0080.453] CloseHandle (hObject=0x2b8) returned 1 [0080.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav", lpFilePart=0x0) returned 0x35 [0080.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\b05mUjVrMWNveXNnMy53YXY=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\b05mUjVrMWNveXNnMy53YXY=", lpFilePart=0x0) returned 0x3c [0080.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0080.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\onfr5k1coysg3.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4d2660, ftCreationTime.dwHighDateTime=0x1d5e6ae, ftLastAccessTime.dwLowDateTime=0xcb4fbc00, ftLastAccessTime.dwHighDateTime=0x1d5e6bf, ftLastWriteTime.dwLowDateTime=0xd7ac2ac0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xc23a)) returned 1 [0080.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0080.454] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oNfR5k1coysg3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\onfr5k1coysg3.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\b05mUjVrMWNveXNnMy53YXY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\b05mujvrmwnvexnnmy53yxy=")) returned 1 [0080.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", lpFilePart=0x0) returned 0x33 [0080.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\snqmh3pekkf.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.454] GetFileType (hFile=0x2b8) returned 0x1 [0080.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.455] GetFileType (hFile=0x2b8) returned 0x1 [0080.455] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xcd45 [0080.455] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=52539, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xcd3b [0080.455] ReadFile (in: hFile=0x2b8, lpBuffer=0x27008e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27008e8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.456] CloseHandle (hObject=0x2b8) returned 1 [0080.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11b98) returned 0x0 [0080.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", lpFilePart=0x0) returned 0x33 [0080.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\snqmh3pekkf.mp3"), fInfoLevelId=0x0, lpFileInformation=0x276d498 | out: lpFileInformation=0x276d498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4944c9f0, ftCreationTime.dwHighDateTime=0x1d5e44c, ftLastAccessTime.dwLowDateTime=0x9236b920, ftLastAccessTime.dwHighDateTime=0x1d5dee3, ftLastWriteTime.dwLowDateTime=0x9236b920, ftLastWriteTime.dwHighDateTime=0x1d5dee3, nFileSizeHigh=0x0, nFileSizeLow=0xcd45)) returned 1 [0080.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0080.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", lpFilePart=0x0) returned 0x33 [0080.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\snqmh3pekkf.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.462] GetFileType (hFile=0x2b8) returned 0x1 [0080.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0080.462] GetFileType (hFile=0x2b8) returned 0x1 [0080.462] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xcd45 [0080.463] ReadFile (in: hFile=0x2b8, lpBuffer=0x276d700, nNumberOfBytesToRead=0xcd45, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x276d700*, lpNumberOfBytesRead=0x1c9aeb38*=0xcd45, lpOverlapped=0x0) returned 1 [0080.463] CloseHandle (hObject=0x2b8) returned 1 [0080.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", lpFilePart=0x0) returned 0x33 [0080.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\snqmh3pekkf.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.491] GetFileType (hFile=0x2b8) returned 0x1 [0080.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.491] GetFileType (hFile=0x2b8) returned 0x1 [0080.491] WriteFile (in: hFile=0x2b8, lpBuffer=0x280aae8*, nNumberOfBytesToWrite=0xcd50, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x280aae8*, lpNumberOfBytesWritten=0x1c9aebc8*=0xcd50, lpOverlapped=0x0) returned 1 [0080.493] CloseHandle (hObject=0x2b8) returned 1 [0080.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", lpFilePart=0x0) returned 0x33 [0080.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", lpFilePart=0x0) returned 0x33 [0080.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0080.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\snqmh3pekkf.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.496] GetFileType (hFile=0x2b8) returned 0x1 [0080.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0080.496] GetFileType (hFile=0x2b8) returned 0x1 [0080.496] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xcd50 [0080.496] WriteFile (in: hFile=0x2b8, lpBuffer=0x28188f0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28188f0*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0080.496] CloseHandle (hObject=0x2b8) returned 1 [0080.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3", lpFilePart=0x0) returned 0x33 [0080.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\U25RbUgzUGVrS2YubXAz", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\U25RbUgzUGVrS2YubXAz", lpFilePart=0x0) returned 0x38 [0080.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0080.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\snqmh3pekkf.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4944c9f0, ftCreationTime.dwHighDateTime=0x1d5e44c, ftLastAccessTime.dwLowDateTime=0x9236b920, ftLastAccessTime.dwHighDateTime=0x1d5dee3, ftLastWriteTime.dwLowDateTime=0xd7b34ee0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xcd5a)) returned 1 [0080.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0080.496] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SnQmH3PekKf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\snqmh3pekkf.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\U25RbUgzUGVrS2YubXAz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\u25rbugzugvrs2yubxaz")) returned 1 [0080.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", lpFilePart=0x0) returned 0x39 [0080.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0080.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xwdbhyi2flajwi6oo.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.497] GetFileType (hFile=0x2b8) returned 0x1 [0080.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0080.497] GetFileType (hFile=0x2b8) returned 0x1 [0080.497] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x73af [0080.497] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=29605, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x73a5 [0080.497] ReadFile (in: hFile=0x2b8, lpBuffer=0x2819c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2819c78*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0080.498] CloseHandle (hObject=0x2b8) returned 1 [0080.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11b98) returned 0x0 [0080.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", lpFilePart=0x0) returned 0x39 [0080.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xwdbhyi2flajwi6oo.m4a"), fInfoLevelId=0x0, lpFileInformation=0x28867e8 | out: lpFileInformation=0x28867e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf531d430, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xcf6b9640, ftLastAccessTime.dwHighDateTime=0x1d5de42, ftLastWriteTime.dwLowDateTime=0xcf6b9640, ftLastWriteTime.dwHighDateTime=0x1d5de42, nFileSizeHigh=0x0, nFileSizeLow=0x73af)) returned 1 [0080.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0080.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", lpFilePart=0x0) returned 0x39 [0080.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xwdbhyi2flajwi6oo.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.500] GetFileType (hFile=0x2b8) returned 0x1 [0080.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0080.501] GetFileType (hFile=0x2b8) returned 0x1 [0080.501] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x73af [0080.501] ReadFile (in: hFile=0x2b8, lpBuffer=0x2886a90, nNumberOfBytesToRead=0x73af, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2886a90*, lpNumberOfBytesRead=0x1c9aeb38*=0x73af, lpOverlapped=0x0) returned 1 [0080.501] CloseHandle (hObject=0x2b8) returned 1 [0080.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", lpFilePart=0x0) returned 0x39 [0080.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xwdbhyi2flajwi6oo.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.528] GetFileType (hFile=0x2b8) returned 0x1 [0080.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.528] GetFileType (hFile=0x2b8) returned 0x1 [0080.528] WriteFile (in: hFile=0x2b8, lpBuffer=0x2753088*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2753088*, lpNumberOfBytesWritten=0x1c9aebc8*=0x73b0, lpOverlapped=0x0) returned 1 [0080.529] CloseHandle (hObject=0x2b8) returned 1 [0080.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", lpFilePart=0x0) returned 0x39 [0080.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", lpFilePart=0x0) returned 0x39 [0080.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0080.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xwdbhyi2flajwi6oo.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.529] GetFileType (hFile=0x2b8) returned 0x1 [0080.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0080.529] GetFileType (hFile=0x2b8) returned 0x1 [0080.529] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x73b0 [0080.530] WriteFile (in: hFile=0x2b8, lpBuffer=0x275b380*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x275b380*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0080.530] CloseHandle (hObject=0x2b8) returned 1 [0080.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a", lpFilePart=0x0) returned 0x39 [0080.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WFdEYmhZaTJGTEFqd2k2T28ubTRh", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WFdEYmhZaTJGTEFqd2k2T28ubTRh", lpFilePart=0x0) returned 0x40 [0080.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0080.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xwdbhyi2flajwi6oo.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf531d430, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xcf6b9640, ftLastAccessTime.dwHighDateTime=0x1d5de42, ftLastWriteTime.dwLowDateTime=0xd7b811a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x73ba)) returned 1 [0080.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0080.530] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\XWDbhYi2FLAjwi6Oo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xwdbhyi2flajwi6oo.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WFdEYmhZaTJGTEFqd2k2T28ubTRh" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wfdeymhzatjgtefqd2k2t28ubtrh")) returned 1 [0080.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2", lpFilePart=0x0) returned 0x2f [0080.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\", lpFilePart=0x0) returned 0x30 [0080.531] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc904a0, ftCreationTime.dwHighDateTime=0x1d5e7d2, ftLastAccessTime.dwLowDateTime=0x3590bcb0, ftLastAccessTime.dwHighDateTime=0x1d5e132, ftLastWriteTime.dwLowDateTime=0x3590bcb0, ftLastWriteTime.dwHighDateTime=0x1d5e132, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.531] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc904a0, ftCreationTime.dwHighDateTime=0x1d5e7d2, ftLastAccessTime.dwLowDateTime=0x3590bcb0, ftLastAccessTime.dwHighDateTime=0x1d5e132, ftLastWriteTime.dwLowDateTime=0x3590bcb0, ftLastWriteTime.dwHighDateTime=0x1d5e132, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.531] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebad2050, ftCreationTime.dwHighDateTime=0x1d5dee0, ftLastAccessTime.dwLowDateTime=0xdac81e0, ftLastAccessTime.dwHighDateTime=0x1d5df73, ftLastWriteTime.dwLowDateTime=0xdac81e0, ftLastWriteTime.dwHighDateTime=0x1d5df73, nFileSizeHigh=0x0, nFileSizeLow=0x1d4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2 7mYTYrw4Ki_witXDWE.m4a", cAlternateFileName="27MYTY~1.M4A")) returned 1 [0080.531] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf992fc0, ftCreationTime.dwHighDateTime=0x1d5d956, ftLastAccessTime.dwLowDateTime=0x9ccd8780, ftLastAccessTime.dwHighDateTime=0x1d5d856, ftLastWriteTime.dwLowDateTime=0x9ccd8780, ftLastWriteTime.dwHighDateTime=0x1d5d856, nFileSizeHigh=0x0, nFileSizeLow=0x60e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="F7HE 2UPOfAxz.mp3", cAlternateFileName="F7HE2U~1.MP3")) returned 1 [0080.531] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7482e560, ftCreationTime.dwHighDateTime=0x1d5e790, ftLastAccessTime.dwLowDateTime=0x51aba7c0, ftLastAccessTime.dwHighDateTime=0x1d5d813, ftLastWriteTime.dwLowDateTime=0x51aba7c0, ftLastWriteTime.dwHighDateTime=0x1d5d813, nFileSizeHigh=0x0, nFileSizeLow=0x18e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="fv8 1np6ve5GO7h8.wav", cAlternateFileName="FV81NP~1.WAV")) returned 1 [0080.532] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6778aac0, ftCreationTime.dwHighDateTime=0x1d5d88c, ftLastAccessTime.dwLowDateTime=0x25a262f0, ftLastAccessTime.dwHighDateTime=0x1d5da47, ftLastWriteTime.dwLowDateTime=0x25a262f0, ftLastWriteTime.dwHighDateTime=0x1d5da47, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jlPduVx2WRA9sDc", cAlternateFileName="JLPDUV~1")) returned 1 [0080.532] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9796420, ftCreationTime.dwHighDateTime=0x1d5deca, ftLastAccessTime.dwLowDateTime=0x282a3240, ftLastAccessTime.dwHighDateTime=0x1d5de58, ftLastWriteTime.dwLowDateTime=0x282a3240, ftLastWriteTime.dwHighDateTime=0x1d5de58, nFileSizeHigh=0x0, nFileSizeLow=0x11c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="KFScKq5uSIDuAP3cA.mp3", cAlternateFileName="KFSCKQ~1.MP3")) returned 1 [0080.532] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd975540, ftCreationTime.dwHighDateTime=0x1d5d96a, ftLastAccessTime.dwLowDateTime=0x8201e540, ftLastAccessTime.dwHighDateTime=0x1d5d860, ftLastWriteTime.dwLowDateTime=0x8201e540, ftLastWriteTime.dwHighDateTime=0x1d5d860, nFileSizeHigh=0x0, nFileSizeLow=0x11fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="milnqdqKJu ApTg.mp3", cAlternateFileName="MILNQD~1.MP3")) returned 1 [0080.532] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f52420, ftCreationTime.dwHighDateTime=0x1d5db8e, ftLastAccessTime.dwLowDateTime=0xd91b80b0, ftLastAccessTime.dwHighDateTime=0x1d5da1e, ftLastWriteTime.dwLowDateTime=0xd91b80b0, ftLastWriteTime.dwHighDateTime=0x1d5da1e, nFileSizeHigh=0x0, nFileSizeLow=0x10abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="mMCR7N4J5mjcqL rT1H.mp3", cAlternateFileName="MMCR7N~1.MP3")) returned 1 [0080.532] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b07120, ftCreationTime.dwHighDateTime=0x1d5e66d, ftLastAccessTime.dwLowDateTime=0xc106d320, ftLastAccessTime.dwHighDateTime=0x1d5e4d3, ftLastWriteTime.dwLowDateTime=0xc106d320, ftLastWriteTime.dwHighDateTime=0x1d5e4d3, nFileSizeHigh=0x0, nFileSizeLow=0xf615, dwReserved0=0x0, dwReserved1=0x0, cFileName="msuXi KWKtdtM-1IhJmT.m4a", cAlternateFileName="MSUXIK~1.M4A")) returned 1 [0080.532] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594e3f80, ftCreationTime.dwHighDateTime=0x1d5de83, ftLastAccessTime.dwLowDateTime=0x4bf8760, ftLastAccessTime.dwHighDateTime=0x1d5dc46, ftLastWriteTime.dwLowDateTime=0x4bf8760, ftLastWriteTime.dwHighDateTime=0x1d5dc46, nFileSizeHigh=0x0, nFileSizeLow=0x1194e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sQotlUiR4KyrcZ.wav", cAlternateFileName="SQOTLU~1.WAV")) returned 1 [0080.532] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa296f870, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x9c71ae00, ftLastAccessTime.dwHighDateTime=0x1d5e7cf, ftLastWriteTime.dwLowDateTime=0x9c71ae00, ftLastWriteTime.dwHighDateTime=0x1d5e7cf, nFileSizeHigh=0x0, nFileSizeLow=0x123c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xT2W-.wav", cAlternateFileName="")) returned 1 [0080.532] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a485070, ftCreationTime.dwHighDateTime=0x1d5e55a, ftLastAccessTime.dwLowDateTime=0xd09a0cb0, ftLastAccessTime.dwHighDateTime=0x1d5e5ac, ftLastWriteTime.dwLowDateTime=0xd09a0cb0, ftLastWriteTime.dwHighDateTime=0x1d5e5ac, nFileSizeHigh=0x0, nFileSizeLow=0x174f, dwReserved0=0x0, dwReserved1=0x0, cFileName="z8rGEtdbrKMO6h.m4a", cAlternateFileName="Z8RGET~1.M4A")) returned 1 [0080.533] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.533] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0080.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0080.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0080.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2", lpFilePart=0x0) returned 0x2f [0080.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\", lpFilePart=0x0) returned 0x30 [0080.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc904a0, ftCreationTime.dwHighDateTime=0x1d5e7d2, ftLastAccessTime.dwLowDateTime=0x3590bcb0, ftLastAccessTime.dwHighDateTime=0x1d5e132, ftLastWriteTime.dwLowDateTime=0x3590bcb0, ftLastWriteTime.dwHighDateTime=0x1d5e132, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.533] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc904a0, ftCreationTime.dwHighDateTime=0x1d5e7d2, ftLastAccessTime.dwLowDateTime=0x3590bcb0, ftLastAccessTime.dwHighDateTime=0x1d5e132, ftLastWriteTime.dwLowDateTime=0x3590bcb0, ftLastWriteTime.dwHighDateTime=0x1d5e132, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.533] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebad2050, ftCreationTime.dwHighDateTime=0x1d5dee0, ftLastAccessTime.dwLowDateTime=0xdac81e0, ftLastAccessTime.dwHighDateTime=0x1d5df73, ftLastWriteTime.dwLowDateTime=0xdac81e0, ftLastWriteTime.dwHighDateTime=0x1d5df73, nFileSizeHigh=0x0, nFileSizeLow=0x1d4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2 7mYTYrw4Ki_witXDWE.m4a", cAlternateFileName="27MYTY~1.M4A")) returned 1 [0080.533] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf992fc0, ftCreationTime.dwHighDateTime=0x1d5d956, ftLastAccessTime.dwLowDateTime=0x9ccd8780, ftLastAccessTime.dwHighDateTime=0x1d5d856, ftLastWriteTime.dwLowDateTime=0x9ccd8780, ftLastWriteTime.dwHighDateTime=0x1d5d856, nFileSizeHigh=0x0, nFileSizeLow=0x60e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="F7HE 2UPOfAxz.mp3", cAlternateFileName="F7HE2U~1.MP3")) returned 1 [0080.534] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7482e560, ftCreationTime.dwHighDateTime=0x1d5e790, ftLastAccessTime.dwLowDateTime=0x51aba7c0, ftLastAccessTime.dwHighDateTime=0x1d5d813, ftLastWriteTime.dwLowDateTime=0x51aba7c0, ftLastWriteTime.dwHighDateTime=0x1d5d813, nFileSizeHigh=0x0, nFileSizeLow=0x18e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="fv8 1np6ve5GO7h8.wav", cAlternateFileName="FV81NP~1.WAV")) returned 1 [0080.534] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6778aac0, ftCreationTime.dwHighDateTime=0x1d5d88c, ftLastAccessTime.dwLowDateTime=0x25a262f0, ftLastAccessTime.dwHighDateTime=0x1d5da47, ftLastWriteTime.dwLowDateTime=0x25a262f0, ftLastWriteTime.dwHighDateTime=0x1d5da47, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jlPduVx2WRA9sDc", cAlternateFileName="JLPDUV~1")) returned 1 [0080.534] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9796420, ftCreationTime.dwHighDateTime=0x1d5deca, ftLastAccessTime.dwLowDateTime=0x282a3240, ftLastAccessTime.dwHighDateTime=0x1d5de58, ftLastWriteTime.dwLowDateTime=0x282a3240, ftLastWriteTime.dwHighDateTime=0x1d5de58, nFileSizeHigh=0x0, nFileSizeLow=0x11c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="KFScKq5uSIDuAP3cA.mp3", cAlternateFileName="KFSCKQ~1.MP3")) returned 1 [0080.534] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd975540, ftCreationTime.dwHighDateTime=0x1d5d96a, ftLastAccessTime.dwLowDateTime=0x8201e540, ftLastAccessTime.dwHighDateTime=0x1d5d860, ftLastWriteTime.dwLowDateTime=0x8201e540, ftLastWriteTime.dwHighDateTime=0x1d5d860, nFileSizeHigh=0x0, nFileSizeLow=0x11fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="milnqdqKJu ApTg.mp3", cAlternateFileName="MILNQD~1.MP3")) returned 1 [0080.534] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f52420, ftCreationTime.dwHighDateTime=0x1d5db8e, ftLastAccessTime.dwLowDateTime=0xd91b80b0, ftLastAccessTime.dwHighDateTime=0x1d5da1e, ftLastWriteTime.dwLowDateTime=0xd91b80b0, ftLastWriteTime.dwHighDateTime=0x1d5da1e, nFileSizeHigh=0x0, nFileSizeLow=0x10abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="mMCR7N4J5mjcqL rT1H.mp3", cAlternateFileName="MMCR7N~1.MP3")) returned 1 [0080.534] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b07120, ftCreationTime.dwHighDateTime=0x1d5e66d, ftLastAccessTime.dwLowDateTime=0xc106d320, ftLastAccessTime.dwHighDateTime=0x1d5e4d3, ftLastWriteTime.dwLowDateTime=0xc106d320, ftLastWriteTime.dwHighDateTime=0x1d5e4d3, nFileSizeHigh=0x0, nFileSizeLow=0xf615, dwReserved0=0x0, dwReserved1=0x0, cFileName="msuXi KWKtdtM-1IhJmT.m4a", cAlternateFileName="MSUXIK~1.M4A")) returned 1 [0080.535] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594e3f80, ftCreationTime.dwHighDateTime=0x1d5de83, ftLastAccessTime.dwLowDateTime=0x4bf8760, ftLastAccessTime.dwHighDateTime=0x1d5dc46, ftLastWriteTime.dwLowDateTime=0x4bf8760, ftLastWriteTime.dwHighDateTime=0x1d5dc46, nFileSizeHigh=0x0, nFileSizeLow=0x1194e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sQotlUiR4KyrcZ.wav", cAlternateFileName="SQOTLU~1.WAV")) returned 1 [0080.535] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa296f870, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x9c71ae00, ftLastAccessTime.dwHighDateTime=0x1d5e7cf, ftLastWriteTime.dwLowDateTime=0x9c71ae00, ftLastWriteTime.dwHighDateTime=0x1d5e7cf, nFileSizeHigh=0x0, nFileSizeLow=0x123c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xT2W-.wav", cAlternateFileName="")) returned 1 [0080.535] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a485070, ftCreationTime.dwHighDateTime=0x1d5e55a, ftLastAccessTime.dwLowDateTime=0xd09a0cb0, ftLastAccessTime.dwHighDateTime=0x1d5e5ac, ftLastWriteTime.dwLowDateTime=0xd09a0cb0, ftLastWriteTime.dwHighDateTime=0x1d5e5ac, nFileSizeHigh=0x0, nFileSizeLow=0x174f, dwReserved0=0x0, dwReserved1=0x0, cFileName="z8rGEtdbrKMO6h.m4a", cAlternateFileName="Z8RGET~1.M4A")) returned 1 [0080.535] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a485070, ftCreationTime.dwHighDateTime=0x1d5e55a, ftLastAccessTime.dwLowDateTime=0xd09a0cb0, ftLastAccessTime.dwHighDateTime=0x1d5e5ac, ftLastWriteTime.dwLowDateTime=0xd09a0cb0, ftLastWriteTime.dwHighDateTime=0x1d5e5ac, nFileSizeHigh=0x0, nFileSizeLow=0x174f, dwReserved0=0x0, dwReserved1=0x0, cFileName="z8rGEtdbrKMO6h.m4a", cAlternateFileName="Z8RGET~1.M4A")) returned 0 [0080.535] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0080.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0080.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", lpFilePart=0x0) returned 0x48 [0080.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\2 7mytyrw4ki_witxdwe.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.535] GetFileType (hFile=0x2b8) returned 0x1 [0080.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.536] GetFileType (hFile=0x2b8) returned 0x1 [0080.536] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x1d4d [0080.536] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=7491, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x1d43 [0080.536] ReadFile (in: hFile=0x2b8, lpBuffer=0x2761598, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2761598*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.537] CloseHandle (hObject=0x2b8) returned 1 [0080.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", lpFilePart=0x0) returned 0x48 [0080.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\2 7mytyrw4ki_witxdwe.m4a"), fInfoLevelId=0x0, lpFileInformation=0x27ce0c8 | out: lpFileInformation=0x27ce0c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebad2050, ftCreationTime.dwHighDateTime=0x1d5dee0, ftLastAccessTime.dwLowDateTime=0xdac81e0, ftLastAccessTime.dwHighDateTime=0x1d5df73, ftLastWriteTime.dwLowDateTime=0xdac81e0, ftLastWriteTime.dwHighDateTime=0x1d5df73, nFileSizeHigh=0x0, nFileSizeLow=0x1d4d)) returned 1 [0080.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", lpFilePart=0x0) returned 0x48 [0080.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\2 7mytyrw4ki_witxdwe.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.538] GetFileType (hFile=0x2b8) returned 0x1 [0080.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.538] GetFileType (hFile=0x2b8) returned 0x1 [0080.539] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x1d4d [0080.539] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ce3c0, nNumberOfBytesToRead=0x1d4d, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27ce3c0*, lpNumberOfBytesRead=0x1c9aea98*=0x1d4d, lpOverlapped=0x0) returned 1 [0080.539] CloseHandle (hObject=0x2b8) returned 1 [0080.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", lpFilePart=0x0) returned 0x48 [0080.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\2 7mytyrw4ki_witxdwe.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.550] GetFileType (hFile=0x2b8) returned 0x1 [0080.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.550] GetFileType (hFile=0x2b8) returned 0x1 [0080.550] WriteFile (in: hFile=0x2b8, lpBuffer=0x284e240*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x284e240*, lpNumberOfBytesWritten=0x1c9aeb28*=0x1d50, lpOverlapped=0x0) returned 1 [0080.551] CloseHandle (hObject=0x2b8) returned 1 [0080.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", lpFilePart=0x0) returned 0x48 [0080.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", lpFilePart=0x0) returned 0x48 [0080.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\2 7mytyrw4ki_witxdwe.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.551] GetFileType (hFile=0x2b8) returned 0x1 [0080.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.552] GetFileType (hFile=0x2b8) returned 0x1 [0080.552] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x1d50 [0080.552] WriteFile (in: hFile=0x2b8, lpBuffer=0x2850f90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2850f90*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.552] CloseHandle (hObject=0x2b8) returned 1 [0080.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a", lpFilePart=0x0) returned 0x48 [0080.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\MiA3bVlUWXJ3NEtpX3dpdFhEV0UubTRh", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\MiA3bVlUWXJ3NEtpX3dpdFhEV0UubTRh", lpFilePart=0x0) returned 0x50 [0080.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.552] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\2 7mytyrw4ki_witxdwe.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebad2050, ftCreationTime.dwHighDateTime=0x1d5dee0, ftLastAccessTime.dwLowDateTime=0xdac81e0, ftLastAccessTime.dwHighDateTime=0x1d5df73, ftLastWriteTime.dwLowDateTime=0xd7ba7300, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1d5a)) returned 1 [0080.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.552] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\2 7mYTYrw4Ki_witXDWE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\2 7mytyrw4ki_witxdwe.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\MiA3bVlUWXJ3NEtpX3dpdFhEV0UubTRh" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\mia3bvluwxj3netpx3dpdfhev0uubtrh")) returned 1 [0080.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", lpFilePart=0x0) returned 0x41 [0080.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\f7he 2upofaxz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.553] GetFileType (hFile=0x2b8) returned 0x1 [0080.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.553] GetFileType (hFile=0x2b8) returned 0x1 [0080.553] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x60e9 [0080.553] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=24799, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x60df [0080.553] ReadFile (in: hFile=0x2b8, lpBuffer=0x28523b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28523b0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.554] CloseHandle (hObject=0x2b8) returned 1 [0080.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", lpFilePart=0x0) returned 0x41 [0080.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.555] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\f7he 2upofaxz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x28befa0 | out: lpFileInformation=0x28befa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf992fc0, ftCreationTime.dwHighDateTime=0x1d5d956, ftLastAccessTime.dwLowDateTime=0x9ccd8780, ftLastAccessTime.dwHighDateTime=0x1d5d856, ftLastWriteTime.dwLowDateTime=0x9ccd8780, ftLastWriteTime.dwHighDateTime=0x1d5d856, nFileSizeHigh=0x0, nFileSizeLow=0x60e9)) returned 1 [0080.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", lpFilePart=0x0) returned 0x41 [0080.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\f7he 2upofaxz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.556] GetFileType (hFile=0x2b8) returned 0x1 [0080.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.556] GetFileType (hFile=0x2b8) returned 0x1 [0080.556] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x60e9 [0080.556] ReadFile (in: hFile=0x2b8, lpBuffer=0x28bf258, nNumberOfBytesToRead=0x60e9, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28bf258*, lpNumberOfBytesRead=0x1c9aea98*=0x60e9, lpOverlapped=0x0) returned 1 [0080.556] CloseHandle (hObject=0x2b8) returned 1 [0080.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", lpFilePart=0x0) returned 0x41 [0080.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\f7he 2upofaxz.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.573] GetFileType (hFile=0x2b8) returned 0x1 [0080.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.573] GetFileType (hFile=0x2b8) returned 0x1 [0080.573] WriteFile (in: hFile=0x2b8, lpBuffer=0x27936e0*, nNumberOfBytesToWrite=0x60f0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x27936e0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x60f0, lpOverlapped=0x0) returned 1 [0080.574] CloseHandle (hObject=0x2b8) returned 1 [0080.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", lpFilePart=0x0) returned 0x41 [0080.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", lpFilePart=0x0) returned 0x41 [0080.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\f7he 2upofaxz.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.574] GetFileType (hFile=0x2b8) returned 0x1 [0080.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.574] GetFileType (hFile=0x2b8) returned 0x1 [0080.574] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x60f0 [0080.574] WriteFile (in: hFile=0x2b8, lpBuffer=0x279a750*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x279a750*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.574] CloseHandle (hObject=0x2b8) returned 1 [0080.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3", lpFilePart=0x0) returned 0x41 [0080.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\RjdIRSAyVVBPZkF4ei5tcDM=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\RjdIRSAyVVBPZkF4ei5tcDM=", lpFilePart=0x0) returned 0x48 [0080.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.575] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\f7he 2upofaxz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf992fc0, ftCreationTime.dwHighDateTime=0x1d5d956, ftLastAccessTime.dwLowDateTime=0x9ccd8780, ftLastAccessTime.dwHighDateTime=0x1d5d856, ftLastWriteTime.dwLowDateTime=0xd7bf35c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x60fa)) returned 1 [0080.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.575] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\F7HE 2UPOfAxz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\f7he 2upofaxz.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\RjdIRSAyVVBPZkF4ei5tcDM=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\rjdirsayvvbpzkf4ei5tcdm=")) returned 1 [0080.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", lpFilePart=0x0) returned 0x44 [0080.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\fv8 1np6ve5go7h8.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.576] GetFileType (hFile=0x2b8) returned 0x1 [0080.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.576] GetFileType (hFile=0x2b8) returned 0x1 [0080.576] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x18e06 [0080.576] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=101884, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x18dfc [0080.576] ReadFile (in: hFile=0x2b8, lpBuffer=0x279bb50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x279bb50*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.576] CloseHandle (hObject=0x2b8) returned 1 [0080.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", lpFilePart=0x0) returned 0x44 [0080.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\fv8 1np6ve5go7h8.wav"), fInfoLevelId=0x0, lpFileInformation=0x28086c0 | out: lpFileInformation=0x28086c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7482e560, ftCreationTime.dwHighDateTime=0x1d5e790, ftLastAccessTime.dwLowDateTime=0x51aba7c0, ftLastAccessTime.dwHighDateTime=0x1d5d813, ftLastWriteTime.dwLowDateTime=0x51aba7c0, ftLastWriteTime.dwHighDateTime=0x1d5d813, nFileSizeHigh=0x0, nFileSizeLow=0x18e06)) returned 1 [0080.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", lpFilePart=0x0) returned 0x44 [0080.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\fv8 1np6ve5go7h8.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.579] GetFileType (hFile=0x2b8) returned 0x1 [0080.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.579] GetFileType (hFile=0x2b8) returned 0x1 [0080.579] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x18e06 [0080.579] ReadFile (in: hFile=0x2b8, lpBuffer=0x1295c480, nNumberOfBytesToRead=0x18e06, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x1295c480*, lpNumberOfBytesRead=0x1c9aea98*=0x18e06, lpOverlapped=0x0) returned 1 [0080.581] CloseHandle (hObject=0x2b8) returned 1 [0080.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", lpFilePart=0x0) returned 0x44 [0080.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\fv8 1np6ve5go7h8.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.600] GetFileType (hFile=0x2b8) returned 0x1 [0080.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.600] GetFileType (hFile=0x2b8) returned 0x1 [0080.600] WriteFile (in: hFile=0x2b8, lpBuffer=0x126c5210*, nNumberOfBytesToWrite=0x18e10, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x126c5210*, lpNumberOfBytesWritten=0x1c9aeb28*=0x18e10, lpOverlapped=0x0) returned 1 [0080.602] CloseHandle (hObject=0x2b8) returned 1 [0080.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", lpFilePart=0x0) returned 0x44 [0080.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", lpFilePart=0x0) returned 0x44 [0080.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\fv8 1np6ve5go7h8.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.604] GetFileType (hFile=0x2b8) returned 0x1 [0080.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.604] GetFileType (hFile=0x2b8) returned 0x1 [0080.604] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x18e10 [0080.604] WriteFile (in: hFile=0x2b8, lpBuffer=0x2692778*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2692778*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.604] CloseHandle (hObject=0x2b8) returned 1 [0080.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav", lpFilePart=0x0) returned 0x44 [0080.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\ZnY4IDFucDZ2ZTVHTzdoOC53YXY=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\ZnY4IDFucDZ2ZTVHTzdoOC53YXY=", lpFilePart=0x0) returned 0x4c [0080.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\fv8 1np6ve5go7h8.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7482e560, ftCreationTime.dwHighDateTime=0x1d5e790, ftLastAccessTime.dwLowDateTime=0x51aba7c0, ftLastAccessTime.dwHighDateTime=0x1d5d813, ftLastWriteTime.dwLowDateTime=0xd7c3f880, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x18e1a)) returned 1 [0080.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.604] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\fv8 1np6ve5GO7h8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\fv8 1np6ve5go7h8.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\ZnY4IDFucDZ2ZTVHTzdoOC53YXY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\zny4idfucdz2ztvhtzdooc53yxy=")) returned 1 [0080.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", lpFilePart=0x0) returned 0x45 [0080.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\kfsckq5usiduap3ca.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.605] GetFileType (hFile=0x2b8) returned 0x1 [0080.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.605] GetFileType (hFile=0x2b8) returned 0x1 [0080.605] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x11c9a [0080.605] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=72848, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x11c90 [0080.605] ReadFile (in: hFile=0x2b8, lpBuffer=0x2693b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2693b90*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.606] CloseHandle (hObject=0x2b8) returned 1 [0080.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0080.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", lpFilePart=0x0) returned 0x45 [0080.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.612] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\kfsckq5usiduap3ca.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2700740 | out: lpFileInformation=0x2700740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9796420, ftCreationTime.dwHighDateTime=0x1d5deca, ftLastAccessTime.dwLowDateTime=0x282a3240, ftLastAccessTime.dwHighDateTime=0x1d5de58, ftLastWriteTime.dwLowDateTime=0x282a3240, ftLastWriteTime.dwHighDateTime=0x1d5de58, nFileSizeHigh=0x0, nFileSizeLow=0x11c9a)) returned 1 [0080.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", lpFilePart=0x0) returned 0x45 [0080.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\kfsckq5usiduap3ca.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.613] GetFileType (hFile=0x2b8) returned 0x1 [0080.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.613] GetFileType (hFile=0x2b8) returned 0x1 [0080.613] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x11c9a [0080.613] ReadFile (in: hFile=0x2b8, lpBuffer=0x2700a18, nNumberOfBytesToRead=0x11c9a, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2700a18*, lpNumberOfBytesRead=0x1c9aea98*=0x11c9a, lpOverlapped=0x0) returned 1 [0080.613] CloseHandle (hObject=0x2b8) returned 1 [0080.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", lpFilePart=0x0) returned 0x45 [0080.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\kfsckq5usiduap3ca.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.640] GetFileType (hFile=0x2b8) returned 0x1 [0080.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.641] GetFileType (hFile=0x2b8) returned 0x1 [0080.641] WriteFile (in: hFile=0x2b8, lpBuffer=0x27acbf0*, nNumberOfBytesToWrite=0x11ca0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x27acbf0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x11ca0, lpOverlapped=0x0) returned 1 [0080.642] CloseHandle (hObject=0x2b8) returned 1 [0080.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", lpFilePart=0x0) returned 0x45 [0080.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", lpFilePart=0x0) returned 0x45 [0080.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\kfsckq5usiduap3ca.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.644] GetFileType (hFile=0x2b8) returned 0x1 [0080.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.644] GetFileType (hFile=0x2b8) returned 0x1 [0080.644] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x11ca0 [0080.644] WriteFile (in: hFile=0x2b8, lpBuffer=0x27bf850*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27bf850*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.644] CloseHandle (hObject=0x2b8) returned 1 [0080.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3", lpFilePart=0x0) returned 0x45 [0080.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\S0ZTY0txNXVTSUR1QVAzY0EubXAz", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\S0ZTY0txNXVTSUR1QVAzY0EubXAz", lpFilePart=0x0) returned 0x4c [0080.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.644] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\kfsckq5usiduap3ca.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9796420, ftCreationTime.dwHighDateTime=0x1d5deca, ftLastAccessTime.dwLowDateTime=0x282a3240, ftLastAccessTime.dwHighDateTime=0x1d5de58, ftLastWriteTime.dwLowDateTime=0xd7c8bb40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x11caa)) returned 1 [0080.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.644] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\KFScKq5uSIDuAP3cA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\kfsckq5usiduap3ca.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\S0ZTY0txNXVTSUR1QVAzY0EubXAz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\s0zty0txnxvtsur1qvazy0eubxaz")) returned 1 [0080.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", lpFilePart=0x0) returned 0x43 [0080.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\milnqdqkju aptg.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.645] GetFileType (hFile=0x2b8) returned 0x1 [0080.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.645] GetFileType (hFile=0x2b8) returned 0x1 [0080.645] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x11fe7 [0080.645] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=73693, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x11fdd [0080.645] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c0c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27c0c58*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.646] CloseHandle (hObject=0x2b8) returned 1 [0080.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11b98) returned 0x0 [0080.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", lpFilePart=0x0) returned 0x43 [0080.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.648] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\milnqdqkju aptg.mp3"), fInfoLevelId=0x0, lpFileInformation=0x282d7c8 | out: lpFileInformation=0x282d7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd975540, ftCreationTime.dwHighDateTime=0x1d5d96a, ftLastAccessTime.dwLowDateTime=0x8201e540, ftLastAccessTime.dwHighDateTime=0x1d5d860, ftLastWriteTime.dwLowDateTime=0x8201e540, ftLastWriteTime.dwHighDateTime=0x1d5d860, nFileSizeHigh=0x0, nFileSizeLow=0x11fe7)) returned 1 [0080.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", lpFilePart=0x0) returned 0x43 [0080.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\milnqdqkju aptg.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.648] GetFileType (hFile=0x2b8) returned 0x1 [0080.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.648] GetFileType (hFile=0x2b8) returned 0x1 [0080.648] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x11fe7 [0080.648] ReadFile (in: hFile=0x2b8, lpBuffer=0x282da80, nNumberOfBytesToRead=0x11fe7, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x282da80*, lpNumberOfBytesRead=0x1c9aea98*=0x11fe7, lpOverlapped=0x0) returned 1 [0080.649] CloseHandle (hObject=0x2b8) returned 1 [0080.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", lpFilePart=0x0) returned 0x43 [0080.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\milnqdqkju aptg.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.676] GetFileType (hFile=0x2b8) returned 0x1 [0080.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.676] GetFileType (hFile=0x2b8) returned 0x1 [0080.677] WriteFile (in: hFile=0x2b8, lpBuffer=0x27168e8*, nNumberOfBytesToWrite=0x11ff0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x27168e8*, lpNumberOfBytesWritten=0x1c9aeb28*=0x11ff0, lpOverlapped=0x0) returned 1 [0080.678] CloseHandle (hObject=0x2b8) returned 1 [0080.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", lpFilePart=0x0) returned 0x43 [0080.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", lpFilePart=0x0) returned 0x43 [0080.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\milnqdqkju aptg.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.679] GetFileType (hFile=0x2b8) returned 0x1 [0080.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.679] GetFileType (hFile=0x2b8) returned 0x1 [0080.679] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x11ff0 [0080.679] WriteFile (in: hFile=0x2b8, lpBuffer=0x2729860*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2729860*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.679] CloseHandle (hObject=0x2b8) returned 1 [0080.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3", lpFilePart=0x0) returned 0x43 [0080.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\bWlsbnFkcUtKdSBBcFRnLm1wMw==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\bWlsbnFkcUtKdSBBcFRnLm1wMw==", lpFilePart=0x0) returned 0x4c [0080.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.679] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\milnqdqkju aptg.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd975540, ftCreationTime.dwHighDateTime=0x1d5d96a, ftLastAccessTime.dwLowDateTime=0x8201e540, ftLastAccessTime.dwHighDateTime=0x1d5d860, ftLastWriteTime.dwLowDateTime=0xd7cd7e00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x11ffa)) returned 1 [0080.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.679] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\milnqdqKJu ApTg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\milnqdqkju aptg.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\bWlsbnFkcUtKdSBBcFRnLm1wMw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\bwlsbnfkcutkdsbbcfrnlm1wmw==")) returned 1 [0080.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", lpFilePart=0x0) returned 0x47 [0080.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\mmcr7n4j5mjcql rt1h.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.680] GetFileType (hFile=0x2b8) returned 0x1 [0080.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.680] GetFileType (hFile=0x2b8) returned 0x1 [0080.680] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x10abc [0080.680] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=68274, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x10ab2 [0080.680] ReadFile (in: hFile=0x2b8, lpBuffer=0x272ac70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x272ac70*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.683] CloseHandle (hObject=0x2b8) returned 1 [0080.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", lpFilePart=0x0) returned 0x47 [0080.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.685] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\mmcr7n4j5mjcql rt1h.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2797a18 | out: lpFileInformation=0x2797a18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f52420, ftCreationTime.dwHighDateTime=0x1d5db8e, ftLastAccessTime.dwLowDateTime=0xd91b80b0, ftLastAccessTime.dwHighDateTime=0x1d5da1e, ftLastWriteTime.dwLowDateTime=0xd91b80b0, ftLastWriteTime.dwHighDateTime=0x1d5da1e, nFileSizeHigh=0x0, nFileSizeLow=0x10abc)) returned 1 [0080.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", lpFilePart=0x0) returned 0x47 [0080.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\mmcr7n4j5mjcql rt1h.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.685] GetFileType (hFile=0x2b8) returned 0x1 [0080.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.685] GetFileType (hFile=0x2b8) returned 0x1 [0080.685] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x10abc [0080.685] ReadFile (in: hFile=0x2b8, lpBuffer=0x2797cf0, nNumberOfBytesToRead=0x10abc, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2797cf0*, lpNumberOfBytesRead=0x1c9aea98*=0x10abc, lpOverlapped=0x0) returned 1 [0080.685] CloseHandle (hObject=0x2b8) returned 1 [0080.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", lpFilePart=0x0) returned 0x47 [0080.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\mmcr7n4j5mjcql rt1h.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.697] GetFileType (hFile=0x2b8) returned 0x1 [0080.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.697] GetFileType (hFile=0x2b8) returned 0x1 [0080.698] WriteFile (in: hFile=0x2b8, lpBuffer=0x2840928*, nNumberOfBytesToWrite=0x10ac0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2840928*, lpNumberOfBytesWritten=0x1c9aeb28*=0x10ac0, lpOverlapped=0x0) returned 1 [0080.700] CloseHandle (hObject=0x2b8) returned 1 [0080.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", lpFilePart=0x0) returned 0x47 [0080.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", lpFilePart=0x0) returned 0x47 [0080.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\mmcr7n4j5mjcql rt1h.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.700] GetFileType (hFile=0x2b8) returned 0x1 [0080.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.700] GetFileType (hFile=0x2b8) returned 0x1 [0080.700] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x10ac0 [0080.700] WriteFile (in: hFile=0x2b8, lpBuffer=0x28523b0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x28523b0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.700] CloseHandle (hObject=0x2b8) returned 1 [0080.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3", lpFilePart=0x0) returned 0x47 [0080.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\bU1DUjdONEo1bWpjcUwgclQxSC5tcDM=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\bU1DUjdONEo1bWpjcUwgclQxSC5tcDM=", lpFilePart=0x0) returned 0x50 [0080.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.701] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\mmcr7n4j5mjcql rt1h.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f52420, ftCreationTime.dwHighDateTime=0x1d5db8e, ftLastAccessTime.dwLowDateTime=0xd91b80b0, ftLastAccessTime.dwHighDateTime=0x1d5da1e, ftLastWriteTime.dwLowDateTime=0xd7d240c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x10aca)) returned 1 [0080.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.701] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\mMCR7N4J5mjcqL rT1H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\mmcr7n4j5mjcql rt1h.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\bU1DUjdONEo1bWpjcUwgclQxSC5tcDM=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\bu1dujdoneo1bwpjcuwgclqxsc5tcdm=")) returned 1 [0080.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", lpFilePart=0x0) returned 0x48 [0080.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\msuxi kwktdtm-1ihjmt.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.701] GetFileType (hFile=0x2b8) returned 0x1 [0080.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.701] GetFileType (hFile=0x2b8) returned 0x1 [0080.701] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xf615 [0080.702] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=62987, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xf60b [0080.702] ReadFile (in: hFile=0x2b8, lpBuffer=0x28537e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28537e8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.702] CloseHandle (hObject=0x2b8) returned 1 [0080.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", lpFilePart=0x0) returned 0x48 [0080.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.706] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\msuxi kwktdtm-1ihjmt.m4a"), fInfoLevelId=0x0, lpFileInformation=0x28c0398 | out: lpFileInformation=0x28c0398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b07120, ftCreationTime.dwHighDateTime=0x1d5e66d, ftLastAccessTime.dwLowDateTime=0xc106d320, ftLastAccessTime.dwHighDateTime=0x1d5e4d3, ftLastWriteTime.dwLowDateTime=0xc106d320, ftLastWriteTime.dwHighDateTime=0x1d5e4d3, nFileSizeHigh=0x0, nFileSizeLow=0xf615)) returned 1 [0080.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", lpFilePart=0x0) returned 0x48 [0080.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\msuxi kwktdtm-1ihjmt.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.707] GetFileType (hFile=0x2b8) returned 0x1 [0080.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.707] GetFileType (hFile=0x2b8) returned 0x1 [0080.707] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xf615 [0080.708] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c0690, nNumberOfBytesToRead=0xf615, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28c0690*, lpNumberOfBytesRead=0x1c9aea98*=0xf615, lpOverlapped=0x0) returned 1 [0080.708] CloseHandle (hObject=0x2b8) returned 1 [0080.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", lpFilePart=0x0) returned 0x48 [0080.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\msuxi kwktdtm-1ihjmt.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.756] GetFileType (hFile=0x2b8) returned 0x1 [0080.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.756] GetFileType (hFile=0x2b8) returned 0x1 [0080.756] WriteFile (in: hFile=0x2b8, lpBuffer=0x279b650*, nNumberOfBytesToWrite=0xf620, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x279b650*, lpNumberOfBytesWritten=0x1c9aeb28*=0xf620, lpOverlapped=0x0) returned 1 [0080.758] CloseHandle (hObject=0x2b8) returned 1 [0080.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", lpFilePart=0x0) returned 0x48 [0080.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", lpFilePart=0x0) returned 0x48 [0080.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\msuxi kwktdtm-1ihjmt.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.759] GetFileType (hFile=0x2b8) returned 0x1 [0080.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.759] GetFileType (hFile=0x2b8) returned 0x1 [0080.759] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xf620 [0080.761] WriteFile (in: hFile=0x2b8, lpBuffer=0x27abc70*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27abc70*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.761] CloseHandle (hObject=0x2b8) returned 1 [0080.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a", lpFilePart=0x0) returned 0x48 [0080.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\bXN1WGkgS1dLdGR0TS0xSWhKbVQubTRh", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\bXN1WGkgS1dLdGR0TS0xSWhKbVQubTRh", lpFilePart=0x0) returned 0x50 [0080.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\msuxi kwktdtm-1ihjmt.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b07120, ftCreationTime.dwHighDateTime=0x1d5e66d, ftLastAccessTime.dwLowDateTime=0xc106d320, ftLastAccessTime.dwHighDateTime=0x1d5e4d3, ftLastWriteTime.dwLowDateTime=0xd7dbc640, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xf62a)) returned 1 [0080.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.762] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\msuXi KWKtdtM-1IhJmT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\msuxi kwktdtm-1ihjmt.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\bXN1WGkgS1dLdGR0TS0xSWhKbVQubTRh" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\bxn1wgkgs1dldgr0ts0xswhkbvqubtrh")) returned 1 [0080.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", lpFilePart=0x0) returned 0x42 [0080.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\sqotluir4kyrcz.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.762] GetFileType (hFile=0x2b8) returned 0x1 [0080.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.762] GetFileType (hFile=0x2b8) returned 0x1 [0080.763] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x1194e [0080.763] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=72004, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x11944 [0080.763] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ad090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27ad090*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.763] CloseHandle (hObject=0x2b8) returned 1 [0080.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", lpFilePart=0x0) returned 0x42 [0080.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.765] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\sqotluir4kyrcz.wav"), fInfoLevelId=0x0, lpFileInformation=0x2819c00 | out: lpFileInformation=0x2819c00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594e3f80, ftCreationTime.dwHighDateTime=0x1d5de83, ftLastAccessTime.dwLowDateTime=0x4bf8760, ftLastAccessTime.dwHighDateTime=0x1d5dc46, ftLastWriteTime.dwLowDateTime=0x4bf8760, ftLastWriteTime.dwHighDateTime=0x1d5dc46, nFileSizeHigh=0x0, nFileSizeLow=0x1194e)) returned 1 [0080.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", lpFilePart=0x0) returned 0x42 [0080.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\sqotluir4kyrcz.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.765] GetFileType (hFile=0x2b8) returned 0x1 [0080.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.765] GetFileType (hFile=0x2b8) returned 0x1 [0080.765] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x1194e [0080.766] ReadFile (in: hFile=0x2b8, lpBuffer=0x2819eb8, nNumberOfBytesToRead=0x1194e, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2819eb8*, lpNumberOfBytesRead=0x1c9aea98*=0x1194e, lpOverlapped=0x0) returned 1 [0080.766] CloseHandle (hObject=0x2b8) returned 1 [0080.778] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", lpFilePart=0x0) returned 0x42 [0080.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\sqotluir4kyrcz.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.780] GetFileType (hFile=0x2b8) returned 0x1 [0080.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.780] GetFileType (hFile=0x2b8) returned 0x1 [0080.780] WriteFile (in: hFile=0x2b8, lpBuffer=0x28c56a0*, nNumberOfBytesToWrite=0x11950, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x28c56a0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x11950, lpOverlapped=0x0) returned 1 [0080.781] CloseHandle (hObject=0x2b8) returned 1 [0080.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", lpFilePart=0x0) returned 0x42 [0080.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", lpFilePart=0x0) returned 0x42 [0080.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\sqotluir4kyrcz.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.784] GetFileType (hFile=0x2b8) returned 0x1 [0080.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.784] GetFileType (hFile=0x2b8) returned 0x1 [0080.784] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x11950 [0080.784] WriteFile (in: hFile=0x2b8, lpBuffer=0x28d7f70*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x28d7f70*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.785] CloseHandle (hObject=0x2b8) returned 1 [0080.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav", lpFilePart=0x0) returned 0x42 [0080.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\c1FvdGxVaVI0S3lyY1oud2F2", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\c1FvdGxVaVI0S3lyY1oud2F2", lpFilePart=0x0) returned 0x48 [0080.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\sqotluir4kyrcz.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594e3f80, ftCreationTime.dwHighDateTime=0x1d5de83, ftLastAccessTime.dwLowDateTime=0x4bf8760, ftLastAccessTime.dwHighDateTime=0x1d5dc46, ftLastWriteTime.dwLowDateTime=0xd7de27a0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1195a)) returned 1 [0080.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.785] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\sQotlUiR4KyrcZ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\sqotluir4kyrcz.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\c1FvdGxVaVI0S3lyY1oud2F2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\c1fvdgxvavi0s3lyy1oud2f2")) returned 1 [0080.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", lpFilePart=0x0) returned 0x39 [0080.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\xt2w-.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.786] GetFileType (hFile=0x2b8) returned 0x1 [0080.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.786] GetFileType (hFile=0x2b8) returned 0x1 [0080.786] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x123c5 [0080.786] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=74683, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x123bb [0080.786] ReadFile (in: hFile=0x2b8, lpBuffer=0x28d9340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28d9340*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.787] CloseHandle (hObject=0x2b8) returned 1 [0080.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", lpFilePart=0x0) returned 0x39 [0080.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\xt2w-.wav"), fInfoLevelId=0x0, lpFileInformation=0x26e33d8 | out: lpFileInformation=0x26e33d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa296f870, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x9c71ae00, ftLastAccessTime.dwHighDateTime=0x1d5e7cf, ftLastWriteTime.dwLowDateTime=0x9c71ae00, ftLastWriteTime.dwHighDateTime=0x1d5e7cf, nFileSizeHigh=0x0, nFileSizeLow=0x123c5)) returned 1 [0080.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", lpFilePart=0x0) returned 0x39 [0080.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\xt2w-.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.801] GetFileType (hFile=0x2b8) returned 0x1 [0080.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.802] GetFileType (hFile=0x2b8) returned 0x1 [0080.802] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x123c5 [0080.802] ReadFile (in: hFile=0x2b8, lpBuffer=0x26e3650, nNumberOfBytesToRead=0x123c5, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x26e3650*, lpNumberOfBytesRead=0x1c9aea98*=0x123c5, lpOverlapped=0x0) returned 1 [0080.802] CloseHandle (hObject=0x2b8) returned 1 [0080.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", lpFilePart=0x0) returned 0x39 [0080.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\xt2w-.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.845] GetFileType (hFile=0x2b8) returned 0x1 [0080.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.845] GetFileType (hFile=0x2b8) returned 0x1 [0080.845] WriteFile (in: hFile=0x2b8, lpBuffer=0x2790fb0*, nNumberOfBytesToWrite=0x123d0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2790fb0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x123d0, lpOverlapped=0x0) returned 1 [0080.848] CloseHandle (hObject=0x2b8) returned 1 [0080.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", lpFilePart=0x0) returned 0x39 [0080.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", lpFilePart=0x0) returned 0x39 [0080.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\xt2w-.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.849] GetFileType (hFile=0x2b8) returned 0x1 [0080.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.849] GetFileType (hFile=0x2b8) returned 0x1 [0080.849] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x123d0 [0080.849] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a4270*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27a4270*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.849] CloseHandle (hObject=0x2b8) returned 1 [0080.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav", lpFilePart=0x0) returned 0x39 [0080.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\eFQyVy0ud2F2", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\eFQyVy0ud2F2", lpFilePart=0x0) returned 0x3c [0080.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.849] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\xt2w-.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa296f870, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x9c71ae00, ftLastAccessTime.dwHighDateTime=0x1d5e7cf, ftLastWriteTime.dwLowDateTime=0xd7e7ad20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x123da)) returned 1 [0080.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.850] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\xT2W-.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\xt2w-.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\eFQyVy0ud2F2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\efqyvy0ud2f2")) returned 1 [0080.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", lpFilePart=0x0) returned 0x42 [0080.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0080.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\z8rgetdbrkmo6h.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.850] GetFileType (hFile=0x2b8) returned 0x1 [0080.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0080.850] GetFileType (hFile=0x2b8) returned 0x1 [0080.850] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x174f [0080.851] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=5957, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x1745 [0080.851] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a5620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27a5620*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0080.851] CloseHandle (hObject=0x2b8) returned 1 [0080.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", lpFilePart=0x0) returned 0x42 [0080.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.854] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\z8rgetdbrkmo6h.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2812210 | out: lpFileInformation=0x2812210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a485070, ftCreationTime.dwHighDateTime=0x1d5e55a, ftLastAccessTime.dwLowDateTime=0xd09a0cb0, ftLastAccessTime.dwHighDateTime=0x1d5e5ac, ftLastWriteTime.dwLowDateTime=0xd09a0cb0, ftLastWriteTime.dwHighDateTime=0x1d5e5ac, nFileSizeHigh=0x0, nFileSizeLow=0x174f)) returned 1 [0080.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0080.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", lpFilePart=0x0) returned 0x42 [0080.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0080.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\z8rgetdbrkmo6h.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.854] GetFileType (hFile=0x2b8) returned 0x1 [0080.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0080.854] GetFileType (hFile=0x2b8) returned 0x1 [0080.854] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x174f [0080.855] ReadFile (in: hFile=0x2b8, lpBuffer=0x28124c8, nNumberOfBytesToRead=0x174f, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28124c8*, lpNumberOfBytesRead=0x1c9aea98*=0x174f, lpOverlapped=0x0) returned 1 [0080.855] CloseHandle (hObject=0x2b8) returned 1 [0080.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", lpFilePart=0x0) returned 0x42 [0080.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\z8rgetdbrkmo6h.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.865] GetFileType (hFile=0x2b8) returned 0x1 [0080.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.865] GetFileType (hFile=0x2b8) returned 0x1 [0080.865] WriteFile (in: hFile=0x2b8, lpBuffer=0x28902b0*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x28902b0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x1750, lpOverlapped=0x0) returned 1 [0080.866] CloseHandle (hObject=0x2b8) returned 1 [0080.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", lpFilePart=0x0) returned 0x42 [0080.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", lpFilePart=0x0) returned 0x42 [0080.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0080.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\z8rgetdbrkmo6h.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.867] GetFileType (hFile=0x2b8) returned 0x1 [0080.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0080.867] GetFileType (hFile=0x2b8) returned 0x1 [0080.867] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x1750 [0080.867] WriteFile (in: hFile=0x2b8, lpBuffer=0x2892980*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2892980*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0080.867] CloseHandle (hObject=0x2b8) returned 1 [0080.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a", lpFilePart=0x0) returned 0x42 [0080.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\ejhyR0V0ZGJyS01PNmgubTRh", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\ejhyR0V0ZGJyS01PNmgubTRh", lpFilePart=0x0) returned 0x48 [0080.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0080.867] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\z8rgetdbrkmo6h.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a485070, ftCreationTime.dwHighDateTime=0x1d5e55a, ftLastAccessTime.dwLowDateTime=0xd09a0cb0, ftLastAccessTime.dwHighDateTime=0x1d5e5ac, ftLastWriteTime.dwLowDateTime=0xd7ea0e80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x175a)) returned 1 [0080.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0080.868] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\z8rGEtdbrKMO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\z8rgetdbrkmo6h.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\ejhyR0V0ZGJyS01PNmgubTRh" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\ejhyr0v0zgjys01pnmgubtrh")) returned 1 [0080.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc", lpFilePart=0x0) returned 0x3f [0080.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\", lpFilePart=0x0) returned 0x40 [0080.868] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6778aac0, ftCreationTime.dwHighDateTime=0x1d5d88c, ftLastAccessTime.dwLowDateTime=0x25a262f0, ftLastAccessTime.dwHighDateTime=0x1d5da47, ftLastWriteTime.dwLowDateTime=0x25a262f0, ftLastWriteTime.dwHighDateTime=0x1d5da47, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.869] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6778aac0, ftCreationTime.dwHighDateTime=0x1d5d88c, ftLastAccessTime.dwLowDateTime=0x25a262f0, ftLastAccessTime.dwHighDateTime=0x1d5da47, ftLastWriteTime.dwLowDateTime=0x25a262f0, ftLastWriteTime.dwHighDateTime=0x1d5da47, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.869] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcac07c70, ftCreationTime.dwHighDateTime=0x1d5e26e, ftLastAccessTime.dwLowDateTime=0x6958c2c0, ftLastAccessTime.dwHighDateTime=0x1d5e47c, ftLastWriteTime.dwLowDateTime=0x6958c2c0, ftLastWriteTime.dwHighDateTime=0x1d5e47c, nFileSizeHigh=0x0, nFileSizeLow=0x17bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="-JSrIXKfZTmoDJd.mp3", cAlternateFileName="-JSRIX~1.MP3")) returned 1 [0080.869] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340cd370, ftCreationTime.dwHighDateTime=0x1d5e3b1, ftLastAccessTime.dwLowDateTime=0xc113f730, ftLastAccessTime.dwHighDateTime=0x1d5d9ca, ftLastWriteTime.dwLowDateTime=0xc113f730, ftLastWriteTime.dwHighDateTime=0x1d5d9ca, nFileSizeHigh=0x0, nFileSizeLow=0x78d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="27oDpLWlXZaT6lQ.wav", cAlternateFileName="27ODPL~1.WAV")) returned 1 [0080.869] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec0ebf0, ftCreationTime.dwHighDateTime=0x1d5d808, ftLastAccessTime.dwLowDateTime=0x3818ce50, ftLastAccessTime.dwHighDateTime=0x1d5e5ec, ftLastWriteTime.dwLowDateTime=0x3818ce50, ftLastWriteTime.dwHighDateTime=0x1d5e5ec, nFileSizeHigh=0x0, nFileSizeLow=0xfd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="2nw_HwijlnA.mp3", cAlternateFileName="2NW_HW~1.MP3")) returned 1 [0080.869] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f54f780, ftCreationTime.dwHighDateTime=0x1d5df20, ftLastAccessTime.dwLowDateTime=0x463a0f30, ftLastAccessTime.dwHighDateTime=0x1d5e7b3, ftLastWriteTime.dwLowDateTime=0x463a0f30, ftLastWriteTime.dwHighDateTime=0x1d5e7b3, nFileSizeHigh=0x0, nFileSizeLow=0x188c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpprWx t.wav", cAlternateFileName="JPPRWX~1.WAV")) returned 1 [0080.869] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03aa810, ftCreationTime.dwHighDateTime=0x1d5dc09, ftLastAccessTime.dwLowDateTime=0xf91772e0, ftLastAccessTime.dwHighDateTime=0x1d5e01b, ftLastWriteTime.dwLowDateTime=0xf91772e0, ftLastWriteTime.dwHighDateTime=0x1d5e01b, nFileSizeHigh=0x0, nFileSizeLow=0x134b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="jym3NiBGq8zzYsk8g.m4a", cAlternateFileName="JYM3NI~1.M4A")) returned 1 [0080.870] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0a2250, ftCreationTime.dwHighDateTime=0x1d5e069, ftLastAccessTime.dwLowDateTime=0x385e66a0, ftLastAccessTime.dwHighDateTime=0x1d5e0b9, ftLastWriteTime.dwLowDateTime=0x385e66a0, ftLastWriteTime.dwHighDateTime=0x1d5e0b9, nFileSizeHigh=0x0, nFileSizeLow=0x13170, dwReserved0=0x0, dwReserved1=0x0, cFileName="pyvLrG_LWqVZruhU.m4a", cAlternateFileName="PYVLRG~1.M4A")) returned 1 [0080.870] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5edb350, ftCreationTime.dwHighDateTime=0x1d5dfde, ftLastAccessTime.dwLowDateTime=0x7b73000, ftLastAccessTime.dwHighDateTime=0x1d5da37, ftLastWriteTime.dwLowDateTime=0x7b73000, ftLastWriteTime.dwHighDateTime=0x1d5da37, nFileSizeHigh=0x0, nFileSizeLow=0x9820, dwReserved0=0x0, dwReserved1=0x0, cFileName="sBCKlWn.wav", cAlternateFileName="")) returned 1 [0080.870] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a775a30, ftCreationTime.dwHighDateTime=0x1d5dde2, ftLastAccessTime.dwLowDateTime=0x40d18880, ftLastAccessTime.dwHighDateTime=0x1d5e1bd, ftLastWriteTime.dwLowDateTime=0x40d18880, ftLastWriteTime.dwHighDateTime=0x1d5e1bd, nFileSizeHigh=0x0, nFileSizeLow=0x7bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="svgTwv7W2fzaKPSr-HA.mp3", cAlternateFileName="SVGTWV~1.MP3")) returned 1 [0080.870] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c52930, ftCreationTime.dwHighDateTime=0x1d5df9e, ftLastAccessTime.dwLowDateTime=0x939de8a0, ftLastAccessTime.dwHighDateTime=0x1d5e425, ftLastWriteTime.dwLowDateTime=0x939de8a0, ftLastWriteTime.dwHighDateTime=0x1d5e425, nFileSizeHigh=0x0, nFileSizeLow=0x8c2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="y4f925Rt9FDp-6ka_.mp3", cAlternateFileName="Y4F925~1.MP3")) returned 1 [0080.870] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.870] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0080.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0080.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0080.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc", nBufferLength=0x105, lpBuffer=0x1c9ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc", lpFilePart=0x0) returned 0x3f [0080.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\", nBufferLength=0x105, lpBuffer=0x1c9ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\", lpFilePart=0x0) returned 0x40 [0080.871] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\*", lpFindFileData=0x1c9ae7b0 | out: lpFindFileData=0x1c9ae7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6778aac0, ftCreationTime.dwHighDateTime=0x1d5d88c, ftLastAccessTime.dwLowDateTime=0x25a262f0, ftLastAccessTime.dwHighDateTime=0x1d5da47, ftLastWriteTime.dwLowDateTime=0x25a262f0, ftLastWriteTime.dwHighDateTime=0x1d5da47, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0080.871] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6778aac0, ftCreationTime.dwHighDateTime=0x1d5d88c, ftLastAccessTime.dwLowDateTime=0x25a262f0, ftLastAccessTime.dwHighDateTime=0x1d5da47, ftLastWriteTime.dwLowDateTime=0x25a262f0, ftLastWriteTime.dwHighDateTime=0x1d5da47, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.871] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcac07c70, ftCreationTime.dwHighDateTime=0x1d5e26e, ftLastAccessTime.dwLowDateTime=0x6958c2c0, ftLastAccessTime.dwHighDateTime=0x1d5e47c, ftLastWriteTime.dwLowDateTime=0x6958c2c0, ftLastWriteTime.dwHighDateTime=0x1d5e47c, nFileSizeHigh=0x0, nFileSizeLow=0x17bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="-JSrIXKfZTmoDJd.mp3", cAlternateFileName="-JSRIX~1.MP3")) returned 1 [0080.871] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340cd370, ftCreationTime.dwHighDateTime=0x1d5e3b1, ftLastAccessTime.dwLowDateTime=0xc113f730, ftLastAccessTime.dwHighDateTime=0x1d5d9ca, ftLastWriteTime.dwLowDateTime=0xc113f730, ftLastWriteTime.dwHighDateTime=0x1d5d9ca, nFileSizeHigh=0x0, nFileSizeLow=0x78d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="27oDpLWlXZaT6lQ.wav", cAlternateFileName="27ODPL~1.WAV")) returned 1 [0080.871] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec0ebf0, ftCreationTime.dwHighDateTime=0x1d5d808, ftLastAccessTime.dwLowDateTime=0x3818ce50, ftLastAccessTime.dwHighDateTime=0x1d5e5ec, ftLastWriteTime.dwLowDateTime=0x3818ce50, ftLastWriteTime.dwHighDateTime=0x1d5e5ec, nFileSizeHigh=0x0, nFileSizeLow=0xfd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="2nw_HwijlnA.mp3", cAlternateFileName="2NW_HW~1.MP3")) returned 1 [0080.871] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f54f780, ftCreationTime.dwHighDateTime=0x1d5df20, ftLastAccessTime.dwLowDateTime=0x463a0f30, ftLastAccessTime.dwHighDateTime=0x1d5e7b3, ftLastWriteTime.dwLowDateTime=0x463a0f30, ftLastWriteTime.dwHighDateTime=0x1d5e7b3, nFileSizeHigh=0x0, nFileSizeLow=0x188c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpprWx t.wav", cAlternateFileName="JPPRWX~1.WAV")) returned 1 [0080.871] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03aa810, ftCreationTime.dwHighDateTime=0x1d5dc09, ftLastAccessTime.dwLowDateTime=0xf91772e0, ftLastAccessTime.dwHighDateTime=0x1d5e01b, ftLastWriteTime.dwLowDateTime=0xf91772e0, ftLastWriteTime.dwHighDateTime=0x1d5e01b, nFileSizeHigh=0x0, nFileSizeLow=0x134b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="jym3NiBGq8zzYsk8g.m4a", cAlternateFileName="JYM3NI~1.M4A")) returned 1 [0080.871] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0a2250, ftCreationTime.dwHighDateTime=0x1d5e069, ftLastAccessTime.dwLowDateTime=0x385e66a0, ftLastAccessTime.dwHighDateTime=0x1d5e0b9, ftLastWriteTime.dwLowDateTime=0x385e66a0, ftLastWriteTime.dwHighDateTime=0x1d5e0b9, nFileSizeHigh=0x0, nFileSizeLow=0x13170, dwReserved0=0x0, dwReserved1=0x0, cFileName="pyvLrG_LWqVZruhU.m4a", cAlternateFileName="PYVLRG~1.M4A")) returned 1 [0080.872] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5edb350, ftCreationTime.dwHighDateTime=0x1d5dfde, ftLastAccessTime.dwLowDateTime=0x7b73000, ftLastAccessTime.dwHighDateTime=0x1d5da37, ftLastWriteTime.dwLowDateTime=0x7b73000, ftLastWriteTime.dwHighDateTime=0x1d5da37, nFileSizeHigh=0x0, nFileSizeLow=0x9820, dwReserved0=0x0, dwReserved1=0x0, cFileName="sBCKlWn.wav", cAlternateFileName="")) returned 1 [0080.872] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a775a30, ftCreationTime.dwHighDateTime=0x1d5dde2, ftLastAccessTime.dwLowDateTime=0x40d18880, ftLastAccessTime.dwHighDateTime=0x1d5e1bd, ftLastWriteTime.dwLowDateTime=0x40d18880, ftLastWriteTime.dwHighDateTime=0x1d5e1bd, nFileSizeHigh=0x0, nFileSizeLow=0x7bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="svgTwv7W2fzaKPSr-HA.mp3", cAlternateFileName="SVGTWV~1.MP3")) returned 1 [0080.872] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c52930, ftCreationTime.dwHighDateTime=0x1d5df9e, ftLastAccessTime.dwLowDateTime=0x939de8a0, ftLastAccessTime.dwHighDateTime=0x1d5e425, ftLastWriteTime.dwLowDateTime=0x939de8a0, ftLastWriteTime.dwHighDateTime=0x1d5e425, nFileSizeHigh=0x0, nFileSizeLow=0x8c2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="y4f925Rt9FDp-6ka_.mp3", cAlternateFileName="Y4F925~1.MP3")) returned 1 [0080.872] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae800 | out: lpFindFileData=0x1c9ae800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c52930, ftCreationTime.dwHighDateTime=0x1d5df9e, ftLastAccessTime.dwLowDateTime=0x939de8a0, ftLastAccessTime.dwHighDateTime=0x1d5e425, ftLastWriteTime.dwLowDateTime=0x939de8a0, ftLastWriteTime.dwHighDateTime=0x1d5e425, nFileSizeHigh=0x0, nFileSizeLow=0x8c2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="y4f925Rt9FDp-6ka_.mp3", cAlternateFileName="Y4F925~1.MP3")) returned 0 [0080.872] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0080.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea60) returned 1 [0080.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0080.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", lpFilePart=0x0) returned 0x53 [0080.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0080.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\-jsrixkfztmodjd.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.872] GetFileType (hFile=0x2b8) returned 0x1 [0080.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0080.872] GetFileType (hFile=0x2b8) returned 0x1 [0080.872] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x17bbc [0080.873] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=97202, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x17bb2 [0080.873] ReadFile (in: hFile=0x2b8, lpBuffer=0x2898a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x2898a78*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0080.873] CloseHandle (hObject=0x2b8) returned 1 [0080.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", lpFilePart=0x0) returned 0x53 [0080.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.908] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\-jsrixkfztmodjd.mp3"), fInfoLevelId=0x0, lpFileInformation=0x27219d8 | out: lpFileInformation=0x27219d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcac07c70, ftCreationTime.dwHighDateTime=0x1d5e26e, ftLastAccessTime.dwLowDateTime=0x6958c2c0, ftLastAccessTime.dwHighDateTime=0x1d5e47c, ftLastWriteTime.dwLowDateTime=0x6958c2c0, ftLastWriteTime.dwHighDateTime=0x1d5e47c, nFileSizeHigh=0x0, nFileSizeLow=0x17bbc)) returned 1 [0080.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0080.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", lpFilePart=0x0) returned 0x53 [0080.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0080.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\-jsrixkfztmodjd.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.908] GetFileType (hFile=0x2b8) returned 0x1 [0080.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0080.908] GetFileType (hFile=0x2b8) returned 0x1 [0080.908] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x17bbc [0080.908] ReadFile (in: hFile=0x2b8, lpBuffer=0x127ad608, nNumberOfBytesToRead=0x17bbc, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x127ad608*, lpNumberOfBytesRead=0x1c9ae9f8*=0x17bbc, lpOverlapped=0x0) returned 1 [0080.910] CloseHandle (hObject=0x2b8) returned 1 [0080.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", lpFilePart=0x0) returned 0x53 [0080.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0080.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\-jsrixkfztmodjd.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.941] GetFileType (hFile=0x2b8) returned 0x1 [0080.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0080.941] GetFileType (hFile=0x2b8) returned 0x1 [0080.941] WriteFile (in: hFile=0x2b8, lpBuffer=0x12824168*, nNumberOfBytesToWrite=0x17bc0, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x12824168*, lpNumberOfBytesWritten=0x1c9aea88*=0x17bc0, lpOverlapped=0x0) returned 1 [0080.944] CloseHandle (hObject=0x2b8) returned 1 [0080.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", lpFilePart=0x0) returned 0x53 [0080.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", lpFilePart=0x0) returned 0x53 [0080.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\-jsrixkfztmodjd.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.945] GetFileType (hFile=0x2b8) returned 0x1 [0080.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.946] GetFileType (hFile=0x2b8) returned 0x1 [0080.946] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x17bc0 [0080.946] WriteFile (in: hFile=0x2b8, lpBuffer=0x27998b0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x27998b0*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0080.949] CloseHandle (hObject=0x2b8) returned 1 [0080.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3", lpFilePart=0x0) returned 0x53 [0080.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\LUpTcklYS2ZaVG1vREpkLm1wMw==", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\LUpTcklYS2ZaVG1vREpkLm1wMw==", lpFilePart=0x0) returned 0x5c [0080.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0080.950] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\-jsrixkfztmodjd.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcac07c70, ftCreationTime.dwHighDateTime=0x1d5e26e, ftLastAccessTime.dwLowDateTime=0x6958c2c0, ftLastAccessTime.dwHighDateTime=0x1d5e47c, ftLastWriteTime.dwLowDateTime=0xd7f856c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x17bca)) returned 1 [0080.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0080.950] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\-JSrIXKfZTmoDJd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\-jsrixkfztmodjd.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\LUpTcklYS2ZaVG1vREpkLm1wMw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\luptcklys2zavg1vrepklm1wmw==")) returned 1 [0080.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", lpFilePart=0x0) returned 0x53 [0080.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0080.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\27odplwlxzat6lq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.951] GetFileType (hFile=0x2b8) returned 0x1 [0080.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0080.951] GetFileType (hFile=0x2b8) returned 0x1 [0080.951] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x78d5 [0080.951] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=30923, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x78cb [0080.951] ReadFile (in: hFile=0x2b8, lpBuffer=0x279ad30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x279ad30*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0080.952] CloseHandle (hObject=0x2b8) returned 1 [0080.953] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0080.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", lpFilePart=0x0) returned 0x53 [0080.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0080.956] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\27odplwlxzat6lq.wav"), fInfoLevelId=0x0, lpFileInformation=0x28078a0 | out: lpFileInformation=0x28078a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340cd370, ftCreationTime.dwHighDateTime=0x1d5e3b1, ftLastAccessTime.dwLowDateTime=0xc113f730, ftLastAccessTime.dwHighDateTime=0x1d5d9ca, ftLastWriteTime.dwLowDateTime=0xc113f730, ftLastWriteTime.dwHighDateTime=0x1d5d9ca, nFileSizeHigh=0x0, nFileSizeLow=0x78d5)) returned 1 [0080.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0080.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", lpFilePart=0x0) returned 0x53 [0080.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0080.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\27odplwlxzat6lq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.957] GetFileType (hFile=0x2b8) returned 0x1 [0080.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0080.957] GetFileType (hFile=0x2b8) returned 0x1 [0080.957] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x78d5 [0080.957] ReadFile (in: hFile=0x2b8, lpBuffer=0x2807b98, nNumberOfBytesToRead=0x78d5, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2807b98*, lpNumberOfBytesRead=0x1c9ae9f8*=0x78d5, lpOverlapped=0x0) returned 1 [0080.957] CloseHandle (hObject=0x2b8) returned 1 [0080.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", lpFilePart=0x0) returned 0x53 [0080.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0080.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\27odplwlxzat6lq.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.973] GetFileType (hFile=0x2b8) returned 0x1 [0080.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0080.973] GetFileType (hFile=0x2b8) returned 0x1 [0080.973] WriteFile (in: hFile=0x2b8, lpBuffer=0x28a4150*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x28a4150*, lpNumberOfBytesWritten=0x1c9aea88*=0x78e0, lpOverlapped=0x0) returned 1 [0080.974] CloseHandle (hObject=0x2b8) returned 1 [0080.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", lpFilePart=0x0) returned 0x53 [0080.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", lpFilePart=0x0) returned 0x53 [0080.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0080.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\27odplwlxzat6lq.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.975] GetFileType (hFile=0x2b8) returned 0x1 [0080.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0080.975] GetFileType (hFile=0x2b8) returned 0x1 [0080.975] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x78e0 [0080.975] WriteFile (in: hFile=0x2b8, lpBuffer=0x28aca58*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x28aca58*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0080.976] CloseHandle (hObject=0x2b8) returned 1 [0080.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav", lpFilePart=0x0) returned 0x53 [0080.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\MjdvRHBMV2xYWmFUNmxRLndhdg==", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\MjdvRHBMV2xYWmFUNmxRLndhdg==", lpFilePart=0x0) returned 0x5c [0080.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0080.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\27odplwlxzat6lq.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340cd370, ftCreationTime.dwHighDateTime=0x1d5e3b1, ftLastAccessTime.dwLowDateTime=0xc113f730, ftLastAccessTime.dwHighDateTime=0x1d5d9ca, ftLastWriteTime.dwLowDateTime=0xd7fab820, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x78ea)) returned 1 [0080.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0080.976] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\27oDpLWlXZaT6lQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\27odplwlxzat6lq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\MjdvRHBMV2xYWmFUNmxRLndhdg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\mjdvrhbmv2xywmfunmxrlndhdg==")) returned 1 [0080.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", lpFilePart=0x0) returned 0x4f [0080.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0080.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\2nw_hwijlna.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0080.977] GetFileType (hFile=0x2b8) returned 0x1 [0080.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0080.977] GetFileType (hFile=0x2b8) returned 0x1 [0080.977] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0xfd28 [0080.977] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=64798, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0xfd1e [0080.977] ReadFile (in: hFile=0x2b8, lpBuffer=0x28adec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x28adec8*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0080.978] CloseHandle (hObject=0x2b8) returned 1 [0080.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0081.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", lpFilePart=0x0) returned 0x4f [0081.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.001] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\2nw_hwijlna.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2732168 | out: lpFileInformation=0x2732168*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec0ebf0, ftCreationTime.dwHighDateTime=0x1d5d808, ftLastAccessTime.dwLowDateTime=0x3818ce50, ftLastAccessTime.dwHighDateTime=0x1d5e5ec, ftLastWriteTime.dwLowDateTime=0x3818ce50, ftLastWriteTime.dwHighDateTime=0x1d5e5ec, nFileSizeHigh=0x0, nFileSizeLow=0xfd28)) returned 1 [0081.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0081.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", lpFilePart=0x0) returned 0x4f [0081.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0081.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\2nw_hwijlna.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.001] GetFileType (hFile=0x2b8) returned 0x1 [0081.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0081.002] GetFileType (hFile=0x2b8) returned 0x1 [0081.002] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0xfd28 [0081.002] ReadFile (in: hFile=0x2b8, lpBuffer=0x2732440, nNumberOfBytesToRead=0xfd28, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2732440*, lpNumberOfBytesRead=0x1c9ae9f8*=0xfd28, lpOverlapped=0x0) returned 1 [0081.002] CloseHandle (hObject=0x2b8) returned 1 [0081.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", lpFilePart=0x0) returned 0x4f [0081.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0081.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\2nw_hwijlna.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.031] GetFileType (hFile=0x2b8) returned 0x1 [0081.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0081.031] GetFileType (hFile=0x2b8) returned 0x1 [0081.031] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d87c0*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x27d87c0*, lpNumberOfBytesWritten=0x1c9aea88*=0xfd30, lpOverlapped=0x0) returned 1 [0081.033] CloseHandle (hObject=0x2b8) returned 1 [0081.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", lpFilePart=0x0) returned 0x4f [0081.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", lpFilePart=0x0) returned 0x4f [0081.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\2nw_hwijlna.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.034] GetFileType (hFile=0x2b8) returned 0x1 [0081.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.034] GetFileType (hFile=0x2b8) returned 0x1 [0081.034] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0xfd30 [0081.034] WriteFile (in: hFile=0x2b8, lpBuffer=0x27e94c8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x27e94c8*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0081.034] CloseHandle (hObject=0x2b8) returned 1 [0081.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3", lpFilePart=0x0) returned 0x4f [0081.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\Mm53X0h3aWpsbkEubXAz", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\Mm53X0h3aWpsbkEubXAz", lpFilePart=0x0) returned 0x54 [0081.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0081.035] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\2nw_hwijlna.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec0ebf0, ftCreationTime.dwHighDateTime=0x1d5d808, ftLastAccessTime.dwLowDateTime=0x3818ce50, ftLastAccessTime.dwHighDateTime=0x1d5e5ec, ftLastWriteTime.dwLowDateTime=0xd8043da0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xfd3a)) returned 1 [0081.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0081.035] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\2nw_HwijlnA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\2nw_hwijlna.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\Mm53X0h3aWpsbkEubXAz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\mm53x0h3awpsbkeubxaz")) returned 1 [0081.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", lpFilePart=0x0) returned 0x4c [0081.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0081.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jpprwx t.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.036] GetFileType (hFile=0x2b8) returned 0x1 [0081.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0081.036] GetFileType (hFile=0x2b8) returned 0x1 [0081.036] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x188c7 [0081.036] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=100541, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x188bd [0081.036] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ea910, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x27ea910*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0081.037] CloseHandle (hObject=0x2b8) returned 1 [0081.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0081.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", lpFilePart=0x0) returned 0x4c [0081.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jpprwx t.wav"), fInfoLevelId=0x0, lpFileInformation=0x2857480 | out: lpFileInformation=0x2857480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f54f780, ftCreationTime.dwHighDateTime=0x1d5df20, ftLastAccessTime.dwLowDateTime=0x463a0f30, ftLastAccessTime.dwHighDateTime=0x1d5e7b3, ftLastWriteTime.dwLowDateTime=0x463a0f30, ftLastWriteTime.dwHighDateTime=0x1d5e7b3, nFileSizeHigh=0x0, nFileSizeLow=0x188c7)) returned 1 [0081.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0081.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", lpFilePart=0x0) returned 0x4c [0081.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0081.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jpprwx t.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.039] GetFileType (hFile=0x2b8) returned 0x1 [0081.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0081.039] GetFileType (hFile=0x2b8) returned 0x1 [0081.039] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x188c7 [0081.039] ReadFile (in: hFile=0x2b8, lpBuffer=0x1285b7d8, nNumberOfBytesToRead=0x188c7, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x1285b7d8*, lpNumberOfBytesRead=0x1c9ae9f8*=0x188c7, lpOverlapped=0x0) returned 1 [0081.046] CloseHandle (hObject=0x2b8) returned 1 [0081.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", lpFilePart=0x0) returned 0x4c [0081.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0081.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jpprwx t.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.081] GetFileType (hFile=0x2b8) returned 0x1 [0081.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0081.081] GetFileType (hFile=0x2b8) returned 0x1 [0081.081] WriteFile (in: hFile=0x2b8, lpBuffer=0x128d6480*, nNumberOfBytesToWrite=0x188d0, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x128d6480*, lpNumberOfBytesWritten=0x1c9aea88*=0x188d0, lpOverlapped=0x0) returned 1 [0081.084] CloseHandle (hObject=0x2b8) returned 1 [0081.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", lpFilePart=0x0) returned 0x4c [0081.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", lpFilePart=0x0) returned 0x4c [0081.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jpprwx t.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.085] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x188d0 [0081.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav", lpFilePart=0x0) returned 0x4c [0081.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\anBwcld4IHQud2F2", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\anBwcld4IHQud2F2", lpFilePart=0x0) returned 0x50 [0081.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0081.086] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jpprwx t.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f54f780, ftCreationTime.dwHighDateTime=0x1d5df20, ftLastAccessTime.dwLowDateTime=0x463a0f30, ftLastAccessTime.dwHighDateTime=0x1d5e7b3, ftLastWriteTime.dwLowDateTime=0xd80b61c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x188da)) returned 1 [0081.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0081.086] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jpprWx t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jpprwx t.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\anBwcld4IHQud2F2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\anbwcld4ihqud2f2")) returned 1 [0081.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", lpFilePart=0x0) returned 0x55 [0081.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0081.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jym3nibgq8zzysk8g.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0081.087] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x134b2 [0081.087] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=79016, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x134a8 [0081.087] ReadFile (in: hFile=0x2b8, lpBuffer=0x28d06a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x28d06a0*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0081.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", lpFilePart=0x0) returned 0x55 [0081.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jym3nibgq8zzysk8g.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2765e38 | out: lpFileInformation=0x2765e38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03aa810, ftCreationTime.dwHighDateTime=0x1d5dc09, ftLastAccessTime.dwLowDateTime=0xf91772e0, ftLastAccessTime.dwHighDateTime=0x1d5e01b, ftLastWriteTime.dwLowDateTime=0xf91772e0, ftLastWriteTime.dwHighDateTime=0x1d5e01b, nFileSizeHigh=0x0, nFileSizeLow=0x134b2)) returned 1 [0081.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0081.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", lpFilePart=0x0) returned 0x55 [0081.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0081.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jym3nibgq8zzysk8g.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.098] GetFileType (hFile=0x2b8) returned 0x1 [0081.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0081.098] GetFileType (hFile=0x2b8) returned 0x1 [0081.098] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x134b2 [0081.098] ReadFile (in: hFile=0x2b8, lpBuffer=0x2766150, nNumberOfBytesToRead=0x134b2, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2766150*, lpNumberOfBytesRead=0x1c9ae9f8*=0x134b2, lpOverlapped=0x0) returned 1 [0081.098] CloseHandle (hObject=0x2b8) returned 1 [0081.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", lpFilePart=0x0) returned 0x55 [0081.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0081.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jym3nibgq8zzysk8g.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.128] GetFileType (hFile=0x2b8) returned 0x1 [0081.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0081.129] GetFileType (hFile=0x2b8) returned 0x1 [0081.129] WriteFile (in: hFile=0x2b8, lpBuffer=0x2816b88*, nNumberOfBytesToWrite=0x134c0, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x2816b88*, lpNumberOfBytesWritten=0x1c9aea88*=0x134c0, lpOverlapped=0x0) returned 1 [0081.130] CloseHandle (hObject=0x2b8) returned 1 [0081.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", lpFilePart=0x0) returned 0x55 [0081.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", lpFilePart=0x0) returned 0x55 [0081.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jym3nibgq8zzysk8g.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.132] GetFileType (hFile=0x2b8) returned 0x1 [0081.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.132] GetFileType (hFile=0x2b8) returned 0x1 [0081.132] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x134c0 [0081.132] WriteFile (in: hFile=0x2b8, lpBuffer=0x282b0a8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x282b0a8*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0081.132] CloseHandle (hObject=0x2b8) returned 1 [0081.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a", lpFilePart=0x0) returned 0x55 [0081.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\anltM05pQkdxOHp6WXNrOGcubTRh", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\anltM05pQkdxOHp6WXNrOGcubTRh", lpFilePart=0x0) returned 0x5c [0081.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0081.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jym3nibgq8zzysk8g.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03aa810, ftCreationTime.dwHighDateTime=0x1d5dc09, ftLastAccessTime.dwLowDateTime=0xf91772e0, ftLastAccessTime.dwHighDateTime=0x1d5e01b, ftLastWriteTime.dwLowDateTime=0xd81285e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x134ca)) returned 1 [0081.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0081.132] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\jym3NiBGq8zzYsk8g.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\jym3nibgq8zzysk8g.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\anltM05pQkdxOHp6WXNrOGcubTRh" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\anltm05pqkdxohp6wxnrogcubtrh")) returned 1 [0081.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", lpFilePart=0x0) returned 0x54 [0081.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0081.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\pyvlrg_lwqvzruhu.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.133] GetFileType (hFile=0x2b8) returned 0x1 [0081.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0081.133] GetFileType (hFile=0x2b8) returned 0x1 [0081.133] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x13170 [0081.134] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=78182, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x13166 [0081.134] ReadFile (in: hFile=0x2b8, lpBuffer=0x282c540, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x282c540*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0081.134] CloseHandle (hObject=0x2b8) returned 1 [0081.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aea80 | out: SystemInformation=0x12641930, ResultLength=0x1c9aea80*=0x11b98) returned 0x0 [0081.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", lpFilePart=0x0) returned 0x54 [0081.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\pyvlrg_lwqvzruhu.m4a"), fInfoLevelId=0x0, lpFileInformation=0x2899070 | out: lpFileInformation=0x2899070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0a2250, ftCreationTime.dwHighDateTime=0x1d5e069, ftLastAccessTime.dwLowDateTime=0x385e66a0, ftLastAccessTime.dwHighDateTime=0x1d5e0b9, ftLastWriteTime.dwLowDateTime=0x385e66a0, ftLastWriteTime.dwHighDateTime=0x1d5e0b9, nFileSizeHigh=0x0, nFileSizeLow=0x13170)) returned 1 [0081.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0081.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", lpFilePart=0x0) returned 0x54 [0081.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0081.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\pyvlrg_lwqvzruhu.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.137] GetFileType (hFile=0x2b8) returned 0x1 [0081.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0081.137] GetFileType (hFile=0x2b8) returned 0x1 [0081.137] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x13170 [0081.137] ReadFile (in: hFile=0x2b8, lpBuffer=0x2899388, nNumberOfBytesToRead=0x13170, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2899388*, lpNumberOfBytesRead=0x1c9ae9f8*=0x13170, lpOverlapped=0x0) returned 1 [0081.137] CloseHandle (hObject=0x2b8) returned 1 [0081.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", lpFilePart=0x0) returned 0x54 [0081.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0081.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\pyvlrg_lwqvzruhu.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.170] GetFileType (hFile=0x2b8) returned 0x1 [0081.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0081.170] GetFileType (hFile=0x2b8) returned 0x1 [0081.170] WriteFile (in: hFile=0x2b8, lpBuffer=0x27169c0*, nNumberOfBytesToWrite=0x13180, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x27169c0*, lpNumberOfBytesWritten=0x1c9aea88*=0x13180, lpOverlapped=0x0) returned 1 [0081.172] CloseHandle (hObject=0x2b8) returned 1 [0081.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", lpFilePart=0x0) returned 0x54 [0081.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", lpFilePart=0x0) returned 0x54 [0081.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\pyvlrg_lwqvzruhu.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.172] GetFileType (hFile=0x2b8) returned 0x1 [0081.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.172] GetFileType (hFile=0x2b8) returned 0x1 [0081.172] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x13180 [0081.173] WriteFile (in: hFile=0x2b8, lpBuffer=0x272aba0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x272aba0*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0081.173] CloseHandle (hObject=0x2b8) returned 1 [0081.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a", lpFilePart=0x0) returned 0x54 [0081.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\cHl2THJHX0xXcVZacnVoVS5tNGE=", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\cHl2THJHX0xXcVZacnVoVS5tNGE=", lpFilePart=0x0) returned 0x5c [0081.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0081.173] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\pyvlrg_lwqvzruhu.m4a"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0a2250, ftCreationTime.dwHighDateTime=0x1d5e069, ftLastAccessTime.dwLowDateTime=0x385e66a0, ftLastAccessTime.dwHighDateTime=0x1d5e0b9, ftLastWriteTime.dwLowDateTime=0xd819aa00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1318a)) returned 1 [0081.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0081.173] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\pyvLrG_LWqVZruhU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\pyvlrg_lwqvzruhu.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\cHl2THJHX0xXcVZacnVoVS5tNGE=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\chl2thjhx0xxcvzacnvovs5tnge=")) returned 1 [0081.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", lpFilePart=0x0) returned 0x4b [0081.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0081.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\sbcklwn.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.174] GetFileType (hFile=0x2b8) returned 0x1 [0081.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0081.174] GetFileType (hFile=0x2b8) returned 0x1 [0081.174] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x9820 [0081.174] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=38934, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x9816 [0081.174] ReadFile (in: hFile=0x2b8, lpBuffer=0x272c008, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x272c008*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0081.175] CloseHandle (hObject=0x2b8) returned 1 [0081.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", lpFilePart=0x0) returned 0x4b [0081.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.176] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\sbcklwn.wav"), fInfoLevelId=0x0, lpFileInformation=0x2798b38 | out: lpFileInformation=0x2798b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5edb350, ftCreationTime.dwHighDateTime=0x1d5dfde, ftLastAccessTime.dwLowDateTime=0x7b73000, ftLastAccessTime.dwHighDateTime=0x1d5da37, ftLastWriteTime.dwLowDateTime=0x7b73000, ftLastWriteTime.dwHighDateTime=0x1d5da37, nFileSizeHigh=0x0, nFileSizeLow=0x9820)) returned 1 [0081.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0081.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", lpFilePart=0x0) returned 0x4b [0081.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0081.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\sbcklwn.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.177] GetFileType (hFile=0x2b8) returned 0x1 [0081.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0081.177] GetFileType (hFile=0x2b8) returned 0x1 [0081.177] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x9820 [0081.177] ReadFile (in: hFile=0x2b8, lpBuffer=0x2798df0, nNumberOfBytesToRead=0x9820, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x2798df0*, lpNumberOfBytesRead=0x1c9ae9f8*=0x9820, lpOverlapped=0x0) returned 1 [0081.177] CloseHandle (hObject=0x2b8) returned 1 [0081.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", lpFilePart=0x0) returned 0x4b [0081.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0081.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\sbcklwn.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.189] GetFileType (hFile=0x2b8) returned 0x1 [0081.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0081.189] GetFileType (hFile=0x2b8) returned 0x1 [0081.189] WriteFile (in: hFile=0x2b8, lpBuffer=0x283f2c8*, nNumberOfBytesToWrite=0x9830, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x283f2c8*, lpNumberOfBytesWritten=0x1c9aea88*=0x9830, lpOverlapped=0x0) returned 1 [0081.190] CloseHandle (hObject=0x2b8) returned 1 [0081.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", lpFilePart=0x0) returned 0x4b [0081.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", lpFilePart=0x0) returned 0x4b [0081.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\sbcklwn.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.191] GetFileType (hFile=0x2b8) returned 0x1 [0081.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.191] GetFileType (hFile=0x2b8) returned 0x1 [0081.191] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x9830 [0081.191] WriteFile (in: hFile=0x2b8, lpBuffer=0x2849a90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x2849a90*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0081.191] CloseHandle (hObject=0x2b8) returned 1 [0081.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav", lpFilePart=0x0) returned 0x4b [0081.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\c0JDS2xXbi53YXY=", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\c0JDS2xXbi53YXY=", lpFilePart=0x0) returned 0x50 [0081.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0081.191] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\sbcklwn.wav"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5edb350, ftCreationTime.dwHighDateTime=0x1d5dfde, ftLastAccessTime.dwLowDateTime=0x7b73000, ftLastAccessTime.dwHighDateTime=0x1d5da37, ftLastWriteTime.dwLowDateTime=0xd81c0b60, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x983a)) returned 1 [0081.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0081.192] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\sBCKlWn.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\sbcklwn.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\c0JDS2xXbi53YXY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\c0jds2xxbi53yxy=")) returned 1 [0081.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", lpFilePart=0x0) returned 0x57 [0081.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0081.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\svgtwv7w2fzakpsr-ha.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.192] GetFileType (hFile=0x2b8) returned 0x1 [0081.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0081.192] GetFileType (hFile=0x2b8) returned 0x1 [0081.192] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x7bfb [0081.192] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=31729, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x7bf1 [0081.193] ReadFile (in: hFile=0x2b8, lpBuffer=0x284aee0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x284aee0*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0081.193] CloseHandle (hObject=0x2b8) returned 1 [0081.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", lpFilePart=0x0) returned 0x57 [0081.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.195] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\svgtwv7w2fzakpsr-ha.mp3"), fInfoLevelId=0x0, lpFileInformation=0x28b7ad0 | out: lpFileInformation=0x28b7ad0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a775a30, ftCreationTime.dwHighDateTime=0x1d5dde2, ftLastAccessTime.dwLowDateTime=0x40d18880, ftLastAccessTime.dwHighDateTime=0x1d5e1bd, ftLastWriteTime.dwLowDateTime=0x40d18880, ftLastWriteTime.dwHighDateTime=0x1d5e1bd, nFileSizeHigh=0x0, nFileSizeLow=0x7bfb)) returned 1 [0081.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0081.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", lpFilePart=0x0) returned 0x57 [0081.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0081.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\svgtwv7w2fzakpsr-ha.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.195] GetFileType (hFile=0x2b8) returned 0x1 [0081.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0081.195] GetFileType (hFile=0x2b8) returned 0x1 [0081.195] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x7bfb [0081.195] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b7de8, nNumberOfBytesToRead=0x7bfb, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x28b7de8*, lpNumberOfBytesRead=0x1c9ae9f8*=0x7bfb, lpOverlapped=0x0) returned 1 [0081.199] CloseHandle (hObject=0x2b8) returned 1 [0081.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", lpFilePart=0x0) returned 0x57 [0081.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0081.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\svgtwv7w2fzakpsr-ha.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.244] GetFileType (hFile=0x2b8) returned 0x1 [0081.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0081.244] GetFileType (hFile=0x2b8) returned 0x1 [0081.245] WriteFile (in: hFile=0x2b8, lpBuffer=0x2787818*, nNumberOfBytesToWrite=0x7c00, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x2787818*, lpNumberOfBytesWritten=0x1c9aea88*=0x7c00, lpOverlapped=0x0) returned 1 [0081.246] CloseHandle (hObject=0x2b8) returned 1 [0081.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", lpFilePart=0x0) returned 0x57 [0081.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", lpFilePart=0x0) returned 0x57 [0081.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\svgtwv7w2fzakpsr-ha.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.247] GetFileType (hFile=0x2b8) returned 0x1 [0081.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.247] GetFileType (hFile=0x2b8) returned 0x1 [0081.247] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x7c00 [0081.247] WriteFile (in: hFile=0x2b8, lpBuffer=0x2790480*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x2790480*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0081.247] CloseHandle (hObject=0x2b8) returned 1 [0081.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3", lpFilePart=0x0) returned 0x57 [0081.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\c3ZnVHd2N1cyZnphS1BTci1IQS5tcDM=", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\c3ZnVHd2N1cyZnphS1BTci1IQS5tcDM=", lpFilePart=0x0) returned 0x60 [0081.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0081.248] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\svgtwv7w2fzakpsr-ha.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a775a30, ftCreationTime.dwHighDateTime=0x1d5dde2, ftLastAccessTime.dwLowDateTime=0x40d18880, ftLastAccessTime.dwHighDateTime=0x1d5e1bd, ftLastWriteTime.dwLowDateTime=0xd82590e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x7c0a)) returned 1 [0081.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0081.248] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\svgTwv7W2fzaKPSr-HA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\svgtwv7w2fzakpsr-ha.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\c3ZnVHd2N1cyZnphS1BTci1IQS5tcDM=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\c3znvhd2n1cyznphs1btci1iqs5tcdm=")) returned 1 [0081.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", lpFilePart=0x0) returned 0x55 [0081.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea60) returned 1 [0081.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\y4f925rt9fdp-6ka_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.249] GetFileType (hFile=0x2b8) returned 0x1 [0081.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9d0) returned 1 [0081.249] GetFileType (hFile=0x2b8) returned 0x1 [0081.249] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec28 | out: lpFileSizeHigh=0x1c9aec28*=0x0) returned 0x8c2b [0081.249] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=35873, lpDistanceToMoveHigh=0x1c9aeb88*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aeb88*=0) returned 0x8c21 [0081.249] ReadFile (in: hFile=0x2b8, lpBuffer=0x2791928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb58, lpOverlapped=0x0 | out: lpBuffer=0x2791928*, lpNumberOfBytesRead=0x1c9aeb58*=0xa, lpOverlapped=0x0) returned 1 [0081.250] CloseHandle (hObject=0x2b8) returned 1 [0081.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", lpFilePart=0x0) returned 0x55 [0081.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.253] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\y4f925rt9fdp-6ka_.mp3"), fInfoLevelId=0x0, lpFileInformation=0x27fe378 | out: lpFileInformation=0x27fe378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c52930, ftCreationTime.dwHighDateTime=0x1d5df9e, ftLastAccessTime.dwLowDateTime=0x939de8a0, ftLastAccessTime.dwHighDateTime=0x1d5e425, ftLastWriteTime.dwLowDateTime=0x939de8a0, ftLastWriteTime.dwHighDateTime=0x1d5e425, nFileSizeHigh=0x0, nFileSizeLow=0x8c2b)) returned 1 [0081.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea30) returned 1 [0081.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", lpFilePart=0x0) returned 0x55 [0081.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae930) returned 1 [0081.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\y4f925rt9fdp-6ka_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.253] GetFileType (hFile=0x2b8) returned 0x1 [0081.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8a0) returned 1 [0081.253] GetFileType (hFile=0x2b8) returned 0x1 [0081.253] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeac8 | out: lpFileSizeHigh=0x1c9aeac8*=0x0) returned 0x8c2b [0081.254] ReadFile (in: hFile=0x2b8, lpBuffer=0x27fe690, nNumberOfBytesToRead=0x8c2b, lpNumberOfBytesRead=0x1c9ae9f8, lpOverlapped=0x0 | out: lpBuffer=0x27fe690*, lpNumberOfBytesRead=0x1c9ae9f8*=0x8c2b, lpOverlapped=0x0) returned 1 [0081.254] CloseHandle (hObject=0x2b8) returned 1 [0081.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", lpFilePart=0x0) returned 0x55 [0081.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae960) returned 1 [0081.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\y4f925rt9fdp-6ka_.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.287] GetFileType (hFile=0x2b8) returned 0x1 [0081.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8d0) returned 1 [0081.287] GetFileType (hFile=0x2b8) returned 0x1 [0081.287] WriteFile (in: hFile=0x2b8, lpBuffer=0x28a0f70*, nNumberOfBytesToWrite=0x8c30, lpNumberOfBytesWritten=0x1c9aea88, lpOverlapped=0x0 | out: lpBuffer=0x28a0f70*, lpNumberOfBytesWritten=0x1c9aea88*=0x8c30, lpOverlapped=0x0) returned 1 [0081.288] CloseHandle (hObject=0x2b8) returned 1 [0081.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", lpFilePart=0x0) returned 0x55 [0081.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", lpFilePart=0x0) returned 0x55 [0081.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\y4f925rt9fdp-6ka_.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.289] GetFileType (hFile=0x2b8) returned 0x1 [0081.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.289] GetFileType (hFile=0x2b8) returned 0x1 [0081.289] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9ae9e8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9ae9e8*=0) returned 0x8c30 [0081.290] WriteFile (in: hFile=0x2b8, lpBuffer=0x28aac00*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeaa8, lpOverlapped=0x0 | out: lpBuffer=0x28aac00*, lpNumberOfBytesWritten=0x1c9aeaa8*=0xa, lpOverlapped=0x0) returned 1 [0081.290] CloseHandle (hObject=0x2b8) returned 1 [0081.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3", lpFilePart=0x0) returned 0x55 [0081.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\eTRmOTI1UnQ5RkRwLTZrYV8ubXAz", nBufferLength=0x105, lpBuffer=0x1c9ae5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\eTRmOTI1UnQ5RkRwLTZrYV8ubXAz", lpFilePart=0x0) returned 0x5c [0081.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea30) returned 1 [0081.290] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\y4f925rt9fdp-6ka_.mp3"), fInfoLevelId=0x0, lpFileInformation=0x1c9aeb10 | out: lpFileInformation=0x1c9aeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c52930, ftCreationTime.dwHighDateTime=0x1d5df9e, ftLastAccessTime.dwLowDateTime=0x939de8a0, ftLastAccessTime.dwHighDateTime=0x1d5e425, ftLastWriteTime.dwLowDateTime=0xd82cb500, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x8c3a)) returned 1 [0081.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9f0) returned 1 [0081.291] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\y4f925Rt9FDp-6ka_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\y4f925rt9fdp-6ka_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\eTRmOTI1UnQ5RkRwLTZrYV8ubXAz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\etrmoti1unq5rkrwltzryv8ubxaz")) returned 1 [0081.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae490, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\README_3728769.txt", lpFilePart=0x0) returned 0x52 [0081.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae970) returned 1 [0081.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\jlPduVx2WRA9sDc\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\jlpduvx2wra9sdc\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0081.293] GetFileType (hFile=0x2b8) returned 0x1 [0081.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae8e0) returned 1 [0081.293] GetFileType (hFile=0x2b8) returned 0x1 [0081.293] WriteFile (in: hFile=0x2b8, lpBuffer=0x28aefa0*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9ae9b8, lpOverlapped=0x0 | out: lpBuffer=0x28aefa0*, lpNumberOfBytesWritten=0x1c9ae9b8*=0x5b3, lpOverlapped=0x0) returned 1 [0081.294] CloseHandle (hObject=0x2b8) returned 1 [0081.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\README_3728769.txt", lpFilePart=0x0) returned 0x42 [0081.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0081.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iksMYoBfEE2\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iksmyobfee2\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0081.295] GetFileType (hFile=0x2b8) returned 0x1 [0081.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0081.296] GetFileType (hFile=0x2b8) returned 0x1 [0081.296] WriteFile (in: hFile=0x2b8, lpBuffer=0x28b3068*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x28b3068*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0081.297] CloseHandle (hObject=0x2b8) returned 1 [0081.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\README_3728769.txt", lpFilePart=0x0) returned 0x36 [0081.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeab0) returned 1 [0081.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0081.297] GetFileType (hFile=0x2b8) returned 0x1 [0081.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea20) returned 1 [0081.298] GetFileType (hFile=0x2b8) returned 0x1 [0081.298] WriteFile (in: hFile=0x2b8, lpBuffer=0x28b7100*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aeaf8, lpOverlapped=0x0 | out: lpBuffer=0x28b7100*, lpNumberOfBytesWritten=0x1c9aeaf8*=0x5b3, lpOverlapped=0x0) returned 1 [0081.299] CloseHandle (hObject=0x2b8) returned 1 [0081.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0081.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents", lpFilePart=0x0) returned 0x2a [0081.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\", lpFilePart=0x0) returned 0x2b [0081.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0081.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb80) returned 1 [0081.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0081.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood", lpFilePart=0x0) returned 0x25 [0081.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\", lpFilePart=0x0) returned 0x26 [0081.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0081.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb80) returned 1 [0081.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0081.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0081.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0081.307] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd91d7ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd91d7ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0081.308] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd91d7ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd91d7ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.308] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd14281f0, ftCreationTime.dwHighDateTime=0x1d5db49, ftLastAccessTime.dwLowDateTime=0xa8389700, ftLastAccessTime.dwHighDateTime=0x1d5de18, ftLastWriteTime.dwLowDateTime=0xa8389700, ftLastWriteTime.dwHighDateTime=0x1d5de18, nFileSizeHigh=0x0, nFileSizeLow=0x59a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-NH_qIaABhiaXwXbZ2l.bmp", cAlternateFileName="-NH_QI~1.BMP")) returned 1 [0081.308] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b11f50, ftCreationTime.dwHighDateTime=0x1d5e52b, ftLastAccessTime.dwLowDateTime=0xa88ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e28f, ftLastWriteTime.dwLowDateTime=0xa88ea8e0, ftLastWriteTime.dwHighDateTime=0x1d5e28f, nFileSizeHigh=0x0, nFileSizeLow=0xbc89, dwReserved0=0x0, dwReserved1=0x0, cFileName="1cZEn-j33S.png", cAlternateFileName="1CZEN-~1.PNG")) returned 1 [0081.308] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b1b1d0, ftCreationTime.dwHighDateTime=0x1d5de46, ftLastAccessTime.dwLowDateTime=0xacf1d270, ftLastAccessTime.dwHighDateTime=0x1d5e6a1, ftLastWriteTime.dwLowDateTime=0xacf1d270, ftLastWriteTime.dwHighDateTime=0x1d5e6a1, nFileSizeHigh=0x0, nFileSizeLow=0xb02b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ZseCLRtqbcvxXjIAj9.gif", cAlternateFileName="3ZSECL~1.GIF")) returned 1 [0081.308] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e9b2d0, ftCreationTime.dwHighDateTime=0x1d5de18, ftLastAccessTime.dwLowDateTime=0x59bad320, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x59bad320, ftLastWriteTime.dwHighDateTime=0x1d5e298, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="4TgAqTz.gif", cAlternateFileName="")) returned 1 [0081.308] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bd57c70, ftCreationTime.dwHighDateTime=0x1d5da11, ftLastAccessTime.dwLowDateTime=0x5efadb80, ftLastAccessTime.dwHighDateTime=0x1d5e3b2, ftLastWriteTime.dwLowDateTime=0x5efadb80, ftLastWriteTime.dwHighDateTime=0x1d5e3b2, nFileSizeHigh=0x0, nFileSizeLow=0x20f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="8OI 6HpvIO4-6kvYhSX.gif", cAlternateFileName="8OI6HP~1.GIF")) returned 1 [0081.308] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.310] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876323f0, ftCreationTime.dwHighDateTime=0x1d5e2bf, ftLastAccessTime.dwLowDateTime=0xc002b30, ftLastAccessTime.dwHighDateTime=0x1d5e7a7, ftLastWriteTime.dwLowDateTime=0xc002b30, ftLastWriteTime.dwHighDateTime=0x1d5e7a7, nFileSizeHigh=0x0, nFileSizeLow=0x18950, dwReserved0=0x0, dwReserved1=0x0, cFileName="dWG o1yVM1Ildid2.jpg", cAlternateFileName="DWGO1Y~1.JPG")) returned 1 [0081.310] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefec4890, ftCreationTime.dwHighDateTime=0x1d5e74f, ftLastAccessTime.dwLowDateTime=0x7d7578e0, ftLastAccessTime.dwHighDateTime=0x1d5d91c, ftLastWriteTime.dwLowDateTime=0x7d7578e0, ftLastWriteTime.dwHighDateTime=0x1d5d91c, nFileSizeHigh=0x0, nFileSizeLow=0x58a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvNF5DQQYjBKTSHW.bmp", cAlternateFileName="JVNF5D~1.BMP")) returned 1 [0081.310] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe073c0a0, ftCreationTime.dwHighDateTime=0x1d5e30d, ftLastAccessTime.dwLowDateTime=0x3af10e20, ftLastAccessTime.dwHighDateTime=0x1d5e2d7, ftLastWriteTime.dwLowDateTime=0x3af10e20, ftLastWriteTime.dwHighDateTime=0x1d5e2d7, nFileSizeHigh=0x0, nFileSizeLow=0x73ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="K5uhk_gMe7nodSphe.png", cAlternateFileName="K5UHK_~1.PNG")) returned 1 [0081.310] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6133aa30, ftCreationTime.dwHighDateTime=0x1d5e312, ftLastAccessTime.dwLowDateTime=0x958c8bb0, ftLastAccessTime.dwHighDateTime=0x1d5da81, ftLastWriteTime.dwLowDateTime=0x958c8bb0, ftLastWriteTime.dwHighDateTime=0x1d5da81, nFileSizeHigh=0x0, nFileSizeLow=0x14ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="M6-i.png", cAlternateFileName="")) returned 1 [0081.310] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b3f90, ftCreationTime.dwHighDateTime=0x1d5d9c6, ftLastAccessTime.dwLowDateTime=0xe1b26460, ftLastAccessTime.dwHighDateTime=0x1d5e47c, ftLastWriteTime.dwLowDateTime=0xe1b26460, ftLastWriteTime.dwHighDateTime=0x1d5e47c, nFileSizeHigh=0x0, nFileSizeLow=0xfd07, dwReserved0=0x0, dwReserved1=0x0, cFileName="o7MUqeDHlGSI U8s n.jpg", cAlternateFileName="O7MUQE~1.JPG")) returned 1 [0081.311] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x524c8980, ftCreationTime.dwHighDateTime=0x1d5d901, ftLastAccessTime.dwLowDateTime=0xbed1b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0xbed1b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e02a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="p0JhMXJ3vii0", cAlternateFileName="P0JHMX~1")) returned 1 [0081.311] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47795330, ftCreationTime.dwHighDateTime=0x1d5e685, ftLastAccessTime.dwLowDateTime=0xd5b4e650, ftLastAccessTime.dwHighDateTime=0x1d5db40, ftLastWriteTime.dwLowDateTime=0xd5b4e650, ftLastWriteTime.dwHighDateTime=0x1d5db40, nFileSizeHigh=0x0, nFileSizeLow=0x15d8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qroj3K4F.jpg", cAlternateFileName="")) returned 1 [0081.311] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87678cb0, ftCreationTime.dwHighDateTime=0x1d5decd, ftLastAccessTime.dwLowDateTime=0xd4bbbea0, ftLastAccessTime.dwHighDateTime=0x1d5e788, ftLastWriteTime.dwLowDateTime=0xd4bbbea0, ftLastWriteTime.dwHighDateTime=0x1d5e788, nFileSizeHigh=0x0, nFileSizeLow=0x13914, dwReserved0=0x0, dwReserved1=0x0, cFileName="uEsbV.jpg", cAlternateFileName="")) returned 1 [0081.311] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b93eee0, ftCreationTime.dwHighDateTime=0x1d5e724, ftLastAccessTime.dwLowDateTime=0x8bfba4b0, ftLastAccessTime.dwHighDateTime=0x1d5e629, ftLastWriteTime.dwLowDateTime=0x8bfba4b0, ftLastWriteTime.dwHighDateTime=0x1d5e629, nFileSizeHigh=0x0, nFileSizeLow=0xd683, dwReserved0=0x0, dwReserved1=0x0, cFileName="YOFsi.jpg", cAlternateFileName="")) returned 1 [0081.311] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed9a37e0, ftCreationTime.dwHighDateTime=0x1d5db3e, ftLastAccessTime.dwLowDateTime=0x4ee8c010, ftLastAccessTime.dwHighDateTime=0x1d5de1a, ftLastWriteTime.dwLowDateTime=0x4ee8c010, ftLastWriteTime.dwHighDateTime=0x1d5de1a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_IuQjjMW", cAlternateFileName="")) returned 1 [0081.311] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed9a37e0, ftCreationTime.dwHighDateTime=0x1d5db3e, ftLastAccessTime.dwLowDateTime=0x4ee8c010, ftLastAccessTime.dwHighDateTime=0x1d5de1a, ftLastWriteTime.dwLowDateTime=0x4ee8c010, ftLastWriteTime.dwHighDateTime=0x1d5de1a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_IuQjjMW", cAlternateFileName="")) returned 0 [0081.311] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0081.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0081.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0081.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aec50) returned 1 [0081.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x1c9ae740, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0081.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x1c9ae6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0081.312] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x1c9ae8f0 | out: lpFindFileData=0x1c9ae8f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd91d7ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd91d7ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0081.312] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd91d7ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd91d7ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.312] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd14281f0, ftCreationTime.dwHighDateTime=0x1d5db49, ftLastAccessTime.dwLowDateTime=0xa8389700, ftLastAccessTime.dwHighDateTime=0x1d5de18, ftLastWriteTime.dwLowDateTime=0xa8389700, ftLastWriteTime.dwHighDateTime=0x1d5de18, nFileSizeHigh=0x0, nFileSizeLow=0x59a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-NH_qIaABhiaXwXbZ2l.bmp", cAlternateFileName="-NH_QI~1.BMP")) returned 1 [0081.312] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b11f50, ftCreationTime.dwHighDateTime=0x1d5e52b, ftLastAccessTime.dwLowDateTime=0xa88ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e28f, ftLastWriteTime.dwLowDateTime=0xa88ea8e0, ftLastWriteTime.dwHighDateTime=0x1d5e28f, nFileSizeHigh=0x0, nFileSizeLow=0xbc89, dwReserved0=0x0, dwReserved1=0x0, cFileName="1cZEn-j33S.png", cAlternateFileName="1CZEN-~1.PNG")) returned 1 [0081.312] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b1b1d0, ftCreationTime.dwHighDateTime=0x1d5de46, ftLastAccessTime.dwLowDateTime=0xacf1d270, ftLastAccessTime.dwHighDateTime=0x1d5e6a1, ftLastWriteTime.dwLowDateTime=0xacf1d270, ftLastWriteTime.dwHighDateTime=0x1d5e6a1, nFileSizeHigh=0x0, nFileSizeLow=0xb02b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ZseCLRtqbcvxXjIAj9.gif", cAlternateFileName="3ZSECL~1.GIF")) returned 1 [0081.312] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e9b2d0, ftCreationTime.dwHighDateTime=0x1d5de18, ftLastAccessTime.dwLowDateTime=0x59bad320, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x59bad320, ftLastWriteTime.dwHighDateTime=0x1d5e298, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="4TgAqTz.gif", cAlternateFileName="")) returned 1 [0081.312] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bd57c70, ftCreationTime.dwHighDateTime=0x1d5da11, ftLastAccessTime.dwLowDateTime=0x5efadb80, ftLastAccessTime.dwHighDateTime=0x1d5e3b2, ftLastWriteTime.dwLowDateTime=0x5efadb80, ftLastWriteTime.dwHighDateTime=0x1d5e3b2, nFileSizeHigh=0x0, nFileSizeLow=0x20f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="8OI 6HpvIO4-6kvYhSX.gif", cAlternateFileName="8OI6HP~1.GIF")) returned 1 [0081.313] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.313] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876323f0, ftCreationTime.dwHighDateTime=0x1d5e2bf, ftLastAccessTime.dwLowDateTime=0xc002b30, ftLastAccessTime.dwHighDateTime=0x1d5e7a7, ftLastWriteTime.dwLowDateTime=0xc002b30, ftLastWriteTime.dwHighDateTime=0x1d5e7a7, nFileSizeHigh=0x0, nFileSizeLow=0x18950, dwReserved0=0x0, dwReserved1=0x0, cFileName="dWG o1yVM1Ildid2.jpg", cAlternateFileName="DWGO1Y~1.JPG")) returned 1 [0081.313] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefec4890, ftCreationTime.dwHighDateTime=0x1d5e74f, ftLastAccessTime.dwLowDateTime=0x7d7578e0, ftLastAccessTime.dwHighDateTime=0x1d5d91c, ftLastWriteTime.dwLowDateTime=0x7d7578e0, ftLastWriteTime.dwHighDateTime=0x1d5d91c, nFileSizeHigh=0x0, nFileSizeLow=0x58a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvNF5DQQYjBKTSHW.bmp", cAlternateFileName="JVNF5D~1.BMP")) returned 1 [0081.313] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe073c0a0, ftCreationTime.dwHighDateTime=0x1d5e30d, ftLastAccessTime.dwLowDateTime=0x3af10e20, ftLastAccessTime.dwHighDateTime=0x1d5e2d7, ftLastWriteTime.dwLowDateTime=0x3af10e20, ftLastWriteTime.dwHighDateTime=0x1d5e2d7, nFileSizeHigh=0x0, nFileSizeLow=0x73ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="K5uhk_gMe7nodSphe.png", cAlternateFileName="K5UHK_~1.PNG")) returned 1 [0081.313] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6133aa30, ftCreationTime.dwHighDateTime=0x1d5e312, ftLastAccessTime.dwLowDateTime=0x958c8bb0, ftLastAccessTime.dwHighDateTime=0x1d5da81, ftLastWriteTime.dwLowDateTime=0x958c8bb0, ftLastWriteTime.dwHighDateTime=0x1d5da81, nFileSizeHigh=0x0, nFileSizeLow=0x14ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="M6-i.png", cAlternateFileName="")) returned 1 [0081.313] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b3f90, ftCreationTime.dwHighDateTime=0x1d5d9c6, ftLastAccessTime.dwLowDateTime=0xe1b26460, ftLastAccessTime.dwHighDateTime=0x1d5e47c, ftLastWriteTime.dwLowDateTime=0xe1b26460, ftLastWriteTime.dwHighDateTime=0x1d5e47c, nFileSizeHigh=0x0, nFileSizeLow=0xfd07, dwReserved0=0x0, dwReserved1=0x0, cFileName="o7MUqeDHlGSI U8s n.jpg", cAlternateFileName="O7MUQE~1.JPG")) returned 1 [0081.313] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x524c8980, ftCreationTime.dwHighDateTime=0x1d5d901, ftLastAccessTime.dwLowDateTime=0xbed1b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0xbed1b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e02a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="p0JhMXJ3vii0", cAlternateFileName="P0JHMX~1")) returned 1 [0081.313] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47795330, ftCreationTime.dwHighDateTime=0x1d5e685, ftLastAccessTime.dwLowDateTime=0xd5b4e650, ftLastAccessTime.dwHighDateTime=0x1d5db40, ftLastWriteTime.dwLowDateTime=0xd5b4e650, ftLastWriteTime.dwHighDateTime=0x1d5db40, nFileSizeHigh=0x0, nFileSizeLow=0x15d8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qroj3K4F.jpg", cAlternateFileName="")) returned 1 [0081.313] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87678cb0, ftCreationTime.dwHighDateTime=0x1d5decd, ftLastAccessTime.dwLowDateTime=0xd4bbbea0, ftLastAccessTime.dwHighDateTime=0x1d5e788, ftLastWriteTime.dwLowDateTime=0xd4bbbea0, ftLastWriteTime.dwHighDateTime=0x1d5e788, nFileSizeHigh=0x0, nFileSizeLow=0x13914, dwReserved0=0x0, dwReserved1=0x0, cFileName="uEsbV.jpg", cAlternateFileName="")) returned 1 [0081.314] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b93eee0, ftCreationTime.dwHighDateTime=0x1d5e724, ftLastAccessTime.dwLowDateTime=0x8bfba4b0, ftLastAccessTime.dwHighDateTime=0x1d5e629, ftLastWriteTime.dwLowDateTime=0x8bfba4b0, ftLastWriteTime.dwHighDateTime=0x1d5e629, nFileSizeHigh=0x0, nFileSizeLow=0xd683, dwReserved0=0x0, dwReserved1=0x0, cFileName="YOFsi.jpg", cAlternateFileName="")) returned 1 [0081.314] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed9a37e0, ftCreationTime.dwHighDateTime=0x1d5db3e, ftLastAccessTime.dwLowDateTime=0x4ee8c010, ftLastAccessTime.dwHighDateTime=0x1d5de1a, ftLastWriteTime.dwLowDateTime=0x4ee8c010, ftLastWriteTime.dwHighDateTime=0x1d5de1a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_IuQjjMW", cAlternateFileName="")) returned 1 [0081.314] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae940 | out: lpFindFileData=0x1c9ae940*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.314] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0081.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeba0) returned 1 [0081.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb60) returned 1 [0081.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", lpFilePart=0x0) returned 0x3e [0081.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-nh_qiaabhiaxwxbz2l.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.314] GetFileType (hFile=0x2b8) returned 0x1 [0081.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.314] GetFileType (hFile=0x2b8) returned 0x1 [0081.314] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x59a8 [0081.314] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=22942, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x599e [0081.315] ReadFile (in: hFile=0x2b8, lpBuffer=0x28bf680, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28bf680*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.315] CloseHandle (hObject=0x2b8) returned 1 [0081.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", lpFilePart=0x0) returned 0x3e [0081.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.323] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-nh_qiaabhiaxwxbz2l.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2766bc8 | out: lpFileInformation=0x2766bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd14281f0, ftCreationTime.dwHighDateTime=0x1d5db49, ftLastAccessTime.dwLowDateTime=0xa8389700, ftLastAccessTime.dwHighDateTime=0x1d5de18, ftLastWriteTime.dwLowDateTime=0xa8389700, ftLastWriteTime.dwHighDateTime=0x1d5de18, nFileSizeHigh=0x0, nFileSizeLow=0x59a8)) returned 1 [0081.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", lpFilePart=0x0) returned 0x3e [0081.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-nh_qiaabhiaxwxbz2l.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.323] GetFileType (hFile=0x2b8) returned 0x1 [0081.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.323] GetFileType (hFile=0x2b8) returned 0x1 [0081.323] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x59a8 [0081.323] ReadFile (in: hFile=0x2b8, lpBuffer=0x2766e80, nNumberOfBytesToRead=0x59a8, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2766e80*, lpNumberOfBytesRead=0x1c9aeb38*=0x59a8, lpOverlapped=0x0) returned 1 [0081.323] CloseHandle (hObject=0x2b8) returned 1 [0081.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", lpFilePart=0x0) returned 0x3e [0081.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-nh_qiaabhiaxwxbz2l.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.361] GetFileType (hFile=0x2b8) returned 0x1 [0081.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.361] GetFileType (hFile=0x2b8) returned 0x1 [0081.361] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f9ad8*, nNumberOfBytesToWrite=0x59b0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27f9ad8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x59b0, lpOverlapped=0x0) returned 1 [0081.362] CloseHandle (hObject=0x2b8) returned 1 [0081.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", lpFilePart=0x0) returned 0x3e [0081.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", lpFilePart=0x0) returned 0x3e [0081.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-nh_qiaabhiaxwxbz2l.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.363] GetFileType (hFile=0x2b8) returned 0x1 [0081.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.363] GetFileType (hFile=0x2b8) returned 0x1 [0081.363] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x59b0 [0081.363] WriteFile (in: hFile=0x2b8, lpBuffer=0x2800400*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2800400*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.363] CloseHandle (hObject=0x2b8) returned 1 [0081.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp", lpFilePart=0x0) returned 0x3e [0081.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LU5IX3FJYUFCaGlhWHdYYloybC5ibXA=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LU5IX3FJYUFCaGlhWHdYYloybC5ibXA=", lpFilePart=0x0) returned 0x47 [0081.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.363] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-nh_qiaabhiaxwxbz2l.bmp"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd14281f0, ftCreationTime.dwHighDateTime=0x1d5db49, ftLastAccessTime.dwLowDateTime=0xa8389700, ftLastAccessTime.dwHighDateTime=0x1d5de18, ftLastWriteTime.dwLowDateTime=0xd8363a80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x59ba)) returned 1 [0081.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.363] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-NH_qIaABhiaXwXbZ2l.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-nh_qiaabhiaxwxbz2l.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LU5IX3FJYUFCaGlhWHdYYloybC5ibXA=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lu5ix3fjyufcaglhwhdyyloybc5ibxa=")) returned 1 [0081.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", lpFilePart=0x0) returned 0x35 [0081.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1czen-j33s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.364] GetFileType (hFile=0x2b8) returned 0x1 [0081.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.364] GetFileType (hFile=0x2b8) returned 0x1 [0081.364] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xbc89 [0081.364] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=48255, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xbc7f [0081.364] ReadFile (in: hFile=0x2b8, lpBuffer=0x28017b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28017b8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.365] CloseHandle (hObject=0x2b8) returned 1 [0081.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", lpFilePart=0x0) returned 0x35 [0081.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.367] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1czen-j33s.png"), fInfoLevelId=0x0, lpFileInformation=0x286e248 | out: lpFileInformation=0x286e248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b11f50, ftCreationTime.dwHighDateTime=0x1d5e52b, ftLastAccessTime.dwLowDateTime=0xa88ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e28f, ftLastWriteTime.dwLowDateTime=0xa88ea8e0, ftLastWriteTime.dwHighDateTime=0x1d5e28f, nFileSizeHigh=0x0, nFileSizeLow=0xbc89)) returned 1 [0081.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", lpFilePart=0x0) returned 0x35 [0081.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1czen-j33s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.367] GetFileType (hFile=0x2b8) returned 0x1 [0081.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.367] GetFileType (hFile=0x2b8) returned 0x1 [0081.367] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xbc89 [0081.367] ReadFile (in: hFile=0x2b8, lpBuffer=0x286e4c0, nNumberOfBytesToRead=0xbc89, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x286e4c0*, lpNumberOfBytesRead=0x1c9aeb38*=0xbc89, lpOverlapped=0x0) returned 1 [0081.368] CloseHandle (hObject=0x2b8) returned 1 [0081.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", lpFilePart=0x0) returned 0x35 [0081.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1czen-j33s.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.384] GetFileType (hFile=0x2b8) returned 0x1 [0081.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.384] GetFileType (hFile=0x2b8) returned 0x1 [0081.384] WriteFile (in: hFile=0x2b8, lpBuffer=0x29085c8*, nNumberOfBytesToWrite=0xbc90, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x29085c8*, lpNumberOfBytesWritten=0x1c9aebc8*=0xbc90, lpOverlapped=0x0) returned 1 [0081.386] CloseHandle (hObject=0x2b8) returned 1 [0081.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", lpFilePart=0x0) returned 0x35 [0081.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", lpFilePart=0x0) returned 0x35 [0081.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1czen-j33s.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.386] GetFileType (hFile=0x2b8) returned 0x1 [0081.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.386] GetFileType (hFile=0x2b8) returned 0x1 [0081.386] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xbc90 [0081.387] WriteFile (in: hFile=0x2b8, lpBuffer=0x2915140*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2915140*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.387] CloseHandle (hObject=0x2b8) returned 1 [0081.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png", lpFilePart=0x0) returned 0x35 [0081.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MWNaRW4tajMzUy5wbmc=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MWNaRW4tajMzUy5wbmc=", lpFilePart=0x0) returned 0x3b [0081.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1czen-j33s.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b11f50, ftCreationTime.dwHighDateTime=0x1d5e52b, ftLastAccessTime.dwLowDateTime=0xa88ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e28f, ftLastWriteTime.dwLowDateTime=0xd83afd40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xbc9a)) returned 1 [0081.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.387] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1cZEn-j33S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1czen-j33s.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MWNaRW4tajMzUy5wbmc=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwnarw4tajmzuy5wbmc=")) returned 1 [0081.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", lpFilePart=0x0) returned 0x3e [0081.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3zseclrtqbcvxxjiaj9.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.388] GetFileType (hFile=0x2b8) returned 0x1 [0081.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.388] GetFileType (hFile=0x2b8) returned 0x1 [0081.388] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xb02b [0081.388] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=45089, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xb021 [0081.388] ReadFile (in: hFile=0x2b8, lpBuffer=0x29164d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x29164d8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.389] CloseHandle (hObject=0x2b8) returned 1 [0081.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", lpFilePart=0x0) returned 0x3e [0081.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3zseclrtqbcvxxjiaj9.gif"), fInfoLevelId=0x0, lpFileInformation=0x2982fa8 | out: lpFileInformation=0x2982fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b1b1d0, ftCreationTime.dwHighDateTime=0x1d5de46, ftLastAccessTime.dwLowDateTime=0xacf1d270, ftLastAccessTime.dwHighDateTime=0x1d5e6a1, ftLastWriteTime.dwLowDateTime=0xacf1d270, ftLastWriteTime.dwHighDateTime=0x1d5e6a1, nFileSizeHigh=0x0, nFileSizeLow=0xb02b)) returned 1 [0081.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", lpFilePart=0x0) returned 0x3e [0081.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3zseclrtqbcvxxjiaj9.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.401] GetFileType (hFile=0x2b8) returned 0x1 [0081.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.401] GetFileType (hFile=0x2b8) returned 0x1 [0081.401] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xb02b [0081.402] ReadFile (in: hFile=0x2b8, lpBuffer=0x2983260, nNumberOfBytesToRead=0xb02b, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2983260*, lpNumberOfBytesRead=0x1c9aeb38*=0xb02b, lpOverlapped=0x0) returned 1 [0081.402] CloseHandle (hObject=0x2b8) returned 1 [0081.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", lpFilePart=0x0) returned 0x3e [0081.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3zseclrtqbcvxxjiaj9.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.423] GetFileType (hFile=0x2b8) returned 0x1 [0081.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.423] GetFileType (hFile=0x2b8) returned 0x1 [0081.423] WriteFile (in: hFile=0x2b8, lpBuffer=0x2a1ac50*, nNumberOfBytesToWrite=0xb030, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x2a1ac50*, lpNumberOfBytesWritten=0x1c9aebc8*=0xb030, lpOverlapped=0x0) returned 1 [0081.424] CloseHandle (hObject=0x2b8) returned 1 [0081.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", lpFilePart=0x0) returned 0x3e [0081.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", lpFilePart=0x0) returned 0x3e [0081.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3zseclrtqbcvxxjiaj9.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.425] GetFileType (hFile=0x2b8) returned 0x1 [0081.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.425] GetFileType (hFile=0x2b8) returned 0x1 [0081.425] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xb030 [0081.425] WriteFile (in: hFile=0x2b8, lpBuffer=0x2a26bf8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2a26bf8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.425] CloseHandle (hObject=0x2b8) returned 1 [0081.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif", lpFilePart=0x0) returned 0x3e [0081.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M1pzZUNMUnRxYmN2eFhqSUFqOS5naWY=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M1pzZUNMUnRxYmN2eFhqSUFqOS5naWY=", lpFilePart=0x0) returned 0x47 [0081.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.426] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3zseclrtqbcvxxjiaj9.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b1b1d0, ftCreationTime.dwHighDateTime=0x1d5de46, ftLastAccessTime.dwLowDateTime=0xacf1d270, ftLastAccessTime.dwHighDateTime=0x1d5e6a1, ftLastWriteTime.dwLowDateTime=0xd83fc000, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xb03a)) returned 1 [0081.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.426] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3ZseCLRtqbcvxXjIAj9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3zseclrtqbcvxxjiaj9.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M1pzZUNMUnRxYmN2eFhqSUFqOS5naWY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m1pzzunmunrxymn2efhqsufqos5nawy=")) returned 1 [0081.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", lpFilePart=0x0) returned 0x32 [0081.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4tgaqtz.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.426] GetFileType (hFile=0x2b8) returned 0x1 [0081.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.426] GetFileType (hFile=0x2b8) returned 0x1 [0081.426] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x6bc2 [0081.427] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=27576, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x6bb8 [0081.427] ReadFile (in: hFile=0x2b8, lpBuffer=0x2a27fa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2a27fa0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.450] CloseHandle (hObject=0x2b8) returned 1 [0081.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11af8) returned 0x0 [0081.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", lpFilePart=0x0) returned 0x32 [0081.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4tgaqtz.gif"), fInfoLevelId=0x0, lpFileInformation=0x2726678 | out: lpFileInformation=0x2726678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e9b2d0, ftCreationTime.dwHighDateTime=0x1d5de18, ftLastAccessTime.dwLowDateTime=0x59bad320, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x59bad320, ftLastWriteTime.dwHighDateTime=0x1d5e298, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2)) returned 1 [0081.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", lpFilePart=0x0) returned 0x32 [0081.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4tgaqtz.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.457] GetFileType (hFile=0x2b8) returned 0x1 [0081.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.457] GetFileType (hFile=0x2b8) returned 0x1 [0081.457] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x6bc2 [0081.457] ReadFile (in: hFile=0x2b8, lpBuffer=0x27268d0, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27268d0*, lpNumberOfBytesRead=0x1c9aeb38*=0x6bc2, lpOverlapped=0x0) returned 1 [0081.458] CloseHandle (hObject=0x2b8) returned 1 [0081.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", lpFilePart=0x0) returned 0x32 [0081.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4tgaqtz.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.485] GetFileType (hFile=0x2b8) returned 0x1 [0081.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.485] GetFileType (hFile=0x2b8) returned 0x1 [0081.485] WriteFile (in: hFile=0x2b8, lpBuffer=0x27befd0*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27befd0*, lpNumberOfBytesWritten=0x1c9aebc8*=0x6bd0, lpOverlapped=0x0) returned 1 [0081.486] CloseHandle (hObject=0x2b8) returned 1 [0081.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", lpFilePart=0x0) returned 0x32 [0081.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", lpFilePart=0x0) returned 0x32 [0081.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4tgaqtz.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.488] GetFileType (hFile=0x2b8) returned 0x1 [0081.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.488] GetFileType (hFile=0x2b8) returned 0x1 [0081.488] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x6bd0 [0081.488] WriteFile (in: hFile=0x2b8, lpBuffer=0x27c6a48*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27c6a48*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.488] CloseHandle (hObject=0x2b8) returned 1 [0081.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif", lpFilePart=0x0) returned 0x32 [0081.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NFRnQXFUei5naWY=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NFRnQXFUei5naWY=", lpFilePart=0x0) returned 0x37 [0081.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.488] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4tgaqtz.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e9b2d0, ftCreationTime.dwHighDateTime=0x1d5de18, ftLastAccessTime.dwLowDateTime=0x59bad320, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0xd8494580, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x6bda)) returned 1 [0081.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.488] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4TgAqTz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4tgaqtz.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NFRnQXFUei5naWY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nfrnqxfuei5nawy=")) returned 1 [0081.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", lpFilePart=0x0) returned 0x3e [0081.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8oi 6hpvio4-6kvyhsx.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.489] GetFileType (hFile=0x2b8) returned 0x1 [0081.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.489] GetFileType (hFile=0x2b8) returned 0x1 [0081.489] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x20f8 [0081.489] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=8430, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x20ee [0081.489] ReadFile (in: hFile=0x2b8, lpBuffer=0x27c7dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27c7dc8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.490] CloseHandle (hObject=0x2b8) returned 1 [0081.491] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11af8) returned 0x0 [0081.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", lpFilePart=0x0) returned 0x3e [0081.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8oi 6hpvio4-6kvyhsx.gif"), fInfoLevelId=0x0, lpFileInformation=0x2834858 | out: lpFileInformation=0x2834858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bd57c70, ftCreationTime.dwHighDateTime=0x1d5da11, ftLastAccessTime.dwLowDateTime=0x5efadb80, ftLastAccessTime.dwHighDateTime=0x1d5e3b2, ftLastWriteTime.dwLowDateTime=0x5efadb80, ftLastWriteTime.dwHighDateTime=0x1d5e3b2, nFileSizeHigh=0x0, nFileSizeLow=0x20f8)) returned 1 [0081.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", lpFilePart=0x0) returned 0x3e [0081.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8oi 6hpvio4-6kvyhsx.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.493] GetFileType (hFile=0x2b8) returned 0x1 [0081.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.493] GetFileType (hFile=0x2b8) returned 0x1 [0081.493] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x20f8 [0081.493] ReadFile (in: hFile=0x2b8, lpBuffer=0x2834b10, nNumberOfBytesToRead=0x20f8, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2834b10*, lpNumberOfBytesRead=0x1c9aeb38*=0x20f8, lpOverlapped=0x0) returned 1 [0081.493] CloseHandle (hObject=0x2b8) returned 1 [0081.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", lpFilePart=0x0) returned 0x3e [0081.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8oi 6hpvio4-6kvyhsx.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.505] GetFileType (hFile=0x2b8) returned 0x1 [0081.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.505] GetFileType (hFile=0x2b8) returned 0x1 [0081.505] WriteFile (in: hFile=0x2b8, lpBuffer=0x28b5960*, nNumberOfBytesToWrite=0x2100, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x28b5960*, lpNumberOfBytesWritten=0x1c9aebc8*=0x2100, lpOverlapped=0x0) returned 1 [0081.506] CloseHandle (hObject=0x2b8) returned 1 [0081.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", lpFilePart=0x0) returned 0x3e [0081.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", lpFilePart=0x0) returned 0x3e [0081.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8oi 6hpvio4-6kvyhsx.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.508] GetFileType (hFile=0x2b8) returned 0x1 [0081.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.508] GetFileType (hFile=0x2b8) returned 0x1 [0081.508] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x2100 [0081.508] WriteFile (in: hFile=0x2b8, lpBuffer=0x28b89d8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28b89d8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.508] CloseHandle (hObject=0x2b8) returned 1 [0081.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif", lpFilePart=0x0) returned 0x3e [0081.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OE9JIDZIcHZJTzQtNmt2WWhTWC5naWY=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OE9JIDZIcHZJTzQtNmt2WWhTWC5naWY=", lpFilePart=0x0) returned 0x47 [0081.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8oi 6hpvio4-6kvyhsx.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bd57c70, ftCreationTime.dwHighDateTime=0x1d5da11, ftLastAccessTime.dwLowDateTime=0x5efadb80, ftLastAccessTime.dwHighDateTime=0x1d5e3b2, ftLastWriteTime.dwLowDateTime=0xd84e0840, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x210a)) returned 1 [0081.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.509] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8OI 6HpvIO4-6kvYhSX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8oi 6hpvio4-6kvyhsx.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OE9JIDZIcHZJTzQtNmt2WWhTWC5naWY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\oe9jidzichzjtzqtnmt2wwhtwc5nawy=")) returned 1 [0081.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x32 [0081.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.509] GetFileType (hFile=0x2b8) returned 0x1 [0081.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.509] GetFileType (hFile=0x2b8) returned 0x1 [0081.509] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x1f8 [0081.509] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=494, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1ee [0081.510] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b9d80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28b9d80*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.510] CloseHandle (hObject=0x2b8) returned 1 [0081.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11af8) returned 0x0 [0081.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x32 [0081.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.521] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x2750f18 | out: lpFileInformation=0x2750f18*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1 [0081.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x32 [0081.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.521] GetFileType (hFile=0x2b8) returned 0x1 [0081.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.521] GetFileType (hFile=0x2b8) returned 0x1 [0081.521] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x1f8 [0081.521] ReadFile (in: hFile=0x2b8, lpBuffer=0x2751380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2751380*, lpNumberOfBytesRead=0x1c9aeb38*=0x1f8, lpOverlapped=0x0) returned 1 [0081.521] CloseHandle (hObject=0x2b8) returned 1 [0081.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x32 [0081.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0081.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ab3e0) returned 1 [0081.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", lpFilePart=0x0) returned 0x3b [0081.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dwg o1yvm1ildid2.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.550] GetFileType (hFile=0x2b8) returned 0x1 [0081.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.550] GetFileType (hFile=0x2b8) returned 0x1 [0081.551] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x18950 [0081.551] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=100678, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x18946 [0081.551] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ca550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27ca550*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.551] CloseHandle (hObject=0x2b8) returned 1 [0081.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11af8) returned 0x0 [0081.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", lpFilePart=0x0) returned 0x3b [0081.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dwg o1yvm1ildid2.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2836f60 | out: lpFileInformation=0x2836f60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876323f0, ftCreationTime.dwHighDateTime=0x1d5e2bf, ftLastAccessTime.dwLowDateTime=0xc002b30, ftLastAccessTime.dwHighDateTime=0x1d5e7a7, ftLastWriteTime.dwLowDateTime=0xc002b30, ftLastWriteTime.dwHighDateTime=0x1d5e7a7, nFileSizeHigh=0x0, nFileSizeLow=0x18950)) returned 1 [0081.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", lpFilePart=0x0) returned 0x3b [0081.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dwg o1yvm1ildid2.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.562] GetFileType (hFile=0x2b8) returned 0x1 [0081.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.562] GetFileType (hFile=0x2b8) returned 0x1 [0081.562] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x18950 [0081.562] ReadFile (in: hFile=0x2b8, lpBuffer=0x12661968, nNumberOfBytesToRead=0x18950, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12661968*, lpNumberOfBytesRead=0x1c9aeb38*=0x18950, lpOverlapped=0x0) returned 1 [0081.563] CloseHandle (hObject=0x2b8) returned 1 [0081.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", lpFilePart=0x0) returned 0x3b [0081.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dwg o1yvm1ildid2.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.598] GetFileType (hFile=0x2b8) returned 0x1 [0081.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.598] GetFileType (hFile=0x2b8) returned 0x1 [0081.598] WriteFile (in: hFile=0x2b8, lpBuffer=0x126dc8d8*, nNumberOfBytesToWrite=0x18960, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x126dc8d8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x18960, lpOverlapped=0x0) returned 1 [0081.600] CloseHandle (hObject=0x2b8) returned 1 [0081.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", lpFilePart=0x0) returned 0x3b [0081.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", lpFilePart=0x0) returned 0x3b [0081.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dwg o1yvm1ildid2.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.601] GetFileType (hFile=0x2b8) returned 0x1 [0081.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.601] GetFileType (hFile=0x2b8) returned 0x1 [0081.601] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x18960 [0081.601] WriteFile (in: hFile=0x2b8, lpBuffer=0x28aec78*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28aec78*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.602] CloseHandle (hObject=0x2b8) returned 1 [0081.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg", lpFilePart=0x0) returned 0x3b [0081.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZFdHIG8xeVZNMUlsZGlkMi5qcGc=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZFdHIG8xeVZNMUlsZGlkMi5qcGc=", lpFilePart=0x0) returned 0x43 [0081.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dwg o1yvm1ildid2.jpg"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876323f0, ftCreationTime.dwHighDateTime=0x1d5e2bf, ftLastAccessTime.dwLowDateTime=0xc002b30, ftLastAccessTime.dwHighDateTime=0x1d5e7a7, ftLastWriteTime.dwLowDateTime=0xd85c5080, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1896a)) returned 1 [0081.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.602] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dWG o1yVM1Ildid2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dwg o1yvm1ildid2.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZFdHIG8xeVZNMUlsZGlkMi5qcGc=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zfdhig8xevznmulszglkmi5qcgc=")) returned 1 [0081.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", lpFilePart=0x0) returned 0x3b [0081.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvnf5dqqyjbktshw.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.603] GetFileType (hFile=0x2b8) returned 0x1 [0081.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.603] GetFileType (hFile=0x2b8) returned 0x1 [0081.603] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x58a9 [0081.603] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=22687, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x589f [0081.603] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b0030, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28b0030*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.604] CloseHandle (hObject=0x2b8) returned 1 [0081.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11af8) returned 0x0 [0081.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", lpFilePart=0x0) returned 0x3b [0081.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvnf5dqqyjbktshw.bmp"), fInfoLevelId=0x0, lpFileInformation=0x275dfe0 | out: lpFileInformation=0x275dfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefec4890, ftCreationTime.dwHighDateTime=0x1d5e74f, ftLastAccessTime.dwLowDateTime=0x7d7578e0, ftLastAccessTime.dwHighDateTime=0x1d5d91c, ftLastWriteTime.dwLowDateTime=0x7d7578e0, ftLastWriteTime.dwHighDateTime=0x1d5d91c, nFileSizeHigh=0x0, nFileSizeLow=0x58a9)) returned 1 [0081.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", lpFilePart=0x0) returned 0x3b [0081.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvnf5dqqyjbktshw.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.609] GetFileType (hFile=0x2b8) returned 0x1 [0081.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.609] GetFileType (hFile=0x2b8) returned 0x1 [0081.609] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x58a9 [0081.610] ReadFile (in: hFile=0x2b8, lpBuffer=0x275e288, nNumberOfBytesToRead=0x58a9, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x275e288*, lpNumberOfBytesRead=0x1c9aeb38*=0x58a9, lpOverlapped=0x0) returned 1 [0081.610] CloseHandle (hObject=0x2b8) returned 1 [0081.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", lpFilePart=0x0) returned 0x3b [0081.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvnf5dqqyjbktshw.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.621] GetFileType (hFile=0x2b8) returned 0x1 [0081.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.621] GetFileType (hFile=0x2b8) returned 0x1 [0081.621] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f09e8*, nNumberOfBytesToWrite=0x58b0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27f09e8*, lpNumberOfBytesWritten=0x1c9aebc8*=0x58b0, lpOverlapped=0x0) returned 1 [0081.622] CloseHandle (hObject=0x2b8) returned 1 [0081.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", lpFilePart=0x0) returned 0x3b [0081.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", lpFilePart=0x0) returned 0x3b [0081.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvnf5dqqyjbktshw.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.623] GetFileType (hFile=0x2b8) returned 0x1 [0081.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.623] GetFileType (hFile=0x2b8) returned 0x1 [0081.623] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x58b0 [0081.624] WriteFile (in: hFile=0x2b8, lpBuffer=0x27f71e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27f71e8*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.624] CloseHandle (hObject=0x2b8) returned 1 [0081.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp", lpFilePart=0x0) returned 0x3b [0081.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\anZORjVEUVFZakJLVFNIVy5ibXA=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\anZORjVEUVFZakJLVFNIVy5ibXA=", lpFilePart=0x0) returned 0x43 [0081.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvnf5dqqyjbktshw.bmp"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefec4890, ftCreationTime.dwHighDateTime=0x1d5e74f, ftLastAccessTime.dwLowDateTime=0x7d7578e0, ftLastAccessTime.dwHighDateTime=0x1d5d91c, ftLastWriteTime.dwLowDateTime=0xd85eb1e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x58ba)) returned 1 [0081.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.624] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jvNF5DQQYjBKTSHW.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jvnf5dqqyjbktshw.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\anZORjVEUVFZakJLVFNIVy5ibXA=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\anzorjveuvfzakjlvfnivy5ibxa=")) returned 1 [0081.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", lpFilePart=0x0) returned 0x3c [0081.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k5uhk_gme7nodsphe.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.625] GetFileType (hFile=0x2b8) returned 0x1 [0081.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.625] GetFileType (hFile=0x2b8) returned 0x1 [0081.625] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x73ab [0081.625] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=29601, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x73a1 [0081.625] ReadFile (in: hFile=0x2b8, lpBuffer=0x27f85a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27f85a8*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.626] CloseHandle (hObject=0x2b8) returned 1 [0081.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11af8) returned 0x0 [0081.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", lpFilePart=0x0) returned 0x3c [0081.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k5uhk_gme7nodsphe.png"), fInfoLevelId=0x0, lpFileInformation=0x2864ff8 | out: lpFileInformation=0x2864ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe073c0a0, ftCreationTime.dwHighDateTime=0x1d5e30d, ftLastAccessTime.dwLowDateTime=0x3af10e20, ftLastAccessTime.dwHighDateTime=0x1d5e2d7, ftLastWriteTime.dwLowDateTime=0x3af10e20, ftLastWriteTime.dwHighDateTime=0x1d5e2d7, nFileSizeHigh=0x0, nFileSizeLow=0x73ab)) returned 1 [0081.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", lpFilePart=0x0) returned 0x3c [0081.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k5uhk_gme7nodsphe.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.628] GetFileType (hFile=0x2b8) returned 0x1 [0081.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.628] GetFileType (hFile=0x2b8) returned 0x1 [0081.628] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x73ab [0081.628] ReadFile (in: hFile=0x2b8, lpBuffer=0x28652b0, nNumberOfBytesToRead=0x73ab, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x28652b0*, lpNumberOfBytesRead=0x1c9aeb38*=0x73ab, lpOverlapped=0x0) returned 1 [0081.629] CloseHandle (hObject=0x2b8) returned 1 [0081.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", lpFilePart=0x0) returned 0x3c [0081.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k5uhk_gme7nodsphe.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.640] GetFileType (hFile=0x2b8) returned 0x1 [0081.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.640] GetFileType (hFile=0x2b8) returned 0x1 [0081.640] WriteFile (in: hFile=0x2b8, lpBuffer=0x28ffe78*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x28ffe78*, lpNumberOfBytesWritten=0x1c9aebc8*=0x73b0, lpOverlapped=0x0) returned 1 [0081.642] CloseHandle (hObject=0x2b8) returned 1 [0081.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", lpFilePart=0x0) returned 0x3c [0081.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", lpFilePart=0x0) returned 0x3c [0081.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k5uhk_gme7nodsphe.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.643] GetFileType (hFile=0x2b8) returned 0x1 [0081.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.643] GetFileType (hFile=0x2b8) returned 0x1 [0081.643] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x73b0 [0081.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png", lpFilePart=0x0) returned 0x3c [0081.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SzV1aGtfZ01lN25vZFNwaGUucG5n", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SzV1aGtfZ01lN25vZFNwaGUucG5n", lpFilePart=0x0) returned 0x43 [0081.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k5uhk_gme7nodsphe.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe073c0a0, ftCreationTime.dwHighDateTime=0x1d5e30d, ftLastAccessTime.dwLowDateTime=0x3af10e20, ftLastAccessTime.dwHighDateTime=0x1d5e2d7, ftLastWriteTime.dwLowDateTime=0xd8611340, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x73ba)) returned 1 [0081.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.643] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\K5uhk_gMe7nodSphe.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\k5uhk_gme7nodsphe.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SzV1aGtfZ01lN25vZFNwaGUucG5n" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\szv1agtfz01ln25vzfnwaguucg5n")) returned 1 [0081.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", lpFilePart=0x0) returned 0x2f [0081.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m6-i.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.644] GetFileType (hFile=0x2b8) returned 0x1 [0081.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.644] GetFileType (hFile=0x2b8) returned 0x1 [0081.644] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x14ea5 [0081.644] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=85659, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x14e9b [0081.644] ReadFile (in: hFile=0x2b8, lpBuffer=0x2909528, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2909528*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.645] CloseHandle (hObject=0x2b8) returned 1 [0081.646] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11af8) returned 0x0 [0081.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", lpFilePart=0x0) returned 0x2f [0081.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m6-i.png"), fInfoLevelId=0x0, lpFileInformation=0x2975ff8 | out: lpFileInformation=0x2975ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6133aa30, ftCreationTime.dwHighDateTime=0x1d5e312, ftLastAccessTime.dwLowDateTime=0x958c8bb0, ftLastAccessTime.dwHighDateTime=0x1d5da81, ftLastWriteTime.dwLowDateTime=0x958c8bb0, ftLastWriteTime.dwHighDateTime=0x1d5da81, nFileSizeHigh=0x0, nFileSizeLow=0x14ea5)) returned 1 [0081.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", lpFilePart=0x0) returned 0x2f [0081.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m6-i.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.647] GetFileType (hFile=0x2b8) returned 0x1 [0081.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.648] GetFileType (hFile=0x2b8) returned 0x1 [0081.648] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x14ea5 [0081.648] ReadFile (in: hFile=0x2b8, lpBuffer=0x126f5270, nNumberOfBytesToRead=0x14ea5, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x126f5270*, lpNumberOfBytesRead=0x1c9aeb38*=0x14ea5, lpOverlapped=0x0) returned 1 [0081.649] CloseHandle (hObject=0x2b8) returned 1 [0081.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", lpFilePart=0x0) returned 0x2f [0081.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m6-i.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.666] GetFileType (hFile=0x2b8) returned 0x1 [0081.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.666] GetFileType (hFile=0x2b8) returned 0x1 [0081.666] WriteFile (in: hFile=0x2b8, lpBuffer=0x1275dc78*, nNumberOfBytesToWrite=0x14eb0, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x1275dc78*, lpNumberOfBytesWritten=0x1c9aebc8*=0x14eb0, lpOverlapped=0x0) returned 1 [0081.668] CloseHandle (hObject=0x2b8) returned 1 [0081.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", lpFilePart=0x0) returned 0x2f [0081.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", lpFilePart=0x0) returned 0x2f [0081.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m6-i.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.669] GetFileType (hFile=0x2b8) returned 0x1 [0081.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.669] GetFileType (hFile=0x2b8) returned 0x1 [0081.670] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x14eb0 [0081.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png", lpFilePart=0x0) returned 0x2f [0081.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TTYtaS5wbmc=", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TTYtaS5wbmc=", lpFilePart=0x0) returned 0x33 [0081.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m6-i.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6133aa30, ftCreationTime.dwHighDateTime=0x1d5e312, ftLastAccessTime.dwLowDateTime=0x958c8bb0, ftLastAccessTime.dwHighDateTime=0x1d5da81, ftLastWriteTime.dwLowDateTime=0xd865d600, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x14eba)) returned 1 [0081.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.670] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\M6-i.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m6-i.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TTYtaS5wbmc=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ttytas5wbmc=")) returned 1 [0081.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", lpFilePart=0x0) returned 0x3d [0081.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o7muqedhlgsi u8s n.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.671] GetFileType (hFile=0x2b8) returned 0x1 [0081.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.671] GetFileType (hFile=0x2b8) returned 0x1 [0081.671] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xfd07 [0081.671] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=64765, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xfcfd [0081.671] ReadFile (in: hFile=0x2b8, lpBuffer=0x29eed48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x29eed48*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.672] CloseHandle (hObject=0x2b8) returned 1 [0081.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", lpFilePart=0x0) returned 0x3d [0081.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o7muqedhlgsi u8s n.jpg"), fInfoLevelId=0x0, lpFileInformation=0x272aa08 | out: lpFileInformation=0x272aa08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b3f90, ftCreationTime.dwHighDateTime=0x1d5d9c6, ftLastAccessTime.dwLowDateTime=0xe1b26460, ftLastAccessTime.dwHighDateTime=0x1d5e47c, ftLastWriteTime.dwLowDateTime=0xe1b26460, ftLastWriteTime.dwHighDateTime=0x1d5e47c, nFileSizeHigh=0x0, nFileSizeLow=0xfd07)) returned 1 [0081.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", lpFilePart=0x0) returned 0x3d [0081.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o7muqedhlgsi u8s n.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.683] GetFileType (hFile=0x2b8) returned 0x1 [0081.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.684] GetFileType (hFile=0x2b8) returned 0x1 [0081.684] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xfd07 [0081.684] ReadFile (in: hFile=0x2b8, lpBuffer=0x272acc0, nNumberOfBytesToRead=0xfd07, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x272acc0*, lpNumberOfBytesRead=0x1c9aeb38*=0xfd07, lpOverlapped=0x0) returned 1 [0081.684] CloseHandle (hObject=0x2b8) returned 1 [0081.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", lpFilePart=0x0) returned 0x3d [0081.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o7muqedhlgsi u8s n.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.730] GetFileType (hFile=0x2b8) returned 0x1 [0081.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.730] GetFileType (hFile=0x2b8) returned 0x1 [0081.730] WriteFile (in: hFile=0x2b8, lpBuffer=0x27d0fe8*, nNumberOfBytesToWrite=0xfd10, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x27d0fe8*, lpNumberOfBytesWritten=0x1c9aebc8*=0xfd10, lpOverlapped=0x0) returned 1 [0081.732] CloseHandle (hObject=0x2b8) returned 1 [0081.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", lpFilePart=0x0) returned 0x3d [0081.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", lpFilePart=0x0) returned 0x3d [0081.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o7muqedhlgsi u8s n.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.733] GetFileType (hFile=0x2b8) returned 0x1 [0081.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.733] GetFileType (hFile=0x2b8) returned 0x1 [0081.733] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xfd10 [0081.733] WriteFile (in: hFile=0x2b8, lpBuffer=0x27e1c70*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x27e1c70*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.733] CloseHandle (hObject=0x2b8) returned 1 [0081.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg", lpFilePart=0x0) returned 0x3d [0081.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\bzdNVXFlREhsR1NJIFU4cyBuLmpwZw==", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\bzdNVXFlREhsR1NJIFU4cyBuLmpwZw==", lpFilePart=0x0) returned 0x47 [0081.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o7muqedhlgsi u8s n.jpg"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b3f90, ftCreationTime.dwHighDateTime=0x1d5d9c6, ftLastAccessTime.dwLowDateTime=0xe1b26460, ftLastAccessTime.dwHighDateTime=0x1d5e47c, ftLastWriteTime.dwLowDateTime=0xd86f5b80, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xfd1a)) returned 1 [0081.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.734] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\o7MUqeDHlGSI U8s n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o7muqedhlgsi u8s n.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\bzdNVXFlREhsR1NJIFU4cyBuLmpwZw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bzdnvxflrehsr1njifu4cybulmpwzw==")) returned 1 [0081.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", lpFilePart=0x0) returned 0x33 [0081.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qroj3k4f.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.734] GetFileType (hFile=0x2b8) returned 0x1 [0081.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.734] GetFileType (hFile=0x2b8) returned 0x1 [0081.735] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x15d8e [0081.735] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=89476, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x15d84 [0081.735] ReadFile (in: hFile=0x2b8, lpBuffer=0x27e3020, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x27e3020*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.736] CloseHandle (hObject=0x2b8) returned 1 [0081.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", lpFilePart=0x0) returned 0x33 [0081.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.737] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qroj3k4f.jpg"), fInfoLevelId=0x0, lpFileInformation=0x284fa30 | out: lpFileInformation=0x284fa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47795330, ftCreationTime.dwHighDateTime=0x1d5e685, ftLastAccessTime.dwLowDateTime=0xd5b4e650, ftLastAccessTime.dwHighDateTime=0x1d5db40, ftLastWriteTime.dwLowDateTime=0xd5b4e650, ftLastWriteTime.dwHighDateTime=0x1d5db40, nFileSizeHigh=0x0, nFileSizeLow=0x15d8e)) returned 1 [0081.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", lpFilePart=0x0) returned 0x33 [0081.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qroj3k4f.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.737] GetFileType (hFile=0x2b8) returned 0x1 [0081.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.738] GetFileType (hFile=0x2b8) returned 0x1 [0081.738] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x15d8e [0081.738] ReadFile (in: hFile=0x2b8, lpBuffer=0x12792598, nNumberOfBytesToRead=0x15d8e, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x12792598*, lpNumberOfBytesRead=0x1c9aeb38*=0x15d8e, lpOverlapped=0x0) returned 1 [0081.739] CloseHandle (hObject=0x2b8) returned 1 [0081.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", lpFilePart=0x0) returned 0x33 [0081.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qroj3k4f.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.757] GetFileType (hFile=0x2b8) returned 0x1 [0081.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.757] GetFileType (hFile=0x2b8) returned 0x1 [0081.757] WriteFile (in: hFile=0x2b8, lpBuffer=0x127ffa08*, nNumberOfBytesToWrite=0x15d90, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x127ffa08*, lpNumberOfBytesWritten=0x1c9aebc8*=0x15d90, lpOverlapped=0x0) returned 1 [0081.761] CloseHandle (hObject=0x2b8) returned 1 [0081.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", lpFilePart=0x0) returned 0x33 [0081.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", lpFilePart=0x0) returned 0x33 [0081.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qroj3k4f.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.761] GetFileType (hFile=0x2b8) returned 0x1 [0081.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.761] GetFileType (hFile=0x2b8) returned 0x1 [0081.761] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x15d90 [0081.761] WriteFile (in: hFile=0x2b8, lpBuffer=0x28c7670*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x28c7670*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.761] CloseHandle (hObject=0x2b8) returned 1 [0081.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg", lpFilePart=0x0) returned 0x33 [0081.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UXJvajNLNEYuanBn", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UXJvajNLNEYuanBn", lpFilePart=0x0) returned 0x37 [0081.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qroj3k4f.jpg"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47795330, ftCreationTime.dwHighDateTime=0x1d5e685, ftLastAccessTime.dwLowDateTime=0xd5b4e650, ftLastAccessTime.dwHighDateTime=0x1d5db40, ftLastWriteTime.dwLowDateTime=0xd8741e40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x15d9a)) returned 1 [0081.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.762] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Qroj3K4F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qroj3k4f.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UXJvajNLNEYuanBn" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uxjvajnlneyuanbn")) returned 1 [0081.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", lpFilePart=0x0) returned 0x30 [0081.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uesbv.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.763] GetFileType (hFile=0x2b8) returned 0x1 [0081.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.763] GetFileType (hFile=0x2b8) returned 0x1 [0081.763] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0x13914 [0081.763] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=80138, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0x1390a [0081.763] ReadFile (in: hFile=0x2b8, lpBuffer=0x28c89c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x28c89c0*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.764] CloseHandle (hObject=0x2b8) returned 1 [0081.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", lpFilePart=0x0) returned 0x30 [0081.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.765] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uesbv.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2935410 | out: lpFileInformation=0x2935410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87678cb0, ftCreationTime.dwHighDateTime=0x1d5decd, ftLastAccessTime.dwLowDateTime=0xd4bbbea0, ftLastAccessTime.dwHighDateTime=0x1d5e788, ftLastWriteTime.dwLowDateTime=0xd4bbbea0, ftLastWriteTime.dwHighDateTime=0x1d5e788, nFileSizeHigh=0x0, nFileSizeLow=0x13914)) returned 1 [0081.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", lpFilePart=0x0) returned 0x30 [0081.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uesbv.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.765] GetFileType (hFile=0x2b8) returned 0x1 [0081.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.766] GetFileType (hFile=0x2b8) returned 0x1 [0081.766] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0x13914 [0081.766] ReadFile (in: hFile=0x2b8, lpBuffer=0x2935668, nNumberOfBytesToRead=0x13914, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x2935668*, lpNumberOfBytesRead=0x1c9aeb38*=0x13914, lpOverlapped=0x0) returned 1 [0081.766] CloseHandle (hObject=0x2b8) returned 1 [0081.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", lpFilePart=0x0) returned 0x30 [0081.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uesbv.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.786] GetFileType (hFile=0x2b8) returned 0x1 [0081.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.786] GetFileType (hFile=0x2b8) returned 0x1 [0081.786] WriteFile (in: hFile=0x2b8, lpBuffer=0x274c950*, nNumberOfBytesToWrite=0x13920, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x274c950*, lpNumberOfBytesWritten=0x1c9aebc8*=0x13920, lpOverlapped=0x0) returned 1 [0081.788] CloseHandle (hObject=0x2b8) returned 1 [0081.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", lpFilePart=0x0) returned 0x30 [0081.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", lpFilePart=0x0) returned 0x30 [0081.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uesbv.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.790] GetFileType (hFile=0x2b8) returned 0x1 [0081.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.790] GetFileType (hFile=0x2b8) returned 0x1 [0081.790] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0x13920 [0081.790] WriteFile (in: hFile=0x2b8, lpBuffer=0x2761110*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x2761110*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.790] CloseHandle (hObject=0x2b8) returned 1 [0081.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg", lpFilePart=0x0) returned 0x30 [0081.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dUVzYlYuanBn", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dUVzYlYuanBn", lpFilePart=0x0) returned 0x33 [0081.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uesbv.jpg"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87678cb0, ftCreationTime.dwHighDateTime=0x1d5decd, ftLastAccessTime.dwLowDateTime=0xd4bbbea0, ftLastAccessTime.dwHighDateTime=0x1d5e788, ftLastWriteTime.dwLowDateTime=0xd878e100, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1392a)) returned 1 [0081.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.790] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uEsbV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uesbv.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dUVzYlYuanBn" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\duvzylyuanbn")) returned 1 [0081.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", lpFilePart=0x0) returned 0x30 [0081.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeba0) returned 1 [0081.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yofsi.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.794] GetFileType (hFile=0x2b8) returned 0x1 [0081.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb10) returned 1 [0081.794] GetFileType (hFile=0x2b8) returned 0x1 [0081.794] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aed68 | out: lpFileSizeHigh=0x1c9aed68*=0x0) returned 0xd683 [0081.794] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=54905, lpDistanceToMoveHigh=0x1c9aecc8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aecc8*=0) returned 0xd679 [0081.794] ReadFile (in: hFile=0x2b8, lpBuffer=0x2762450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aec98, lpOverlapped=0x0 | out: lpBuffer=0x2762450*, lpNumberOfBytesRead=0x1c9aec98*=0xa, lpOverlapped=0x0) returned 1 [0081.795] CloseHandle (hObject=0x2b8) returned 1 [0081.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aebc0 | out: SystemInformation=0x12641930, ResultLength=0x1c9aebc0*=0x11af8) returned 0x0 [0081.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", lpFilePart=0x0) returned 0x30 [0081.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yofsi.jpg"), fInfoLevelId=0x0, lpFileInformation=0x27ceee0 | out: lpFileInformation=0x27ceee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b93eee0, ftCreationTime.dwHighDateTime=0x1d5e724, ftLastAccessTime.dwLowDateTime=0x8bfba4b0, ftLastAccessTime.dwHighDateTime=0x1d5e629, ftLastWriteTime.dwLowDateTime=0x8bfba4b0, ftLastWriteTime.dwHighDateTime=0x1d5e629, nFileSizeHigh=0x0, nFileSizeLow=0xd683)) returned 1 [0081.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb70) returned 1 [0081.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", lpFilePart=0x0) returned 0x30 [0081.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea70) returned 1 [0081.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yofsi.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.801] GetFileType (hFile=0x2b8) returned 0x1 [0081.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae9e0) returned 1 [0081.801] GetFileType (hFile=0x2b8) returned 0x1 [0081.801] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aec08 | out: lpFileSizeHigh=0x1c9aec08*=0x0) returned 0xd683 [0081.802] ReadFile (in: hFile=0x2b8, lpBuffer=0x27cf138, nNumberOfBytesToRead=0xd683, lpNumberOfBytesRead=0x1c9aeb38, lpOverlapped=0x0 | out: lpBuffer=0x27cf138*, lpNumberOfBytesRead=0x1c9aeb38*=0xd683, lpOverlapped=0x0) returned 1 [0081.802] CloseHandle (hObject=0x2b8) returned 1 [0081.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", lpFilePart=0x0) returned 0x30 [0081.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yofsi.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.833] GetFileType (hFile=0x2b8) returned 0x1 [0081.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.833] GetFileType (hFile=0x2b8) returned 0x1 [0081.833] WriteFile (in: hFile=0x2b8, lpBuffer=0x286e0e0*, nNumberOfBytesToWrite=0xd690, lpNumberOfBytesWritten=0x1c9aebc8, lpOverlapped=0x0 | out: lpBuffer=0x286e0e0*, lpNumberOfBytesWritten=0x1c9aebc8*=0xd690, lpOverlapped=0x0) returned 1 [0081.834] CloseHandle (hObject=0x2b8) returned 1 [0081.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", lpFilePart=0x0) returned 0x30 [0081.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", lpFilePart=0x0) returned 0x30 [0081.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb40) returned 1 [0081.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yofsi.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.836] GetFileType (hFile=0x2b8) returned 0x1 [0081.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeab0) returned 1 [0081.836] GetFileType (hFile=0x2b8) returned 0x1 [0081.836] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aeb28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aeb28*=0) returned 0xd690 [0081.836] WriteFile (in: hFile=0x2b8, lpBuffer=0x287c610*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aebe8, lpOverlapped=0x0 | out: lpBuffer=0x287c610*, lpNumberOfBytesWritten=0x1c9aebe8*=0xa, lpOverlapped=0x0) returned 1 [0081.836] CloseHandle (hObject=0x2b8) returned 1 [0081.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg", lpFilePart=0x0) returned 0x30 [0081.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WU9Gc2kuanBn", nBufferLength=0x105, lpBuffer=0x1c9ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WU9Gc2kuanBn", lpFilePart=0x0) returned 0x33 [0081.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb70) returned 1 [0081.836] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yofsi.jpg"), fInfoLevelId=0x0, lpFileInformation=0x1c9aec50 | out: lpFileInformation=0x1c9aec50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b93eee0, ftCreationTime.dwHighDateTime=0x1d5e724, ftLastAccessTime.dwLowDateTime=0x8bfba4b0, ftLastAccessTime.dwHighDateTime=0x1d5e629, ftLastWriteTime.dwLowDateTime=0xd8800520, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd69a)) returned 1 [0081.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb30) returned 1 [0081.836] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YOFsi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yofsi.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WU9Gc2kuanBn" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wu9gc2kuanbn")) returned 1 [0081.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0", lpFilePart=0x0) returned 0x33 [0081.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\", lpFilePart=0x0) returned 0x34 [0081.837] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x524c8980, ftCreationTime.dwHighDateTime=0x1d5d901, ftLastAccessTime.dwLowDateTime=0xbed1b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0xbed1b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e02a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0081.837] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x524c8980, ftCreationTime.dwHighDateTime=0x1d5d901, ftLastAccessTime.dwLowDateTime=0xbed1b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0xbed1b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e02a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.838] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5331d420, ftCreationTime.dwHighDateTime=0x1d5dfca, ftLastAccessTime.dwLowDateTime=0x8b7702c0, ftLastAccessTime.dwHighDateTime=0x1d5daa1, ftLastWriteTime.dwLowDateTime=0x8b7702c0, ftLastWriteTime.dwHighDateTime=0x1d5daa1, nFileSizeHigh=0x0, nFileSizeLow=0x13dc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="00PQi8jDZheaA.jpg", cAlternateFileName="00PQI8~1.JPG")) returned 1 [0081.838] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174de40, ftCreationTime.dwHighDateTime=0x1d5e4fb, ftLastAccessTime.dwLowDateTime=0x2c47c380, ftLastAccessTime.dwHighDateTime=0x1d5e04a, ftLastWriteTime.dwLowDateTime=0x2c47c380, ftLastWriteTime.dwHighDateTime=0x1d5e04a, nFileSizeHigh=0x0, nFileSizeLow=0x8298, dwReserved0=0x0, dwReserved1=0x0, cFileName="2r_FV-HfctIu.gif", cAlternateFileName="2R_FV-~1.GIF")) returned 1 [0081.838] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1784350, ftCreationTime.dwHighDateTime=0x1d5dd16, ftLastAccessTime.dwLowDateTime=0x1afbacd0, ftLastAccessTime.dwHighDateTime=0x1d5e447, ftLastWriteTime.dwLowDateTime=0x1afbacd0, ftLastWriteTime.dwHighDateTime=0x1d5e447, nFileSizeHigh=0x0, nFileSizeLow=0x57f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="75HW_wjpHU.gif", cAlternateFileName="75HW_W~1.GIF")) returned 1 [0081.838] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd415ed0, ftCreationTime.dwHighDateTime=0x1d5d832, ftLastAccessTime.dwLowDateTime=0x1ee45640, ftLastAccessTime.dwHighDateTime=0x1d5e4d7, ftLastWriteTime.dwLowDateTime=0x1ee45640, ftLastWriteTime.dwHighDateTime=0x1d5e4d7, nFileSizeHigh=0x0, nFileSizeLow=0x673b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cut-Vb.png", cAlternateFileName="")) returned 1 [0081.838] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5869c00, ftCreationTime.dwHighDateTime=0x1d5e813, ftLastAccessTime.dwLowDateTime=0x350c52e0, ftLastAccessTime.dwHighDateTime=0x1d5d90d, ftLastWriteTime.dwLowDateTime=0x350c52e0, ftLastWriteTime.dwHighDateTime=0x1d5d90d, nFileSizeHigh=0x0, nFileSizeLow=0x4308, dwReserved0=0x0, dwReserved1=0x0, cFileName="GUUT3Ig185.gif", cAlternateFileName="GUUT3I~1.GIF")) returned 1 [0081.838] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf986cbd0, ftCreationTime.dwHighDateTime=0x1d5da4f, ftLastAccessTime.dwLowDateTime=0x8d9d1740, ftLastAccessTime.dwHighDateTime=0x1d5dac6, ftLastWriteTime.dwLowDateTime=0x8d9d1740, ftLastWriteTime.dwHighDateTime=0x1d5dac6, nFileSizeHigh=0x0, nFileSizeLow=0xd31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="p5eBt5KxK5Pu2augljV.gif", cAlternateFileName="P5EBT5~1.GIF")) returned 1 [0081.838] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2075c0b0, ftCreationTime.dwHighDateTime=0x1d5e7c1, ftLastAccessTime.dwLowDateTime=0xc6d98dc0, ftLastAccessTime.dwHighDateTime=0x1d5e08b, ftLastWriteTime.dwLowDateTime=0xc6d98dc0, ftLastWriteTime.dwHighDateTime=0x1d5e08b, nFileSizeHigh=0x0, nFileSizeLow=0x1251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="QSKPDQmkFSbe2s7.gif", cAlternateFileName="QSKPDQ~1.GIF")) returned 1 [0081.838] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dc750, ftCreationTime.dwHighDateTime=0x1d5e5b1, ftLastAccessTime.dwLowDateTime=0x3cba2290, ftLastAccessTime.dwHighDateTime=0x1d5e15c, ftLastWriteTime.dwLowDateTime=0x3cba2290, ftLastWriteTime.dwHighDateTime=0x1d5e15c, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="uBQ3PaG0.gif", cAlternateFileName="")) returned 1 [0081.839] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508f7370, ftCreationTime.dwHighDateTime=0x1d5e476, ftLastAccessTime.dwLowDateTime=0xfaecc7d0, ftLastAccessTime.dwHighDateTime=0x1d5e1cb, ftLastWriteTime.dwLowDateTime=0xfaecc7d0, ftLastWriteTime.dwHighDateTime=0x1d5e1cb, nFileSizeHigh=0x0, nFileSizeLow=0xefd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="UltAiBoICaX3gVTNUFbP.png", cAlternateFileName="ULTAIB~1.PNG")) returned 1 [0081.839] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c50ef80, ftCreationTime.dwHighDateTime=0x1d5ddd1, ftLastAccessTime.dwLowDateTime=0xf2c55bd0, ftLastAccessTime.dwHighDateTime=0x1d5e473, ftLastWriteTime.dwLowDateTime=0xf2c55bd0, ftLastWriteTime.dwHighDateTime=0x1d5e473, nFileSizeHigh=0x0, nFileSizeLow=0x178e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZkzUY FR.png", cAlternateFileName="ZKZUYF~1.PNG")) returned 1 [0081.839] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cbbd280, ftCreationTime.dwHighDateTime=0x1d5dbc5, ftLastAccessTime.dwLowDateTime=0x299cd310, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0x299cd310, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xhTwz6.gif", cAlternateFileName="")) returned 1 [0081.839] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.839] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0081.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0081.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0081.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0081.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0", lpFilePart=0x0) returned 0x33 [0081.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\", lpFilePart=0x0) returned 0x34 [0081.840] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x524c8980, ftCreationTime.dwHighDateTime=0x1d5d901, ftLastAccessTime.dwLowDateTime=0xbed1b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0xbed1b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e02a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0081.840] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x524c8980, ftCreationTime.dwHighDateTime=0x1d5d901, ftLastAccessTime.dwLowDateTime=0xbed1b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e02a, ftLastWriteTime.dwLowDateTime=0xbed1b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e02a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.840] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5331d420, ftCreationTime.dwHighDateTime=0x1d5dfca, ftLastAccessTime.dwLowDateTime=0x8b7702c0, ftLastAccessTime.dwHighDateTime=0x1d5daa1, ftLastWriteTime.dwLowDateTime=0x8b7702c0, ftLastWriteTime.dwHighDateTime=0x1d5daa1, nFileSizeHigh=0x0, nFileSizeLow=0x13dc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="00PQi8jDZheaA.jpg", cAlternateFileName="00PQI8~1.JPG")) returned 1 [0081.840] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174de40, ftCreationTime.dwHighDateTime=0x1d5e4fb, ftLastAccessTime.dwLowDateTime=0x2c47c380, ftLastAccessTime.dwHighDateTime=0x1d5e04a, ftLastWriteTime.dwLowDateTime=0x2c47c380, ftLastWriteTime.dwHighDateTime=0x1d5e04a, nFileSizeHigh=0x0, nFileSizeLow=0x8298, dwReserved0=0x0, dwReserved1=0x0, cFileName="2r_FV-HfctIu.gif", cAlternateFileName="2R_FV-~1.GIF")) returned 1 [0081.841] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1784350, ftCreationTime.dwHighDateTime=0x1d5dd16, ftLastAccessTime.dwLowDateTime=0x1afbacd0, ftLastAccessTime.dwHighDateTime=0x1d5e447, ftLastWriteTime.dwLowDateTime=0x1afbacd0, ftLastWriteTime.dwHighDateTime=0x1d5e447, nFileSizeHigh=0x0, nFileSizeLow=0x57f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="75HW_wjpHU.gif", cAlternateFileName="75HW_W~1.GIF")) returned 1 [0081.841] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd415ed0, ftCreationTime.dwHighDateTime=0x1d5d832, ftLastAccessTime.dwLowDateTime=0x1ee45640, ftLastAccessTime.dwHighDateTime=0x1d5e4d7, ftLastWriteTime.dwLowDateTime=0x1ee45640, ftLastWriteTime.dwHighDateTime=0x1d5e4d7, nFileSizeHigh=0x0, nFileSizeLow=0x673b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cut-Vb.png", cAlternateFileName="")) returned 1 [0081.841] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5869c00, ftCreationTime.dwHighDateTime=0x1d5e813, ftLastAccessTime.dwLowDateTime=0x350c52e0, ftLastAccessTime.dwHighDateTime=0x1d5d90d, ftLastWriteTime.dwLowDateTime=0x350c52e0, ftLastWriteTime.dwHighDateTime=0x1d5d90d, nFileSizeHigh=0x0, nFileSizeLow=0x4308, dwReserved0=0x0, dwReserved1=0x0, cFileName="GUUT3Ig185.gif", cAlternateFileName="GUUT3I~1.GIF")) returned 1 [0081.841] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf986cbd0, ftCreationTime.dwHighDateTime=0x1d5da4f, ftLastAccessTime.dwLowDateTime=0x8d9d1740, ftLastAccessTime.dwHighDateTime=0x1d5dac6, ftLastWriteTime.dwLowDateTime=0x8d9d1740, ftLastWriteTime.dwHighDateTime=0x1d5dac6, nFileSizeHigh=0x0, nFileSizeLow=0xd31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="p5eBt5KxK5Pu2augljV.gif", cAlternateFileName="P5EBT5~1.GIF")) returned 1 [0081.841] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2075c0b0, ftCreationTime.dwHighDateTime=0x1d5e7c1, ftLastAccessTime.dwLowDateTime=0xc6d98dc0, ftLastAccessTime.dwHighDateTime=0x1d5e08b, ftLastWriteTime.dwLowDateTime=0xc6d98dc0, ftLastWriteTime.dwHighDateTime=0x1d5e08b, nFileSizeHigh=0x0, nFileSizeLow=0x1251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="QSKPDQmkFSbe2s7.gif", cAlternateFileName="QSKPDQ~1.GIF")) returned 1 [0081.841] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dc750, ftCreationTime.dwHighDateTime=0x1d5e5b1, ftLastAccessTime.dwLowDateTime=0x3cba2290, ftLastAccessTime.dwHighDateTime=0x1d5e15c, ftLastWriteTime.dwLowDateTime=0x3cba2290, ftLastWriteTime.dwHighDateTime=0x1d5e15c, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="uBQ3PaG0.gif", cAlternateFileName="")) returned 1 [0081.841] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508f7370, ftCreationTime.dwHighDateTime=0x1d5e476, ftLastAccessTime.dwLowDateTime=0xfaecc7d0, ftLastAccessTime.dwHighDateTime=0x1d5e1cb, ftLastWriteTime.dwLowDateTime=0xfaecc7d0, ftLastWriteTime.dwHighDateTime=0x1d5e1cb, nFileSizeHigh=0x0, nFileSizeLow=0xefd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="UltAiBoICaX3gVTNUFbP.png", cAlternateFileName="ULTAIB~1.PNG")) returned 1 [0081.842] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c50ef80, ftCreationTime.dwHighDateTime=0x1d5ddd1, ftLastAccessTime.dwLowDateTime=0xf2c55bd0, ftLastAccessTime.dwHighDateTime=0x1d5e473, ftLastWriteTime.dwLowDateTime=0xf2c55bd0, ftLastWriteTime.dwHighDateTime=0x1d5e473, nFileSizeHigh=0x0, nFileSizeLow=0x178e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZkzUY FR.png", cAlternateFileName="ZKZUYF~1.PNG")) returned 1 [0081.842] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cbbd280, ftCreationTime.dwHighDateTime=0x1d5dbc5, ftLastAccessTime.dwLowDateTime=0x299cd310, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0x299cd310, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xhTwz6.gif", cAlternateFileName="")) returned 1 [0081.842] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cbbd280, ftCreationTime.dwHighDateTime=0x1d5dbc5, ftLastAccessTime.dwLowDateTime=0x299cd310, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0x299cd310, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="_xhTwz6.gif", cAlternateFileName="")) returned 0 [0081.842] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0081.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0081.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0081.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", lpFilePart=0x0) returned 0x45 [0081.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0081.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\00pqi8jdzheaa.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.842] GetFileType (hFile=0x2b8) returned 0x1 [0081.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0081.842] GetFileType (hFile=0x2b8) returned 0x1 [0081.843] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x13dc9 [0081.843] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=81343, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x13dbf [0081.843] ReadFile (in: hFile=0x2b8, lpBuffer=0x28826f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28826f0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0081.843] CloseHandle (hObject=0x2b8) returned 1 [0081.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11af8) returned 0x0 [0081.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", lpFilePart=0x0) returned 0x45 [0081.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0081.850] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\00pqi8jdzheaa.jpg"), fInfoLevelId=0x0, lpFileInformation=0x28ef100 | out: lpFileInformation=0x28ef100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5331d420, ftCreationTime.dwHighDateTime=0x1d5dfca, ftLastAccessTime.dwLowDateTime=0x8b7702c0, ftLastAccessTime.dwHighDateTime=0x1d5daa1, ftLastWriteTime.dwLowDateTime=0x8b7702c0, ftLastWriteTime.dwHighDateTime=0x1d5daa1, nFileSizeHigh=0x0, nFileSizeLow=0x13dc9)) returned 1 [0081.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0081.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", lpFilePart=0x0) returned 0x45 [0081.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0081.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\00pqi8jdzheaa.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.850] GetFileType (hFile=0x2b8) returned 0x1 [0081.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0081.850] GetFileType (hFile=0x2b8) returned 0x1 [0081.850] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x13dc9 [0081.850] ReadFile (in: hFile=0x2b8, lpBuffer=0x28ef3c8, nNumberOfBytesToRead=0x13dc9, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28ef3c8*, lpNumberOfBytesRead=0x1c9aea98*=0x13dc9, lpOverlapped=0x0) returned 1 [0081.852] CloseHandle (hObject=0x2b8) returned 1 [0081.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", lpFilePart=0x0) returned 0x45 [0081.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\00pqi8jdzheaa.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.870] GetFileType (hFile=0x2b8) returned 0x1 [0081.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.870] GetFileType (hFile=0x2b8) returned 0x1 [0081.870] WriteFile (in: hFile=0x2b8, lpBuffer=0x29a1698*, nNumberOfBytesToWrite=0x13dd0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x29a1698*, lpNumberOfBytesWritten=0x1c9aeb28*=0x13dd0, lpOverlapped=0x0) returned 1 [0081.872] CloseHandle (hObject=0x2b8) returned 1 [0081.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", lpFilePart=0x0) returned 0x45 [0081.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", lpFilePart=0x0) returned 0x45 [0081.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\00pqi8jdzheaa.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.873] GetFileType (hFile=0x2b8) returned 0x1 [0081.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.873] GetFileType (hFile=0x2b8) returned 0x1 [0081.873] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x13dd0 [0081.873] WriteFile (in: hFile=0x2b8, lpBuffer=0x29b6410*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x29b6410*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0081.873] CloseHandle (hObject=0x2b8) returned 1 [0081.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg", lpFilePart=0x0) returned 0x45 [0081.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\MDBQUWk4akRaaGVhQS5qcGc=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\MDBQUWk4akRaaGVhQS5qcGc=", lpFilePart=0x0) returned 0x4c [0081.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0081.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\00pqi8jdzheaa.jpg"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5331d420, ftCreationTime.dwHighDateTime=0x1d5dfca, ftLastAccessTime.dwLowDateTime=0x8b7702c0, ftLastAccessTime.dwHighDateTime=0x1d5daa1, ftLastWriteTime.dwLowDateTime=0xd884c7e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x13dda)) returned 1 [0081.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0081.873] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\00PQi8jDZheaA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\00pqi8jdzheaa.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\MDBQUWk4akRaaGVhQS5qcGc=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\mdbquwk4akraagvhqs5qcgc=")) returned 1 [0081.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", lpFilePart=0x0) returned 0x44 [0081.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0081.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\2r_fv-hfctiu.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.874] GetFileType (hFile=0x2b8) returned 0x1 [0081.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0081.874] GetFileType (hFile=0x2b8) returned 0x1 [0081.874] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x8298 [0081.874] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=33422, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x828e [0081.874] ReadFile (in: hFile=0x2b8, lpBuffer=0x29b7820, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x29b7820*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0081.875] CloseHandle (hObject=0x2b8) returned 1 [0081.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", lpFilePart=0x0) returned 0x44 [0081.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0081.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\2r_fv-hfctiu.gif"), fInfoLevelId=0x0, lpFileInformation=0x2a242b0 | out: lpFileInformation=0x2a242b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174de40, ftCreationTime.dwHighDateTime=0x1d5e4fb, ftLastAccessTime.dwLowDateTime=0x2c47c380, ftLastAccessTime.dwHighDateTime=0x1d5e04a, ftLastWriteTime.dwLowDateTime=0x2c47c380, ftLastWriteTime.dwHighDateTime=0x1d5e04a, nFileSizeHigh=0x0, nFileSizeLow=0x8298)) returned 1 [0081.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0081.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", lpFilePart=0x0) returned 0x44 [0081.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0081.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\2r_fv-hfctiu.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.881] GetFileType (hFile=0x2b8) returned 0x1 [0081.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0081.881] GetFileType (hFile=0x2b8) returned 0x1 [0081.881] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x8298 [0081.882] ReadFile (in: hFile=0x2b8, lpBuffer=0x2a24578, nNumberOfBytesToRead=0x8298, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x2a24578*, lpNumberOfBytesRead=0x1c9aea98*=0x8298, lpOverlapped=0x0) returned 1 [0081.882] CloseHandle (hObject=0x2b8) returned 1 [0081.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", lpFilePart=0x0) returned 0x44 [0081.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\2r_fv-hfctiu.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.904] GetFileType (hFile=0x2b8) returned 0x1 [0081.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.904] GetFileType (hFile=0x2b8) returned 0x1 [0081.904] WriteFile (in: hFile=0x2b8, lpBuffer=0x273f6c8*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x273f6c8*, lpNumberOfBytesWritten=0x1c9aeb28*=0x82a0, lpOverlapped=0x0) returned 1 [0081.905] CloseHandle (hObject=0x2b8) returned 1 [0081.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", lpFilePart=0x0) returned 0x44 [0081.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", lpFilePart=0x0) returned 0x44 [0081.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\2r_fv-hfctiu.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.906] GetFileType (hFile=0x2b8) returned 0x1 [0081.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.907] GetFileType (hFile=0x2b8) returned 0x1 [0081.907] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x82a0 [0081.907] WriteFile (in: hFile=0x2b8, lpBuffer=0x2748908*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2748908*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0081.907] CloseHandle (hObject=0x2b8) returned 1 [0081.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif", lpFilePart=0x0) returned 0x44 [0081.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\MnJfRlYtSGZjdEl1LmdpZg==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\MnJfRlYtSGZjdEl1LmdpZg==", lpFilePart=0x0) returned 0x4c [0081.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0081.907] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\2r_fv-hfctiu.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174de40, ftCreationTime.dwHighDateTime=0x1d5e4fb, ftLastAccessTime.dwLowDateTime=0x2c47c380, ftLastAccessTime.dwHighDateTime=0x1d5e04a, ftLastWriteTime.dwLowDateTime=0xd8898aa0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x82aa)) returned 1 [0081.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0081.907] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\2r_FV-HfctIu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\2r_fv-hfctiu.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\MnJfRlYtSGZjdEl1LmdpZg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\mnjfrlytsgzjdel1lmdpzg==")) returned 1 [0081.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", lpFilePart=0x0) returned 0x42 [0081.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0081.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\75hw_wjphu.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.908] GetFileType (hFile=0x2b8) returned 0x1 [0081.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0081.908] GetFileType (hFile=0x2b8) returned 0x1 [0081.908] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x57f0 [0081.908] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=22502, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x57e6 [0081.908] ReadFile (in: hFile=0x2b8, lpBuffer=0x2749d08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2749d08*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0081.909] CloseHandle (hObject=0x2b8) returned 1 [0081.910] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11af8) returned 0x0 [0081.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", lpFilePart=0x0) returned 0x42 [0081.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0081.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\75hw_wjphu.gif"), fInfoLevelId=0x0, lpFileInformation=0x27b6718 | out: lpFileInformation=0x27b6718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1784350, ftCreationTime.dwHighDateTime=0x1d5dd16, ftLastAccessTime.dwLowDateTime=0x1afbacd0, ftLastAccessTime.dwHighDateTime=0x1d5e447, ftLastWriteTime.dwLowDateTime=0x1afbacd0, ftLastWriteTime.dwHighDateTime=0x1d5e447, nFileSizeHigh=0x0, nFileSizeLow=0x57f0)) returned 1 [0081.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0081.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", lpFilePart=0x0) returned 0x42 [0081.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0081.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\75hw_wjphu.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.911] GetFileType (hFile=0x2b8) returned 0x1 [0081.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0081.912] GetFileType (hFile=0x2b8) returned 0x1 [0081.912] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x57f0 [0081.912] ReadFile (in: hFile=0x2b8, lpBuffer=0x27b69c0, nNumberOfBytesToRead=0x57f0, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27b69c0*, lpNumberOfBytesRead=0x1c9aea98*=0x57f0, lpOverlapped=0x0) returned 1 [0081.912] CloseHandle (hObject=0x2b8) returned 1 [0081.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", lpFilePart=0x0) returned 0x42 [0081.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\75hw_wjphu.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.923] GetFileType (hFile=0x2b8) returned 0x1 [0081.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.923] GetFileType (hFile=0x2b8) returned 0x1 [0081.923] WriteFile (in: hFile=0x2b8, lpBuffer=0x2848da8*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2848da8*, lpNumberOfBytesWritten=0x1c9aeb28*=0x5800, lpOverlapped=0x0) returned 1 [0081.924] CloseHandle (hObject=0x2b8) returned 1 [0081.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", lpFilePart=0x0) returned 0x42 [0081.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", lpFilePart=0x0) returned 0x42 [0081.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\75hw_wjphu.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.926] GetFileType (hFile=0x2b8) returned 0x1 [0081.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.926] GetFileType (hFile=0x2b8) returned 0x1 [0081.926] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x5800 [0081.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif", lpFilePart=0x0) returned 0x42 [0081.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\NzVIV193anBIVS5naWY=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\NzVIV193anBIVS5naWY=", lpFilePart=0x0) returned 0x48 [0081.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0081.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\75hw_wjphu.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1784350, ftCreationTime.dwHighDateTime=0x1d5dd16, ftLastAccessTime.dwLowDateTime=0x1afbacd0, ftLastAccessTime.dwHighDateTime=0x1d5e447, ftLastWriteTime.dwLowDateTime=0xd88bec00, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x580a)) returned 1 [0081.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0081.926] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\75HW_wjpHU.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\75hw_wjphu.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\NzVIV193anBIVS5naWY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\nzviv193anbivs5nawy=")) returned 1 [0081.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", lpFilePart=0x0) returned 0x3e [0081.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0081.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\cut-vb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.927] GetFileType (hFile=0x2b8) returned 0x1 [0081.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0081.927] GetFileType (hFile=0x2b8) returned 0x1 [0081.927] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x673b [0081.927] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=26417, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x6731 [0081.927] ReadFile (in: hFile=0x2b8, lpBuffer=0x28508e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x28508e0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0081.928] CloseHandle (hObject=0x2b8) returned 1 [0081.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11af8) returned 0x0 [0081.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", lpFilePart=0x0) returned 0x3e [0081.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0081.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\cut-vb.png"), fInfoLevelId=0x0, lpFileInformation=0x28bd370 | out: lpFileInformation=0x28bd370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd415ed0, ftCreationTime.dwHighDateTime=0x1d5d832, ftLastAccessTime.dwLowDateTime=0x1ee45640, ftLastAccessTime.dwHighDateTime=0x1d5e4d7, ftLastWriteTime.dwLowDateTime=0x1ee45640, ftLastWriteTime.dwHighDateTime=0x1d5e4d7, nFileSizeHigh=0x0, nFileSizeLow=0x673b)) returned 1 [0081.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0081.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", lpFilePart=0x0) returned 0x3e [0081.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0081.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\cut-vb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.931] GetFileType (hFile=0x2b8) returned 0x1 [0081.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0081.931] GetFileType (hFile=0x2b8) returned 0x1 [0081.931] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x673b [0081.931] ReadFile (in: hFile=0x2b8, lpBuffer=0x28bd5f8, nNumberOfBytesToRead=0x673b, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28bd5f8*, lpNumberOfBytesRead=0x1c9aea98*=0x673b, lpOverlapped=0x0) returned 1 [0081.931] CloseHandle (hObject=0x2b8) returned 1 [0081.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", lpFilePart=0x0) returned 0x3e [0081.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\cut-vb.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.942] GetFileType (hFile=0x2b8) returned 0x1 [0081.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.942] GetFileType (hFile=0x2b8) returned 0x1 [0081.942] WriteFile (in: hFile=0x2b8, lpBuffer=0x2954390*, nNumberOfBytesToWrite=0x6740, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2954390*, lpNumberOfBytesWritten=0x1c9aeb28*=0x6740, lpOverlapped=0x0) returned 1 [0081.943] CloseHandle (hObject=0x2b8) returned 1 [0081.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", lpFilePart=0x0) returned 0x3e [0081.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", lpFilePart=0x0) returned 0x3e [0081.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\cut-vb.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.944] GetFileType (hFile=0x2b8) returned 0x1 [0081.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.944] GetFileType (hFile=0x2b8) returned 0x1 [0081.944] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x6740 [0081.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png", lpFilePart=0x0) returned 0x3e [0081.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Q3V0LVZiLnBuZw==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Q3V0LVZiLnBuZw==", lpFilePart=0x0) returned 0x44 [0081.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0081.947] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\cut-vb.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd415ed0, ftCreationTime.dwHighDateTime=0x1d5d832, ftLastAccessTime.dwLowDateTime=0x1ee45640, ftLastAccessTime.dwHighDateTime=0x1d5e4d7, ftLastWriteTime.dwLowDateTime=0xd890aec0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x674a)) returned 1 [0081.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0081.947] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Cut-Vb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\cut-vb.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Q3V0LVZiLnBuZw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\q3v0lvzilnbuzw==")) returned 1 [0081.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", lpFilePart=0x0) returned 0x42 [0081.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0081.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\guut3ig185.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.948] GetFileType (hFile=0x2b8) returned 0x1 [0081.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0081.948] GetFileType (hFile=0x2b8) returned 0x1 [0081.948] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x4308 [0081.948] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=17150, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x42fe [0081.948] ReadFile (in: hFile=0x2b8, lpBuffer=0x295cfb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x295cfb8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0081.949] CloseHandle (hObject=0x2b8) returned 1 [0081.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", lpFilePart=0x0) returned 0x42 [0081.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0081.950] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\guut3ig185.gif"), fInfoLevelId=0x0, lpFileInformation=0x29c9a48 | out: lpFileInformation=0x29c9a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5869c00, ftCreationTime.dwHighDateTime=0x1d5e813, ftLastAccessTime.dwLowDateTime=0x350c52e0, ftLastAccessTime.dwHighDateTime=0x1d5d90d, ftLastWriteTime.dwLowDateTime=0x350c52e0, ftLastWriteTime.dwHighDateTime=0x1d5d90d, nFileSizeHigh=0x0, nFileSizeLow=0x4308)) returned 1 [0081.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0081.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", lpFilePart=0x0) returned 0x42 [0081.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0081.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\guut3ig185.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.951] GetFileType (hFile=0x2b8) returned 0x1 [0081.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0081.951] GetFileType (hFile=0x2b8) returned 0x1 [0081.951] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x4308 [0081.951] ReadFile (in: hFile=0x2b8, lpBuffer=0x29c9cf0, nNumberOfBytesToRead=0x4308, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x29c9cf0*, lpNumberOfBytesRead=0x1c9aea98*=0x4308, lpOverlapped=0x0) returned 1 [0081.951] CloseHandle (hObject=0x2b8) returned 1 [0081.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", lpFilePart=0x0) returned 0x42 [0081.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0081.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\guut3ig185.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.994] GetFileType (hFile=0x2b8) returned 0x1 [0081.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0081.994] GetFileType (hFile=0x2b8) returned 0x1 [0081.994] WriteFile (in: hFile=0x2b8, lpBuffer=0x2770490*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2770490*, lpNumberOfBytesWritten=0x1c9aeb28*=0x4310, lpOverlapped=0x0) returned 1 [0081.995] CloseHandle (hObject=0x2b8) returned 1 [0081.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", lpFilePart=0x0) returned 0x42 [0081.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", lpFilePart=0x0) returned 0x42 [0081.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0081.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\guut3ig185.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.996] GetFileType (hFile=0x2b8) returned 0x1 [0081.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0081.996] GetFileType (hFile=0x2b8) returned 0x1 [0081.996] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x4310 [0081.996] WriteFile (in: hFile=0x2b8, lpBuffer=0x2775700*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2775700*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0081.996] CloseHandle (hObject=0x2b8) returned 1 [0081.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif", lpFilePart=0x0) returned 0x42 [0081.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\R1VVVDNJZzE4NS5naWY=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\R1VVVDNJZzE4NS5naWY=", lpFilePart=0x0) returned 0x48 [0081.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0081.996] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\guut3ig185.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5869c00, ftCreationTime.dwHighDateTime=0x1d5e813, ftLastAccessTime.dwLowDateTime=0x350c52e0, ftLastAccessTime.dwHighDateTime=0x1d5d90d, ftLastWriteTime.dwLowDateTime=0xd897d2e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x431a)) returned 1 [0081.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0081.996] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\GUUT3Ig185.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\guut3ig185.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\R1VVVDNJZzE4NS5naWY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\r1vvvdnjzze4ns5nawy=")) returned 1 [0081.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", lpFilePart=0x0) returned 0x4b [0081.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0081.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\p5ebt5kxk5pu2augljv.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0081.997] GetFileType (hFile=0x2b8) returned 0x1 [0081.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0081.997] GetFileType (hFile=0x2b8) returned 0x1 [0081.997] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xd31b [0081.997] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=54033, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xd311 [0081.997] ReadFile (in: hFile=0x2b8, lpBuffer=0x2776b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2776b08*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0081.998] CloseHandle (hObject=0x2b8) returned 1 [0082.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", lpFilePart=0x0) returned 0x4b [0082.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.000] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\p5ebt5kxk5pu2augljv.gif"), fInfoLevelId=0x0, lpFileInformation=0x27e3598 | out: lpFileInformation=0x27e3598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf986cbd0, ftCreationTime.dwHighDateTime=0x1d5da4f, ftLastAccessTime.dwLowDateTime=0x8d9d1740, ftLastAccessTime.dwHighDateTime=0x1d5dac6, ftLastWriteTime.dwLowDateTime=0x8d9d1740, ftLastWriteTime.dwHighDateTime=0x1d5dac6, nFileSizeHigh=0x0, nFileSizeLow=0xd31b)) returned 1 [0082.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", lpFilePart=0x0) returned 0x4b [0082.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\p5ebt5kxk5pu2augljv.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.000] GetFileType (hFile=0x2b8) returned 0x1 [0082.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.000] GetFileType (hFile=0x2b8) returned 0x1 [0082.001] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xd31b [0082.001] ReadFile (in: hFile=0x2b8, lpBuffer=0x27e3880, nNumberOfBytesToRead=0xd31b, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27e3880*, lpNumberOfBytesRead=0x1c9aea98*=0xd31b, lpOverlapped=0x0) returned 1 [0082.001] CloseHandle (hObject=0x2b8) returned 1 [0082.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", lpFilePart=0x0) returned 0x4b [0082.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\p5ebt5kxk5pu2augljv.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.014] GetFileType (hFile=0x2b8) returned 0x1 [0082.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.014] GetFileType (hFile=0x2b8) returned 0x1 [0082.014] WriteFile (in: hFile=0x2b8, lpBuffer=0x2881dd8*, nNumberOfBytesToWrite=0xd320, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2881dd8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xd320, lpOverlapped=0x0) returned 1 [0082.016] CloseHandle (hObject=0x2b8) returned 1 [0082.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", lpFilePart=0x0) returned 0x4b [0082.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", lpFilePart=0x0) returned 0x4b [0082.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\p5ebt5kxk5pu2augljv.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.017] GetFileType (hFile=0x2b8) returned 0x1 [0082.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.017] GetFileType (hFile=0x2b8) returned 0x1 [0082.017] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xd320 [0082.017] WriteFile (in: hFile=0x2b8, lpBuffer=0x28900e8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x28900e8*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0082.017] CloseHandle (hObject=0x2b8) returned 1 [0082.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif", lpFilePart=0x0) returned 0x4b [0082.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\cDVlQnQ1S3hLNVB1MmF1Z2xqVi5naWY=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\cDVlQnQ1S3hLNVB1MmF1Z2xqVi5naWY=", lpFilePart=0x0) returned 0x54 [0082.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.017] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\p5ebt5kxk5pu2augljv.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf986cbd0, ftCreationTime.dwHighDateTime=0x1d5da4f, ftLastAccessTime.dwLowDateTime=0x8d9d1740, ftLastAccessTime.dwHighDateTime=0x1d5dac6, ftLastWriteTime.dwLowDateTime=0xd89a3440, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd32a)) returned 1 [0082.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.018] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\p5eBt5KxK5Pu2augljV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\p5ebt5kxk5pu2augljv.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\cDVlQnQ1S3hLNVB1MmF1Z2xqVi5naWY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\cdvlqnq1s3hlnvb1mmf1z2xqvi5nawy=")) returned 1 [0082.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", lpFilePart=0x0) returned 0x47 [0082.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\qskpdqmkfsbe2s7.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.018] GetFileType (hFile=0x2b8) returned 0x1 [0082.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.018] GetFileType (hFile=0x2b8) returned 0x1 [0082.018] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x1251f [0082.018] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=75029, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x12515 [0082.018] ReadFile (in: hFile=0x2b8, lpBuffer=0x2891520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2891520*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.019] CloseHandle (hObject=0x2b8) returned 1 [0082.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", lpFilePart=0x0) returned 0x47 [0082.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.021] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\qskpdqmkfsbe2s7.gif"), fInfoLevelId=0x0, lpFileInformation=0x28fdfb0 | out: lpFileInformation=0x28fdfb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2075c0b0, ftCreationTime.dwHighDateTime=0x1d5e7c1, ftLastAccessTime.dwLowDateTime=0xc6d98dc0, ftLastAccessTime.dwHighDateTime=0x1d5e08b, ftLastWriteTime.dwLowDateTime=0xc6d98dc0, ftLastWriteTime.dwHighDateTime=0x1d5e08b, nFileSizeHigh=0x0, nFileSizeLow=0x1251f)) returned 1 [0082.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", lpFilePart=0x0) returned 0x47 [0082.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\qskpdqmkfsbe2s7.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.021] GetFileType (hFile=0x2b8) returned 0x1 [0082.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.021] GetFileType (hFile=0x2b8) returned 0x1 [0082.021] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x1251f [0082.022] ReadFile (in: hFile=0x2b8, lpBuffer=0x28fe278, nNumberOfBytesToRead=0x1251f, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28fe278*, lpNumberOfBytesRead=0x1c9aea98*=0x1251f, lpOverlapped=0x0) returned 1 [0082.022] CloseHandle (hObject=0x2b8) returned 1 [0082.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", lpFilePart=0x0) returned 0x47 [0082.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\qskpdqmkfsbe2s7.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.067] GetFileType (hFile=0x2b8) returned 0x1 [0082.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.067] GetFileType (hFile=0x2b8) returned 0x1 [0082.067] WriteFile (in: hFile=0x2b8, lpBuffer=0x274d0c8*, nNumberOfBytesToWrite=0x12520, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x274d0c8*, lpNumberOfBytesWritten=0x1c9aeb28*=0x12520, lpOverlapped=0x0) returned 1 [0082.069] CloseHandle (hObject=0x2b8) returned 1 [0082.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", lpFilePart=0x0) returned 0x47 [0082.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", lpFilePart=0x0) returned 0x47 [0082.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\qskpdqmkfsbe2s7.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.070] GetFileType (hFile=0x2b8) returned 0x1 [0082.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.070] GetFileType (hFile=0x2b8) returned 0x1 [0082.070] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x12520 [0082.070] WriteFile (in: hFile=0x2b8, lpBuffer=0x2760598*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2760598*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0082.070] CloseHandle (hObject=0x2b8) returned 1 [0082.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif", lpFilePart=0x0) returned 0x47 [0082.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UVNLUERRbWtGU2JlMnM3LmdpZg==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UVNLUERRbWtGU2JlMnM3LmdpZg==", lpFilePart=0x0) returned 0x50 [0082.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\qskpdqmkfsbe2s7.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2075c0b0, ftCreationTime.dwHighDateTime=0x1d5e7c1, ftLastAccessTime.dwLowDateTime=0xc6d98dc0, ftLastAccessTime.dwHighDateTime=0x1d5e08b, ftLastWriteTime.dwLowDateTime=0xd8a3b9c0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1252a)) returned 1 [0082.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.071] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\QSKPDQmkFSbe2s7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\qskpdqmkfsbe2s7.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UVNLUERRbWtGU2JlMnM3LmdpZg==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\uvnluerrbwtgu2jlmnm3lmdpzg==")) returned 1 [0082.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", lpFilePart=0x0) returned 0x40 [0082.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ubq3pag0.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.072] GetFileType (hFile=0x2b8) returned 0x1 [0082.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.072] GetFileType (hFile=0x2b8) returned 0x1 [0082.072] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x460 [0082.072] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=1110, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x456 [0082.072] ReadFile (in: hFile=0x2b8, lpBuffer=0x27619a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27619a8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.073] CloseHandle (hObject=0x2b8) returned 1 [0082.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", lpFilePart=0x0) returned 0x40 [0082.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ubq3pag0.gif"), fInfoLevelId=0x0, lpFileInformation=0x27ce3f8 | out: lpFileInformation=0x27ce3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dc750, ftCreationTime.dwHighDateTime=0x1d5e5b1, ftLastAccessTime.dwLowDateTime=0x3cba2290, ftLastAccessTime.dwHighDateTime=0x1d5e15c, ftLastWriteTime.dwLowDateTime=0x3cba2290, ftLastWriteTime.dwHighDateTime=0x1d5e15c, nFileSizeHigh=0x0, nFileSizeLow=0x460)) returned 1 [0082.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", lpFilePart=0x0) returned 0x40 [0082.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ubq3pag0.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.074] GetFileType (hFile=0x2b8) returned 0x1 [0082.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.075] GetFileType (hFile=0x2b8) returned 0x1 [0082.075] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x460 [0082.075] ReadFile (in: hFile=0x2b8, lpBuffer=0x27ceb18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27ceb18*, lpNumberOfBytesRead=0x1c9aea98*=0x460, lpOverlapped=0x0) returned 1 [0082.075] CloseHandle (hObject=0x2b8) returned 1 [0082.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", lpFilePart=0x0) returned 0x40 [0082.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ubq3pag0.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.086] GetFileType (hFile=0x2b8) returned 0x1 [0082.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.086] GetFileType (hFile=0x2b8) returned 0x1 [0082.086] WriteFile (in: hFile=0x2b8, lpBuffer=0x2847eb8*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x1c9ae9d8, lpOverlapped=0x0 | out: lpBuffer=0x2847eb8*, lpNumberOfBytesWritten=0x1c9ae9d8*=0x470, lpOverlapped=0x0) returned 1 [0082.087] CloseHandle (hObject=0x2b8) returned 1 [0082.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", lpFilePart=0x0) returned 0x40 [0082.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", lpFilePart=0x0) returned 0x40 [0082.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ubq3pag0.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.088] GetFileType (hFile=0x2b8) returned 0x1 [0082.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.088] GetFileType (hFile=0x2b8) returned 0x1 [0082.088] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x470 [0082.088] WriteFile (in: hFile=0x2b8, lpBuffer=0x2849cb0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2849cb0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0082.088] CloseHandle (hObject=0x2b8) returned 1 [0082.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif", lpFilePart=0x0) returned 0x40 [0082.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\dUJRM1BhRzAuZ2lm", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\dUJRM1BhRzAuZ2lm", lpFilePart=0x0) returned 0x44 [0082.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ubq3pag0.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dc750, ftCreationTime.dwHighDateTime=0x1d5e5b1, ftLastAccessTime.dwLowDateTime=0x3cba2290, ftLastAccessTime.dwHighDateTime=0x1d5e15c, ftLastWriteTime.dwLowDateTime=0xd8a61b20, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x47a)) returned 1 [0082.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.088] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\uBQ3PaG0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ubq3pag0.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\dUJRM1BhRzAuZ2lm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\dujrm1bhrzauz2lm")) returned 1 [0082.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", lpFilePart=0x0) returned 0x4c [0082.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ultaiboicax3gvtnufbp.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.089] GetFileType (hFile=0x2b8) returned 0x1 [0082.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.089] GetFileType (hFile=0x2b8) returned 0x1 [0082.089] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xefd7 [0082.089] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=61389, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xefcd [0082.089] ReadFile (in: hFile=0x2b8, lpBuffer=0x284b0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x284b0b8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.090] CloseHandle (hObject=0x2b8) returned 1 [0082.091] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", lpFilePart=0x0) returned 0x4c [0082.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ultaiboicax3gvtnufbp.png"), fInfoLevelId=0x0, lpFileInformation=0x28b7ac8 | out: lpFileInformation=0x28b7ac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508f7370, ftCreationTime.dwHighDateTime=0x1d5e476, ftLastAccessTime.dwLowDateTime=0xfaecc7d0, ftLastAccessTime.dwHighDateTime=0x1d5e1cb, ftLastWriteTime.dwLowDateTime=0xfaecc7d0, ftLastWriteTime.dwHighDateTime=0x1d5e1cb, nFileSizeHigh=0x0, nFileSizeLow=0xefd7)) returned 1 [0082.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", lpFilePart=0x0) returned 0x4c [0082.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ultaiboicax3gvtnufbp.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.092] GetFileType (hFile=0x2b8) returned 0x1 [0082.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.092] GetFileType (hFile=0x2b8) returned 0x1 [0082.092] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xefd7 [0082.092] ReadFile (in: hFile=0x2b8, lpBuffer=0x28b7dd0, nNumberOfBytesToRead=0xefd7, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28b7dd0*, lpNumberOfBytesRead=0x1c9aea98*=0xefd7, lpOverlapped=0x0) returned 1 [0082.092] CloseHandle (hObject=0x2b8) returned 1 [0082.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", lpFilePart=0x0) returned 0x4c [0082.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ultaiboicax3gvtnufbp.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.136] GetFileType (hFile=0x2b8) returned 0x1 [0082.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.136] GetFileType (hFile=0x2b8) returned 0x1 [0082.136] WriteFile (in: hFile=0x2b8, lpBuffer=0x2794db8*, nNumberOfBytesToWrite=0xefe0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x2794db8*, lpNumberOfBytesWritten=0x1c9aeb28*=0xefe0, lpOverlapped=0x0) returned 1 [0082.138] CloseHandle (hObject=0x2b8) returned 1 [0082.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", lpFilePart=0x0) returned 0x4c [0082.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", lpFilePart=0x0) returned 0x4c [0082.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ultaiboicax3gvtnufbp.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.138] GetFileType (hFile=0x2b8) returned 0x1 [0082.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.138] GetFileType (hFile=0x2b8) returned 0x1 [0082.139] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xefe0 [0082.139] WriteFile (in: hFile=0x2b8, lpBuffer=0x27a4dc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x27a4dc0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0082.139] CloseHandle (hObject=0x2b8) returned 1 [0082.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png", lpFilePart=0x0) returned 0x4c [0082.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\VWx0QWlCb0lDYVgzZ1ZUTlVGYlAucG5n", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\VWx0QWlCb0lDYVgzZ1ZUTlVGYlAucG5n", lpFilePart=0x0) returned 0x54 [0082.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ultaiboicax3gvtnufbp.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508f7370, ftCreationTime.dwHighDateTime=0x1d5e476, ftLastAccessTime.dwLowDateTime=0xfaecc7d0, ftLastAccessTime.dwHighDateTime=0x1d5e1cb, ftLastWriteTime.dwLowDateTime=0xd8ad3f40, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xefea)) returned 1 [0082.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.139] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\UltAiBoICaX3gVTNUFbP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\ultaiboicax3gvtnufbp.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\VWx0QWlCb0lDYVgzZ1ZUTlVGYlAucG5n" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\vwx0qwlcb0ldyvgzz1zutlvgylaucg5n")) returned 1 [0082.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", lpFilePart=0x0) returned 0x40 [0082.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\zkzuy fr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.140] GetFileType (hFile=0x2b8) returned 0x1 [0082.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.140] GetFileType (hFile=0x2b8) returned 0x1 [0082.140] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x178e1 [0082.140] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=96471, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x178d7 [0082.140] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a61f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27a61f0*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.141] CloseHandle (hObject=0x2b8) returned 1 [0082.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", lpFilePart=0x0) returned 0x40 [0082.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\zkzuy fr.png"), fInfoLevelId=0x0, lpFileInformation=0x2812c00 | out: lpFileInformation=0x2812c00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c50ef80, ftCreationTime.dwHighDateTime=0x1d5ddd1, ftLastAccessTime.dwLowDateTime=0xf2c55bd0, ftLastAccessTime.dwHighDateTime=0x1d5e473, ftLastWriteTime.dwLowDateTime=0xf2c55bd0, ftLastWriteTime.dwHighDateTime=0x1d5e473, nFileSizeHigh=0x0, nFileSizeLow=0x178e1)) returned 1 [0082.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", lpFilePart=0x0) returned 0x40 [0082.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\zkzuy fr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.143] GetFileType (hFile=0x2b8) returned 0x1 [0082.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.143] GetFileType (hFile=0x2b8) returned 0x1 [0082.143] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x178e1 [0082.143] ReadFile (in: hFile=0x2b8, lpBuffer=0x128dc3a0, nNumberOfBytesToRead=0x178e1, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x128dc3a0*, lpNumberOfBytesRead=0x1c9aea98*=0x178e1, lpOverlapped=0x0) returned 1 [0082.145] CloseHandle (hObject=0x2b8) returned 1 [0082.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", lpFilePart=0x0) returned 0x40 [0082.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\zkzuy fr.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.163] GetFileType (hFile=0x2b8) returned 0x1 [0082.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.163] GetFileType (hFile=0x2b8) returned 0x1 [0082.163] WriteFile (in: hFile=0x2b8, lpBuffer=0x129520e8*, nNumberOfBytesToWrite=0x178f0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x129520e8*, lpNumberOfBytesWritten=0x1c9aeb28*=0x178f0, lpOverlapped=0x0) returned 1 [0082.165] CloseHandle (hObject=0x2b8) returned 1 [0082.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", lpFilePart=0x0) returned 0x40 [0082.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", lpFilePart=0x0) returned 0x40 [0082.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\zkzuy fr.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.166] GetFileType (hFile=0x2b8) returned 0x1 [0082.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.166] GetFileType (hFile=0x2b8) returned 0x1 [0082.166] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x178f0 [0082.166] WriteFile (in: hFile=0x2b8, lpBuffer=0x288a9c0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x288a9c0*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0082.166] CloseHandle (hObject=0x2b8) returned 1 [0082.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png", lpFilePart=0x0) returned 0x40 [0082.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Wmt6VVkgRlIucG5n", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Wmt6VVkgRlIucG5n", lpFilePart=0x0) returned 0x44 [0082.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\zkzuy fr.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c50ef80, ftCreationTime.dwHighDateTime=0x1d5ddd1, ftLastAccessTime.dwLowDateTime=0xf2c55bd0, ftLastAccessTime.dwHighDateTime=0x1d5e473, ftLastWriteTime.dwLowDateTime=0xd8b20200, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x178fa)) returned 1 [0082.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.166] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\ZkzUY FR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\zkzuy fr.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\Wmt6VVkgRlIucG5n" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\wmt6vvkgrliucg5n")) returned 1 [0082.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", lpFilePart=0x0) returned 0x3f [0082.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\_xhtwz6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.167] GetFileType (hFile=0x2b8) returned 0x1 [0082.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.167] GetFileType (hFile=0x2b8) returned 0x1 [0082.167] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x7114 [0082.167] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=28938, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x710a [0082.167] ReadFile (in: hFile=0x2b8, lpBuffer=0x288bd88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x288bd88*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.168] CloseHandle (hObject=0x2b8) returned 1 [0082.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", lpFilePart=0x0) returned 0x3f [0082.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.171] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\_xhtwz6.gif"), fInfoLevelId=0x0, lpFileInformation=0x28f8818 | out: lpFileInformation=0x28f8818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cbbd280, ftCreationTime.dwHighDateTime=0x1d5dbc5, ftLastAccessTime.dwLowDateTime=0x299cd310, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0x299cd310, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x7114)) returned 1 [0082.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", lpFilePart=0x0) returned 0x3f [0082.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\_xhtwz6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.171] GetFileType (hFile=0x2b8) returned 0x1 [0082.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.171] GetFileType (hFile=0x2b8) returned 0x1 [0082.171] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x7114 [0082.172] ReadFile (in: hFile=0x2b8, lpBuffer=0x28f8aa0, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28f8aa0*, lpNumberOfBytesRead=0x1c9aea98*=0x7114, lpOverlapped=0x0) returned 1 [0082.172] CloseHandle (hObject=0x2b8) returned 1 [0082.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", lpFilePart=0x0) returned 0x3f [0082.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\_xhtwz6.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.230] GetFileType (hFile=0x2b8) returned 0x1 [0082.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.230] GetFileType (hFile=0x2b8) returned 0x1 [0082.230] WriteFile (in: hFile=0x2b8, lpBuffer=0x27242e0*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x27242e0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x7120, lpOverlapped=0x0) returned 1 [0082.232] CloseHandle (hObject=0x2b8) returned 1 [0082.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", lpFilePart=0x0) returned 0x3f [0082.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", lpFilePart=0x0) returned 0x3f [0082.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\_xhtwz6.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.232] GetFileType (hFile=0x2b8) returned 0x1 [0082.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.232] GetFileType (hFile=0x2b8) returned 0x1 [0082.232] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x7120 [0082.232] WriteFile (in: hFile=0x2b8, lpBuffer=0x272c320*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x272c320*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0082.232] CloseHandle (hObject=0x2b8) returned 1 [0082.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif", lpFilePart=0x0) returned 0x3f [0082.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\X3hoVHd6Ni5naWY=", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\X3hoVHd6Ni5naWY=", lpFilePart=0x0) returned 0x44 [0082.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.233] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\_xhtwz6.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cbbd280, ftCreationTime.dwHighDateTime=0x1d5dbc5, ftLastAccessTime.dwLowDateTime=0x299cd310, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0xd8bb8780, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x712a)) returned 1 [0082.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.233] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\_xhTwz6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\_xhtwz6.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\X3hoVHd6Ni5naWY=" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\x3hovhd6ni5nawy=")) returned 1 [0082.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\README_3728769.txt", nBufferLength=0x105, lpBuffer=0x1c9ae530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\README_3728769.txt", lpFilePart=0x0) returned 0x46 [0082.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea10) returned 1 [0082.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\p0JhMXJ3vii0\\README_3728769.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p0jhmxj3vii0\\readme_3728769.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2b8 [0082.236] GetFileType (hFile=0x2b8) returned 0x1 [0082.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae980) returned 1 [0082.236] GetFileType (hFile=0x2b8) returned 0x1 [0082.236] WriteFile (in: hFile=0x2b8, lpBuffer=0x2730600*, nNumberOfBytesToWrite=0x5b3, lpNumberOfBytesWritten=0x1c9aea58, lpOverlapped=0x0 | out: lpBuffer=0x2730600*, lpNumberOfBytesWritten=0x1c9aea58*=0x5b3, lpOverlapped=0x0) returned 1 [0082.237] CloseHandle (hObject=0x2b8) returned 1 [0082.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0082.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW", lpFilePart=0x0) returned 0x2f [0082.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\", lpFilePart=0x0) returned 0x30 [0082.238] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed9a37e0, ftCreationTime.dwHighDateTime=0x1d5db3e, ftLastAccessTime.dwLowDateTime=0x4ee8c010, ftLastAccessTime.dwHighDateTime=0x1d5de1a, ftLastWriteTime.dwLowDateTime=0x4ee8c010, ftLastWriteTime.dwHighDateTime=0x1d5de1a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0082.238] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed9a37e0, ftCreationTime.dwHighDateTime=0x1d5db3e, ftLastAccessTime.dwLowDateTime=0x4ee8c010, ftLastAccessTime.dwHighDateTime=0x1d5de1a, ftLastWriteTime.dwLowDateTime=0x4ee8c010, ftLastWriteTime.dwHighDateTime=0x1d5de1a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.238] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d06f330, ftCreationTime.dwHighDateTime=0x1d5d9cc, ftLastAccessTime.dwLowDateTime=0x77d14dc0, ftLastAccessTime.dwHighDateTime=0x1d5e406, ftLastWriteTime.dwLowDateTime=0x77d14dc0, ftLastWriteTime.dwHighDateTime=0x1d5e406, nFileSizeHigh=0x0, nFileSizeLow=0x6acc, dwReserved0=0x0, dwReserved1=0x0, cFileName="aBfiJ.gif", cAlternateFileName="")) returned 1 [0082.238] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e08c910, ftCreationTime.dwHighDateTime=0x1d5e13c, ftLastAccessTime.dwLowDateTime=0xc5b97770, ftLastAccessTime.dwHighDateTime=0x1d5dd0c, ftLastWriteTime.dwLowDateTime=0xc5b97770, ftLastWriteTime.dwHighDateTime=0x1d5dd0c, nFileSizeHigh=0x0, nFileSizeLow=0xea4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aSdRxCkBpMk2.bmp", cAlternateFileName="ASDRXC~1.BMP")) returned 1 [0082.238] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f7fd4f0, ftCreationTime.dwHighDateTime=0x1d5dea6, ftLastAccessTime.dwLowDateTime=0xe3c6a2f0, ftLastAccessTime.dwHighDateTime=0x1d5dafb, ftLastWriteTime.dwLowDateTime=0xe3c6a2f0, ftLastWriteTime.dwHighDateTime=0x1d5dafb, nFileSizeHigh=0x0, nFileSizeLow=0x17808, dwReserved0=0x0, dwReserved1=0x0, cFileName="az1_aV.png", cAlternateFileName="")) returned 1 [0082.238] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39a4fe90, ftCreationTime.dwHighDateTime=0x1d5e526, ftLastAccessTime.dwLowDateTime=0xffd456d0, ftLastAccessTime.dwHighDateTime=0x1d5d7eb, ftLastWriteTime.dwLowDateTime=0xffd456d0, ftLastWriteTime.dwHighDateTime=0x1d5d7eb, nFileSizeHigh=0x0, nFileSizeLow=0xd3aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="cto6RPrcfEZJ.jpg", cAlternateFileName="CTO6RP~1.JPG")) returned 1 [0082.238] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd652a700, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0x46176090, ftLastAccessTime.dwHighDateTime=0x1d5e635, ftLastWriteTime.dwLowDateTime=0x46176090, ftLastWriteTime.dwHighDateTime=0x1d5e635, nFileSizeHigh=0x0, nFileSizeLow=0x178d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3u0T-U8E7uUTede_AVG.bmp", cAlternateFileName="D3U0T-~1.BMP")) returned 1 [0082.239] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdc8930, ftCreationTime.dwHighDateTime=0x1d5e5a4, ftLastAccessTime.dwLowDateTime=0x5a56a140, ftLastAccessTime.dwHighDateTime=0x1d5e5f6, ftLastWriteTime.dwLowDateTime=0x5a56a140, ftLastWriteTime.dwHighDateTime=0x1d5e5f6, nFileSizeHigh=0x0, nFileSizeLow=0x7be1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea5wQTp.gif", cAlternateFileName="")) returned 1 [0082.239] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81931ba0, ftCreationTime.dwHighDateTime=0x1d5db86, ftLastAccessTime.dwLowDateTime=0x6d629700, ftLastAccessTime.dwHighDateTime=0x1d5def1, ftLastWriteTime.dwLowDateTime=0x6d629700, ftLastWriteTime.dwHighDateTime=0x1d5def1, nFileSizeHigh=0x0, nFileSizeLow=0x11033, dwReserved0=0x0, dwReserved1=0x0, cFileName="h7faehRiRaOu0.jpg", cAlternateFileName="H7FAEH~1.JPG")) returned 1 [0082.239] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388c29f0, ftCreationTime.dwHighDateTime=0x1d5dc72, ftLastAccessTime.dwLowDateTime=0xde4d8c50, ftLastAccessTime.dwHighDateTime=0x1d5dd1a, ftLastWriteTime.dwLowDateTime=0xde4d8c50, ftLastWriteTime.dwHighDateTime=0x1d5dd1a, nFileSizeHigh=0x0, nFileSizeLow=0x1964, dwReserved0=0x0, dwReserved1=0x0, cFileName="HXqTbrXKAf9-HhA8M.gif", cAlternateFileName="HXQTBR~1.GIF")) returned 1 [0082.239] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39907f80, ftCreationTime.dwHighDateTime=0x1d5df70, ftLastAccessTime.dwLowDateTime=0xeef75150, ftLastAccessTime.dwHighDateTime=0x1d5dfe8, ftLastWriteTime.dwLowDateTime=0xeef75150, ftLastWriteTime.dwHighDateTime=0x1d5dfe8, nFileSizeHigh=0x0, nFileSizeLow=0x6f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="I0dOnJ.png", cAlternateFileName="")) returned 1 [0082.239] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6918f2b0, ftCreationTime.dwHighDateTime=0x1d5e681, ftLastAccessTime.dwLowDateTime=0x5780aa30, ftLastAccessTime.dwHighDateTime=0x1d5dcbc, ftLastWriteTime.dwLowDateTime=0x5780aa30, ftLastWriteTime.dwHighDateTime=0x1d5dcbc, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="kFrlN9CHgKv.gif", cAlternateFileName="KFRLN9~1.GIF")) returned 1 [0082.239] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad114100, ftCreationTime.dwHighDateTime=0x1d5de40, ftLastAccessTime.dwLowDateTime=0xb296050, ftLastAccessTime.dwHighDateTime=0x1d5e590, ftLastWriteTime.dwLowDateTime=0xb296050, ftLastWriteTime.dwHighDateTime=0x1d5e590, nFileSizeHigh=0x0, nFileSizeLow=0x14ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="OAVAJiO.gif", cAlternateFileName="")) returned 1 [0082.239] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95db18d0, ftCreationTime.dwHighDateTime=0x1d5e561, ftLastAccessTime.dwLowDateTime=0xd420ebf0, ftLastAccessTime.dwHighDateTime=0x1d5e03a, ftLastWriteTime.dwLowDateTime=0xd420ebf0, ftLastWriteTime.dwHighDateTime=0x1d5e03a, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PO52.png", cAlternateFileName="")) returned 1 [0082.239] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d4b5e60, ftCreationTime.dwHighDateTime=0x1d5e2e9, ftLastAccessTime.dwLowDateTime=0x60dfd740, ftLastAccessTime.dwHighDateTime=0x1d5e667, ftLastWriteTime.dwLowDateTime=0x60dfd740, ftLastWriteTime.dwHighDateTime=0x1d5e667, nFileSizeHigh=0x0, nFileSizeLow=0x80fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPHZc21.png", cAlternateFileName="")) returned 1 [0082.239] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f705510, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0xd8c7a000, ftLastAccessTime.dwHighDateTime=0x1d5dafd, ftLastWriteTime.dwLowDateTime=0xd8c7a000, ftLastWriteTime.dwHighDateTime=0x1d5dafd, nFileSizeHigh=0x0, nFileSizeLow=0xec30, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIS-vK uPQfsQ.png", cAlternateFileName="QIS-VK~1.PNG")) returned 1 [0082.240] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb05820, ftCreationTime.dwHighDateTime=0x1d5e4d4, ftLastAccessTime.dwLowDateTime=0xf84cc210, ftLastAccessTime.dwHighDateTime=0x1d5dbf8, ftLastWriteTime.dwLowDateTime=0xf84cc210, ftLastWriteTime.dwHighDateTime=0x1d5dbf8, nFileSizeHigh=0x0, nFileSizeLow=0x15060, dwReserved0=0x0, dwReserved1=0x0, cFileName="rcRe_S1.png", cAlternateFileName="")) returned 1 [0082.240] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4ae6d70, ftCreationTime.dwHighDateTime=0x1d5e00f, ftLastAccessTime.dwLowDateTime=0x96db2dd0, ftLastAccessTime.dwHighDateTime=0x1d5e36b, ftLastWriteTime.dwLowDateTime=0x96db2dd0, ftLastWriteTime.dwHighDateTime=0x1d5e36b, nFileSizeHigh=0x0, nFileSizeLow=0x14a13, dwReserved0=0x0, dwReserved1=0x0, cFileName="XaKUgl_hFpJZFt.gif", cAlternateFileName="XAKUGL~1.GIF")) returned 1 [0082.240] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.240] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0082.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0082.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0082.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aebb0) returned 1 [0082.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW", nBufferLength=0x105, lpBuffer=0x1c9ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW", lpFilePart=0x0) returned 0x2f [0082.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\", nBufferLength=0x105, lpBuffer=0x1c9ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\", lpFilePart=0x0) returned 0x30 [0082.240] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\*", lpFindFileData=0x1c9ae850 | out: lpFindFileData=0x1c9ae850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed9a37e0, ftCreationTime.dwHighDateTime=0x1d5db3e, ftLastAccessTime.dwLowDateTime=0x4ee8c010, ftLastAccessTime.dwHighDateTime=0x1d5de1a, ftLastWriteTime.dwLowDateTime=0x4ee8c010, ftLastWriteTime.dwHighDateTime=0x1d5de1a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1a808720 [0082.240] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed9a37e0, ftCreationTime.dwHighDateTime=0x1d5db3e, ftLastAccessTime.dwLowDateTime=0x4ee8c010, ftLastAccessTime.dwHighDateTime=0x1d5de1a, ftLastWriteTime.dwLowDateTime=0x4ee8c010, ftLastWriteTime.dwHighDateTime=0x1d5de1a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.241] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d06f330, ftCreationTime.dwHighDateTime=0x1d5d9cc, ftLastAccessTime.dwLowDateTime=0x77d14dc0, ftLastAccessTime.dwHighDateTime=0x1d5e406, ftLastWriteTime.dwLowDateTime=0x77d14dc0, ftLastWriteTime.dwHighDateTime=0x1d5e406, nFileSizeHigh=0x0, nFileSizeLow=0x6acc, dwReserved0=0x0, dwReserved1=0x0, cFileName="aBfiJ.gif", cAlternateFileName="")) returned 1 [0082.241] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e08c910, ftCreationTime.dwHighDateTime=0x1d5e13c, ftLastAccessTime.dwLowDateTime=0xc5b97770, ftLastAccessTime.dwHighDateTime=0x1d5dd0c, ftLastWriteTime.dwLowDateTime=0xc5b97770, ftLastWriteTime.dwHighDateTime=0x1d5dd0c, nFileSizeHigh=0x0, nFileSizeLow=0xea4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aSdRxCkBpMk2.bmp", cAlternateFileName="ASDRXC~1.BMP")) returned 1 [0082.241] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f7fd4f0, ftCreationTime.dwHighDateTime=0x1d5dea6, ftLastAccessTime.dwLowDateTime=0xe3c6a2f0, ftLastAccessTime.dwHighDateTime=0x1d5dafb, ftLastWriteTime.dwLowDateTime=0xe3c6a2f0, ftLastWriteTime.dwHighDateTime=0x1d5dafb, nFileSizeHigh=0x0, nFileSizeLow=0x17808, dwReserved0=0x0, dwReserved1=0x0, cFileName="az1_aV.png", cAlternateFileName="")) returned 1 [0082.241] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39a4fe90, ftCreationTime.dwHighDateTime=0x1d5e526, ftLastAccessTime.dwLowDateTime=0xffd456d0, ftLastAccessTime.dwHighDateTime=0x1d5d7eb, ftLastWriteTime.dwLowDateTime=0xffd456d0, ftLastWriteTime.dwHighDateTime=0x1d5d7eb, nFileSizeHigh=0x0, nFileSizeLow=0xd3aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="cto6RPrcfEZJ.jpg", cAlternateFileName="CTO6RP~1.JPG")) returned 1 [0082.241] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd652a700, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0x46176090, ftLastAccessTime.dwHighDateTime=0x1d5e635, ftLastWriteTime.dwLowDateTime=0x46176090, ftLastWriteTime.dwHighDateTime=0x1d5e635, nFileSizeHigh=0x0, nFileSizeLow=0x178d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3u0T-U8E7uUTede_AVG.bmp", cAlternateFileName="D3U0T-~1.BMP")) returned 1 [0082.242] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdc8930, ftCreationTime.dwHighDateTime=0x1d5e5a4, ftLastAccessTime.dwLowDateTime=0x5a56a140, ftLastAccessTime.dwHighDateTime=0x1d5e5f6, ftLastWriteTime.dwLowDateTime=0x5a56a140, ftLastWriteTime.dwHighDateTime=0x1d5e5f6, nFileSizeHigh=0x0, nFileSizeLow=0x7be1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea5wQTp.gif", cAlternateFileName="")) returned 1 [0082.242] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81931ba0, ftCreationTime.dwHighDateTime=0x1d5db86, ftLastAccessTime.dwLowDateTime=0x6d629700, ftLastAccessTime.dwHighDateTime=0x1d5def1, ftLastWriteTime.dwLowDateTime=0x6d629700, ftLastWriteTime.dwHighDateTime=0x1d5def1, nFileSizeHigh=0x0, nFileSizeLow=0x11033, dwReserved0=0x0, dwReserved1=0x0, cFileName="h7faehRiRaOu0.jpg", cAlternateFileName="H7FAEH~1.JPG")) returned 1 [0082.242] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388c29f0, ftCreationTime.dwHighDateTime=0x1d5dc72, ftLastAccessTime.dwLowDateTime=0xde4d8c50, ftLastAccessTime.dwHighDateTime=0x1d5dd1a, ftLastWriteTime.dwLowDateTime=0xde4d8c50, ftLastWriteTime.dwHighDateTime=0x1d5dd1a, nFileSizeHigh=0x0, nFileSizeLow=0x1964, dwReserved0=0x0, dwReserved1=0x0, cFileName="HXqTbrXKAf9-HhA8M.gif", cAlternateFileName="HXQTBR~1.GIF")) returned 1 [0082.242] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39907f80, ftCreationTime.dwHighDateTime=0x1d5df70, ftLastAccessTime.dwLowDateTime=0xeef75150, ftLastAccessTime.dwHighDateTime=0x1d5dfe8, ftLastWriteTime.dwLowDateTime=0xeef75150, ftLastWriteTime.dwHighDateTime=0x1d5dfe8, nFileSizeHigh=0x0, nFileSizeLow=0x6f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="I0dOnJ.png", cAlternateFileName="")) returned 1 [0082.242] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6918f2b0, ftCreationTime.dwHighDateTime=0x1d5e681, ftLastAccessTime.dwLowDateTime=0x5780aa30, ftLastAccessTime.dwHighDateTime=0x1d5dcbc, ftLastWriteTime.dwLowDateTime=0x5780aa30, ftLastWriteTime.dwHighDateTime=0x1d5dcbc, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="kFrlN9CHgKv.gif", cAlternateFileName="KFRLN9~1.GIF")) returned 1 [0082.242] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad114100, ftCreationTime.dwHighDateTime=0x1d5de40, ftLastAccessTime.dwLowDateTime=0xb296050, ftLastAccessTime.dwHighDateTime=0x1d5e590, ftLastWriteTime.dwLowDateTime=0xb296050, ftLastWriteTime.dwHighDateTime=0x1d5e590, nFileSizeHigh=0x0, nFileSizeLow=0x14ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="OAVAJiO.gif", cAlternateFileName="")) returned 1 [0082.242] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95db18d0, ftCreationTime.dwHighDateTime=0x1d5e561, ftLastAccessTime.dwLowDateTime=0xd420ebf0, ftLastAccessTime.dwHighDateTime=0x1d5e03a, ftLastWriteTime.dwLowDateTime=0xd420ebf0, ftLastWriteTime.dwHighDateTime=0x1d5e03a, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PO52.png", cAlternateFileName="")) returned 1 [0082.243] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d4b5e60, ftCreationTime.dwHighDateTime=0x1d5e2e9, ftLastAccessTime.dwLowDateTime=0x60dfd740, ftLastAccessTime.dwHighDateTime=0x1d5e667, ftLastWriteTime.dwLowDateTime=0x60dfd740, ftLastWriteTime.dwHighDateTime=0x1d5e667, nFileSizeHigh=0x0, nFileSizeLow=0x80fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPHZc21.png", cAlternateFileName="")) returned 1 [0082.243] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f705510, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0xd8c7a000, ftLastAccessTime.dwHighDateTime=0x1d5dafd, ftLastWriteTime.dwLowDateTime=0xd8c7a000, ftLastWriteTime.dwHighDateTime=0x1d5dafd, nFileSizeHigh=0x0, nFileSizeLow=0xec30, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIS-vK uPQfsQ.png", cAlternateFileName="QIS-VK~1.PNG")) returned 1 [0082.243] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb05820, ftCreationTime.dwHighDateTime=0x1d5e4d4, ftLastAccessTime.dwLowDateTime=0xf84cc210, ftLastAccessTime.dwHighDateTime=0x1d5dbf8, ftLastWriteTime.dwLowDateTime=0xf84cc210, ftLastWriteTime.dwHighDateTime=0x1d5dbf8, nFileSizeHigh=0x0, nFileSizeLow=0x15060, dwReserved0=0x0, dwReserved1=0x0, cFileName="rcRe_S1.png", cAlternateFileName="")) returned 1 [0082.243] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4ae6d70, ftCreationTime.dwHighDateTime=0x1d5e00f, ftLastAccessTime.dwLowDateTime=0x96db2dd0, ftLastAccessTime.dwHighDateTime=0x1d5e36b, ftLastWriteTime.dwLowDateTime=0x96db2dd0, ftLastWriteTime.dwHighDateTime=0x1d5e36b, nFileSizeHigh=0x0, nFileSizeLow=0x14a13, dwReserved0=0x0, dwReserved1=0x0, cFileName="XaKUgl_hFpJZFt.gif", cAlternateFileName="XAKUGL~1.GIF")) returned 1 [0082.243] FindNextFileW (in: hFindFile=0x1a808720, lpFindFileData=0x1c9ae8a0 | out: lpFindFileData=0x1c9ae8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4ae6d70, ftCreationTime.dwHighDateTime=0x1d5e00f, ftLastAccessTime.dwLowDateTime=0x96db2dd0, ftLastAccessTime.dwHighDateTime=0x1d5e36b, ftLastWriteTime.dwLowDateTime=0x96db2dd0, ftLastWriteTime.dwHighDateTime=0x1d5e36b, nFileSizeHigh=0x0, nFileSizeLow=0x14a13, dwReserved0=0x0, dwReserved1=0x0, cFileName="XaKUgl_hFpJZFt.gif", cAlternateFileName="XAKUGL~1.GIF")) returned 0 [0082.243] FindClose (in: hFindFile=0x1a808720 | out: hFindFile=0x1a808720) returned 1 [0082.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeb00) returned 1 [0082.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aeac0) returned 1 [0082.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", lpFilePart=0x0) returned 0x39 [0082.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\abfij.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.244] GetFileType (hFile=0x2b8) returned 0x1 [0082.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.244] GetFileType (hFile=0x2b8) returned 0x1 [0082.244] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x6acc [0082.244] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=27330, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x6ac2 [0082.244] ReadFile (in: hFile=0x2b8, lpBuffer=0x27373c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x27373c8*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.245] CloseHandle (hObject=0x2b8) returned 1 [0082.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", lpFilePart=0x0) returned 0x39 [0082.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\abfij.gif"), fInfoLevelId=0x0, lpFileInformation=0x27a3e58 | out: lpFileInformation=0x27a3e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d06f330, ftCreationTime.dwHighDateTime=0x1d5d9cc, ftLastAccessTime.dwLowDateTime=0x77d14dc0, ftLastAccessTime.dwHighDateTime=0x1d5e406, ftLastWriteTime.dwLowDateTime=0x77d14dc0, ftLastWriteTime.dwHighDateTime=0x1d5e406, nFileSizeHigh=0x0, nFileSizeLow=0x6acc)) returned 1 [0082.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", lpFilePart=0x0) returned 0x39 [0082.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\abfij.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.247] GetFileType (hFile=0x2b8) returned 0x1 [0082.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.247] GetFileType (hFile=0x2b8) returned 0x1 [0082.247] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x6acc [0082.247] ReadFile (in: hFile=0x2b8, lpBuffer=0x27a40d0, nNumberOfBytesToRead=0x6acc, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x27a40d0*, lpNumberOfBytesRead=0x1c9aea98*=0x6acc, lpOverlapped=0x0) returned 1 [0082.247] CloseHandle (hObject=0x2b8) returned 1 [0082.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", lpFilePart=0x0) returned 0x39 [0082.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\abfij.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.270] GetFileType (hFile=0x2b8) returned 0x1 [0082.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.270] GetFileType (hFile=0x2b8) returned 0x1 [0082.270] WriteFile (in: hFile=0x2b8, lpBuffer=0x283c2d0*, nNumberOfBytesToWrite=0x6ad0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x283c2d0*, lpNumberOfBytesWritten=0x1c9aeb28*=0x6ad0, lpOverlapped=0x0) returned 1 [0082.271] CloseHandle (hObject=0x2b8) returned 1 [0082.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", lpFilePart=0x0) returned 0x39 [0082.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", lpFilePart=0x0) returned 0x39 [0082.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\abfij.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.272] GetFileType (hFile=0x2b8) returned 0x1 [0082.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.272] GetFileType (hFile=0x2b8) returned 0x1 [0082.272] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x6ad0 [0082.274] WriteFile (in: hFile=0x2b8, lpBuffer=0x2843c90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x1c9aeb48, lpOverlapped=0x0 | out: lpBuffer=0x2843c90*, lpNumberOfBytesWritten=0x1c9aeb48*=0xa, lpOverlapped=0x0) returned 1 [0082.274] CloseHandle (hObject=0x2b8) returned 1 [0082.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif", lpFilePart=0x0) returned 0x39 [0082.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\YUJmaUouZ2lm", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\YUJmaUouZ2lm", lpFilePart=0x0) returned 0x3c [0082.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.274] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\abfij.gif"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d06f330, ftCreationTime.dwHighDateTime=0x1d5d9cc, ftLastAccessTime.dwLowDateTime=0x77d14dc0, ftLastAccessTime.dwHighDateTime=0x1d5e406, ftLastWriteTime.dwLowDateTime=0xd8c2aba0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x6ada)) returned 1 [0082.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.275] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aBfiJ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\abfij.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\YUJmaUouZ2lm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\yujmauouz2lm")) returned 1 [0082.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", lpFilePart=0x0) returned 0x40 [0082.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\asdrxckbpmk2.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.275] GetFileType (hFile=0x2b8) returned 0x1 [0082.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.275] GetFileType (hFile=0x2b8) returned 0x1 [0082.275] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xea4a [0082.276] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=59968, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xea40 [0082.276] ReadFile (in: hFile=0x2b8, lpBuffer=0x2845040, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2845040*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.276] CloseHandle (hObject=0x2b8) returned 1 [0082.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", lpFilePart=0x0) returned 0x40 [0082.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.289] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\asdrxckbpmk2.bmp"), fInfoLevelId=0x0, lpFileInformation=0x26eb0e0 | out: lpFileInformation=0x26eb0e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e08c910, ftCreationTime.dwHighDateTime=0x1d5e13c, ftLastAccessTime.dwLowDateTime=0xc5b97770, ftLastAccessTime.dwHighDateTime=0x1d5dd0c, ftLastWriteTime.dwLowDateTime=0xc5b97770, ftLastWriteTime.dwHighDateTime=0x1d5dd0c, nFileSizeHigh=0x0, nFileSizeLow=0xea4a)) returned 1 [0082.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", lpFilePart=0x0) returned 0x40 [0082.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\asdrxckbpmk2.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.289] GetFileType (hFile=0x2b8) returned 0x1 [0082.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.289] GetFileType (hFile=0x2b8) returned 0x1 [0082.289] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xea4a [0082.290] ReadFile (in: hFile=0x2b8, lpBuffer=0x26eb398, nNumberOfBytesToRead=0xea4a, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x26eb398*, lpNumberOfBytesRead=0x1c9aea98*=0xea4a, lpOverlapped=0x0) returned 1 [0082.290] CloseHandle (hObject=0x2b8) returned 1 [0082.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", lpFilePart=0x0) returned 0x40 [0082.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\asdrxckbpmk2.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.302] GetFileType (hFile=0x2b8) returned 0x1 [0082.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.302] GetFileType (hFile=0x2b8) returned 0x1 [0082.302] WriteFile (in: hFile=0x2b8, lpBuffer=0x278de80*, nNumberOfBytesToWrite=0xea50, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x278de80*, lpNumberOfBytesWritten=0x1c9aeb28*=0xea50, lpOverlapped=0x0) returned 1 [0082.304] CloseHandle (hObject=0x2b8) returned 1 [0082.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", lpFilePart=0x0) returned 0x40 [0082.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", lpFilePart=0x0) returned 0x40 [0082.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\asdrxckbpmk2.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.305] GetFileType (hFile=0x2b8) returned 0x1 [0082.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.305] GetFileType (hFile=0x2b8) returned 0x1 [0082.305] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xea50 [0082.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp", lpFilePart=0x0) returned 0x40 [0082.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\YVNkUnhDa0JwTWsyLmJtcA==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\YVNkUnhDa0JwTWsyLmJtcA==", lpFilePart=0x0) returned 0x48 [0082.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\asdrxckbpmk2.bmp"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e08c910, ftCreationTime.dwHighDateTime=0x1d5e13c, ftLastAccessTime.dwLowDateTime=0xc5b97770, ftLastAccessTime.dwHighDateTime=0x1d5dd0c, ftLastWriteTime.dwLowDateTime=0xd8c76e60, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xea5a)) returned 1 [0082.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.305] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\aSdRxCkBpMk2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\asdrxckbpmk2.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\YVNkUnhDa0JwTWsyLmJtcA==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\yvnkunhda0jwtwsylmjtca==")) returned 1 [0082.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", lpFilePart=0x0) returned 0x3a [0082.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\az1_av.png"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.306] GetFileType (hFile=0x2b8) returned 0x1 [0082.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.306] GetFileType (hFile=0x2b8) returned 0x1 [0082.306] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x17808 [0082.306] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=96254, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x177fe [0082.306] ReadFile (in: hFile=0x2b8, lpBuffer=0x279ec18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x279ec18*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.307] CloseHandle (hObject=0x2b8) returned 1 [0082.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11af8) returned 0x0 [0082.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", lpFilePart=0x0) returned 0x3a [0082.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.310] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\az1_av.png"), fInfoLevelId=0x0, lpFileInformation=0x280b5e8 | out: lpFileInformation=0x280b5e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f7fd4f0, ftCreationTime.dwHighDateTime=0x1d5dea6, ftLastAccessTime.dwLowDateTime=0xe3c6a2f0, ftLastAccessTime.dwHighDateTime=0x1d5dafb, ftLastWriteTime.dwLowDateTime=0xe3c6a2f0, ftLastWriteTime.dwHighDateTime=0x1d5dafb, nFileSizeHigh=0x0, nFileSizeLow=0x17808)) returned 1 [0082.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", lpFilePart=0x0) returned 0x3a [0082.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\az1_av.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.310] GetFileType (hFile=0x2b8) returned 0x1 [0082.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.310] GetFileType (hFile=0x2b8) returned 0x1 [0082.310] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0x17808 [0082.310] ReadFile (in: hFile=0x2b8, lpBuffer=0x1267ee20, nNumberOfBytesToRead=0x17808, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x1267ee20*, lpNumberOfBytesRead=0x1c9aea98*=0x17808, lpOverlapped=0x0) returned 1 [0082.312] CloseHandle (hObject=0x2b8) returned 1 [0082.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", lpFilePart=0x0) returned 0x3a [0082.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\az1_av.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.330] GetFileType (hFile=0x2b8) returned 0x1 [0082.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.330] GetFileType (hFile=0x2b8) returned 0x1 [0082.330] WriteFile (in: hFile=0x2b8, lpBuffer=0x126f4708*, nNumberOfBytesToWrite=0x17810, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x126f4708*, lpNumberOfBytesWritten=0x1c9aeb28*=0x17810, lpOverlapped=0x0) returned 1 [0082.332] CloseHandle (hObject=0x2b8) returned 1 [0082.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", lpFilePart=0x0) returned 0x3a [0082.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", lpFilePart=0x0) returned 0x3a [0082.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\az1_av.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.333] GetFileType (hFile=0x2b8) returned 0x1 [0082.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.333] GetFileType (hFile=0x2b8) returned 0x1 [0082.333] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0x17810 [0082.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png", lpFilePart=0x0) returned 0x3a [0082.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\YXoxX2FWLnBuZw==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\YXoxX2FWLnBuZw==", lpFilePart=0x0) returned 0x40 [0082.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\az1_av.png"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f7fd4f0, ftCreationTime.dwHighDateTime=0x1d5dea6, ftLastAccessTime.dwLowDateTime=0xe3c6a2f0, ftLastAccessTime.dwHighDateTime=0x1d5dafb, ftLastWriteTime.dwLowDateTime=0xd8c9cfc0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x1781a)) returned 1 [0082.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.334] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\az1_aV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\az1_av.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\YXoxX2FWLnBuZw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\yxoxx2fwlnbuzw==")) returned 1 [0082.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", lpFilePart=0x0) returned 0x40 [0082.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\cto6rprcfezj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.334] GetFileType (hFile=0x2b8) returned 0x1 [0082.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.344] GetFileType (hFile=0x2b8) returned 0x1 [0082.344] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0xd3aa [0082.344] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=54176, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0xd3a0 [0082.344] ReadFile (in: hFile=0x2b8, lpBuffer=0x2884630, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x2884630*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.345] CloseHandle (hObject=0x2b8) returned 1 [0082.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", lpFilePart=0x0) returned 0x40 [0082.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb10) returned 1 [0082.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\cto6rprcfezj.jpg"), fInfoLevelId=0x0, lpFileInformation=0x28f0ed8 | out: lpFileInformation=0x28f0ed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39a4fe90, ftCreationTime.dwHighDateTime=0x1d5e526, ftLastAccessTime.dwLowDateTime=0xffd456d0, ftLastAccessTime.dwHighDateTime=0x1d5d7eb, ftLastWriteTime.dwLowDateTime=0xffd456d0, ftLastWriteTime.dwHighDateTime=0x1d5d7eb, nFileSizeHigh=0x0, nFileSizeLow=0xd3aa)) returned 1 [0082.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aead0) returned 1 [0082.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", lpFilePart=0x0) returned 0x40 [0082.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9ae9d0) returned 1 [0082.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\cto6rprcfezj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.351] GetFileType (hFile=0x2b8) returned 0x1 [0082.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae940) returned 1 [0082.351] GetFileType (hFile=0x2b8) returned 0x1 [0082.351] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aeb68 | out: lpFileSizeHigh=0x1c9aeb68*=0x0) returned 0xd3aa [0082.352] ReadFile (in: hFile=0x2b8, lpBuffer=0x28f1190, nNumberOfBytesToRead=0xd3aa, lpNumberOfBytesRead=0x1c9aea98, lpOverlapped=0x0 | out: lpBuffer=0x28f1190*, lpNumberOfBytesRead=0x1c9aea98*=0xd3aa, lpOverlapped=0x0) returned 1 [0082.352] CloseHandle (hObject=0x2b8) returned 1 [0082.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", lpFilePart=0x0) returned 0x40 [0082.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aea00) returned 1 [0082.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\cto6rprcfezj.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.373] GetFileType (hFile=0x2b8) returned 0x1 [0082.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9ae970) returned 1 [0082.373] GetFileType (hFile=0x2b8) returned 0x1 [0082.374] WriteFile (in: hFile=0x2b8, lpBuffer=0x298f600*, nNumberOfBytesToWrite=0xd3b0, lpNumberOfBytesWritten=0x1c9aeb28, lpOverlapped=0x0 | out: lpBuffer=0x298f600*, lpNumberOfBytesWritten=0x1c9aeb28*=0xd3b0, lpOverlapped=0x0) returned 1 [0082.375] CloseHandle (hObject=0x2b8) returned 1 [0082.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", lpFilePart=0x0) returned 0x40 [0082.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", lpFilePart=0x0) returned 0x40 [0082.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeaa0) returned 1 [0082.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\cto6rprcfezj.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.376] GetFileType (hFile=0x2b8) returned 0x1 [0082.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea10) returned 1 [0082.376] GetFileType (hFile=0x2b8) returned 0x1 [0082.376] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1c9aea88*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x1c9aea88*=0) returned 0xd3b0 [0082.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg", lpFilePart=0x0) returned 0x40 [0082.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\Y3RvNlJQcmNmRVpKLmpwZw==", nBufferLength=0x105, lpBuffer=0x1c9ae690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\Y3RvNlJQcmNmRVpKLmpwZw==", lpFilePart=0x0) returned 0x48 [0082.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aead0) returned 1 [0082.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\cto6rprcfezj.jpg"), fInfoLevelId=0x0, lpFileInformation=0x1c9aebb0 | out: lpFileInformation=0x1c9aebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39a4fe90, ftCreationTime.dwHighDateTime=0x1d5e526, ftLastAccessTime.dwLowDateTime=0xffd456d0, ftLastAccessTime.dwHighDateTime=0x1d5d7eb, ftLastWriteTime.dwLowDateTime=0xd8d0f3e0, ftLastWriteTime.dwHighDateTime=0x1d5f1ef, nFileSizeHigh=0x0, nFileSizeLow=0xd3ba)) returned 1 [0082.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea90) returned 1 [0082.377] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\cto6RPrcfEZJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\cto6rprcfezj.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\Y3RvNlJQcmNmRVpKLmpwZw==" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\y3rvnljqcmnmrvpklmpwzw==")) returned 1 [0082.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\d3u0T-U8E7uUTede_AVG.bmp", nBufferLength=0x105, lpBuffer=0x1c9ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\d3u0T-U8E7uUTede_AVG.bmp", lpFilePart=0x0) returned 0x48 [0082.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1c9aeb00) returned 1 [0082.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_IuQjjMW\\d3u0T-U8E7uUTede_AVG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_iuqjjmw\\d3u0t-u8e7uutede_avg.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b8 [0082.378] GetFileType (hFile=0x2b8) returned 0x1 [0082.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1c9aea70) returned 1 [0082.378] GetFileType (hFile=0x2b8) returned 0x1 [0082.378] GetFileSize (in: hFile=0x2b8, lpFileSizeHigh=0x1c9aecc8 | out: lpFileSizeHigh=0x1c9aecc8*=0x0) returned 0x178d4 [0082.378] SetFilePointer (in: hFile=0x2b8, lDistanceToMove=96458, lpDistanceToMoveHigh=0x1c9aec28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1c9aec28*=0) returned 0x178ca [0082.378] ReadFile (in: hFile=0x2b8, lpBuffer=0x299ed38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c9aebf8, lpOverlapped=0x0 | out: lpBuffer=0x299ed38*, lpNumberOfBytesRead=0x1c9aebf8*=0xa, lpOverlapped=0x0) returned 1 [0082.379] CloseHandle (hObject=0x2b8) returned 1 [0082.379] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12641930, Length=0x20000, ResultLength=0x1c9aeb20 | out: SystemInformation=0x12641930, ResultLength=0x1c9aeb20*=0x11aa8) returned 0x0 Thread: id = 8 os_tid = 0x598 Thread: id = 9 os_tid = 0x67c Thread: id = 10 os_tid = 0x54c Thread: id = 11 os_tid = 0x20c